Speaks-For Calculus

Lampson–Abadi–Burrows–Wobber’s (1992) formalism for distributed authentication, delegation, and who is entitled to assert what on whose behalf. The primitives are says (principal A asserts statement s, written A says s) and speaks-for (A ⇒ B — anything A says, B says). The principal algebra is rich: atomic principals (users, processes, keys), conjunction A ∧ B, quoting A | B (A speaking on behalf of B), roles A as R, and for-channel A for K. Speaks-for facts are witnessed by signed certificates; authentication is checking chains of certificates from a trusted root. Access control then grants rights to principals at any level of compoundness. The calculus is the formal vocabulary underlying SPKI/SDSI, DIDs and Verifiable Credentials, modern attribute-based authorisation, and any system that needs to reason about delegated commitment.

In this vault

Authentication in Distributed Systems - Lampson Abadi Burrows Wobber — the founding paper
A Logic of Authentication — BAN Logic (1990) for protocol-level reasoning
Spi Calculus — pi-calculus with cryptography
SPKI-SDSI — capability-style PKI built on speaks-for
Decentralized Identifiers
Capability Myths Demolished
Programming Semantics for Multiprogrammed Computations — the Object Capability dual view
The Heart of Spritely - Distributed Objects and Capability Security
An Ontology for Commitments in Multiagent Systems - Singh — delegated commitments
Distributed Security
Agent Infrastructure
CBCL - Safe Self-Extending Agent Communication — signed-verdict architecture

Backlinks

Linked Pages

CBCL - Safe Self-Extending Agent Communication

CBCL: Safe Self-Extending Agent Communication

Reference: O’Connor, H. (2026). LangSec Workshop, IEEE Security and Privacy Workshops (SPW 2026). arXiv:2604.14512v1 [cs.CR], 16 Apr 2026. Source file: oconnor-cbcl-langsec26.pdf. URL. Reference implementation: https://codeberg.org/anuna/cbcl-rs.

Summary

Building on McCarthy’s 1975/1982 Common Business Communication Language vision and the language-theoretic security programme of Sassaman, Patterson, Bratus and Locasto (Security Applications Of Formal Language Theory), this paper presents a contemporary CBCL: an agent communication language designed so that all messages — including runtime language extensions — remain within the deterministic context-free (DCFL) complexity class. The motivating diagnosis is that contemporary agent communication has slid up the Chomsky hierarchy without acknowledging the security cost: KQML and FIPA-ACL are CFL with informal extensibility, but MCP and LLM-based agent frameworks operate over inputs whose effective complexity is recursively-enumerable, where the validity of an arbitrary message is undecidable and “weird machines” (Exploit Programming - From Buffer Overflows To Weird Machines) become unavoidable. CBCL takes the opposite tack: minimal core (8 performatives — tell, ask, reply, hello, bye, ok, error, cancel) plus a homoiconic dialect mechanism that lets agents define, transmit, and adopt domain-specific vocabularies as first-class CBCL messages, with three machine-checked safety invariants — R1 (no recursion in dialect templates), R2 (declared resource bounds on depth, expansion size, verification time), R3 (core-vocabulary preservation) — that together guarantee DCFL preservation under arbitrary finite sequences of dialect installations.

The paper accompanies the design with a Lean 4 formalization (≈5,400 lines, 16 modules, 176 machine-checked theorems, zero sorry gaps, no custom axioms) covering parser correctness (soundness + completeness), R1–R3 verification, pipeline totality, and the central dcfl_preserved closure theorem; a verified parser binary cbcl-parse is extracted from the proofs. A separately-developed Rust reference implementation (cbcl-rs, ≈11,000 lines, no_std-compatible core) ships a hand-rolled O(n) parser, dialect verification engine, gossip-based dialect propagation (O(log n) convergence per Demers et al.), C FFI/WASM bindings, property-based and differential tests, and cargo-fuzz targets; differential tests cross-validate the Rust parser against the Lean-extracted binary, eliminating spec-implementation parser differentials. Five example dialects (precision agriculture, AI planning, cross-chain asset transfer, artifact management, email) are R1–R3-verified end-to-end. A draft IETF Internet-Draft specifying application/cbcl and a Nostr transport binding (cbcl-nostr) accompany the paper. The Discussion explicitly aligns the design with Singh’s social-agency programme: dialect installation is treated as a public commitment to the dialect’s declared semantics — semantic divergence becomes a breach of commitment, observable and accountable, rather than a hidden failure of shared mental state — sidestepping the unverifiable mentalistic semantics critique of Verifiable Semantics for ACLs.

