Agents learn—with boundaries

Recall before, capture after

LearningMemory stores scoped episodes with confidence, success and failure counts, expiry, and optional time decay. Memory is isolated by agent type, durable instance, and tenant.

class InvoiceAgent extends Agent {
  static override learning = {
    minConfidence: 0.8,
    scope: 'invoice-extraction'
  };

  async run() {
    const strategy = this.recalledMemories[0]?.value
      ?? await this.discoverStrategy();

    this.stageLearning({ key: this.documentId, value: strategy });
    if (!this.validated) this.reportLearningOutcome({ success: false });
  }
}

Personas make one agent class many durable workers

A tenant can create several AgentPersona records for one class. Each can have its own instructions, tool ceiling, principal, schedule, dispatch subscriber, and memory scope. The default persona preserves the old singleton identity for a non-destructive upgrade.

Adaptation stops at a human gate

Feedback reinforces memory automatically. A reflection runner may draft a DirectiveProposal, but it cannot activate the rewrite. A principal with personas.activate-directive must approve it, and the accepted text becomes a scoped prompt override.

Agents can delegate without widening authority

The invoke-agent tool carries an immutable principal through worker calls. It intersects RBAC with agent and persona tool ceilings. Delegation depth has a maximum of three. Correlated completion events return to the conversation.

Which agents a tenant may run

Availability is a binding between a tenant and an agent class. It inherits down the tenant tree. The resolver merges manifest permission defaults under each explicit override. It checks ancestors for agents that the tenant did not enable. Each result identifies its local or inherited source. Direct reads of the binding rows answer a narrower question and skip this resolution.

• Enable, disable, or clear an override per tenant and agent class.
• An override that is cleared falls back to inheritance rather than to off.
• Stored agent configuration is treated as sensitive and is sanitized before it reaches a browser.

The host decides when an agent stops

An agent does not take over the process. Signal handling is optional for each instance. Thus, a server or job runner owns shutdown by default. A single-agent script can request signal handling explicitly. Schedules are declared with the agent and executed by the background job runner. Thus, the application selects the execution host instead of the agent model.