Implementation status (post-paper, cbcl-rs). The reference implementation has shipped two further safety invariants the paper sketches as future work, plus a richer Lean formalisation: R4 (Integrity) — Ed25519-style signatures over canonical encodings via an algorithm-agnostic Signer trait, with three-valued install verdicts (Valid / Unsigned / Invalid) — and R5 (Contract Well-formedness) — optional (protocol …) and (shape …) clauses on a dialect, expressing causal Merkle DAG protocols and per-performative shape contracts; R5 enforces acyclicity, reachability from begin, performative definedness with ancestor closure for extends, step uniqueness, and depth-bound respect, all decidable in linear fuel at install time. The §VII-D structural-contracts vision is therefore live (SPEC-002, SPEC-003): verify_monotone, verify_all_is_meet, and verify_eventually_consistent are proved theorems showing causal-protocol verification is a lattice homomorphism that joins coordination-free under G-Set store merge — explicit CALM Theorem alignment. The Lean codebase has grown to 380+ declarations across 19 files (still zero sorry, only the standard axioms propext / Classical.choice / Quot.sound); the workspace ships 837 tests including 584 cbcl-core unit tests, 37 proptest cases, 21 differential integration tests against the Lean-extracted binary, libFuzzer harnesses, and cargo-mutants mutation testing at a 90% kill threshold. The crate layout has grown from the paper’s five to seven: the original cbcl-core / cbcl-parser / cbcl-cli / cbcl-wasm / cbcl-ffi plus cbcl-erl (Erlang/LFE binding, SPEC-009 — with SPEC-010 binding-conformance suite) and cbcl-arena (Agent Arena platform, SPEC-012 — composable referee on cbcl-lfe-router with capability-keyed message routing and signed receipt logs). A worked sealed-bid auction dialect (SPEC-004) demonstrates structural defence against false-claim manipulation — concrete evidence that the R5 contract layer is rich enough to encode mechanism-design integrity properties decidably. The earlier Scheme prototype (anuna-research/cbcl) is superseded; architecture decisions live as ADRs under .hence/ (purity boundary, parser library choice, error handling, WASM API surface, R4 adversarial review).

Key Ideas

DCFL as the Goldilocks complexity class: Regular is too weak for nested envelopes/dialects; general CFL admits ambiguous grammars and parser-differential attacks; context-sensitive is PSPACE-complete; Type-0 is undecidable. DCFL is the minimal class that supports nested structure with class-level unambiguity (parser equivalence under language evolution).
Homoiconic self-extension: Dialect definitions are themselves valid CBCL messages, parsed by the same recogniser used for ordinary communication — a single attack surface, no separate meta-language. Inspired by Racket’s #lang mechanism.
Three safety invariants R1–R3: declarative pattern-template substitution only (no recursion, no iteration, no reflection); declared resource bounds (depth ≤ 64, expansion ≤ 8192 chars, verification ≤ 1000 ms); the eight core performatives cannot be redefined.
DCFL preservation theorem: dialect invocations must appear inside a (lang name …) wrapper; the lang tag plus a unique dialect name forms a prefix-free partition that lets a deterministic pushdown automaton dispatch to the appropriate subgrammar without extra lookahead — circumventing the fact that DCFLs are not closed under union in general. Mechanised in Lean 4 as dcfl_preserved.
Lean 4 formalization with extraction: 176 theorems, 0 sorry gaps, no custom axioms; the verified parser binary cbcl-parse is extracted from the proofs and runs the same fuel-bounded recursive-descent parser as the model.
Rust reference implementation: cbcl-core (no_std, no unsafe), cbcl-parser, cbcl-cli, cbcl-ffi, cbcl-wasm. Differential tests against the Lean-extracted binary; cargo-fuzz over five entry points.
Eight core performatives (tell, ask, reply, hello, bye, ok, error, cancel) plus four message categories (simple, meta, lang-scoped, wrapped); keyword parameters in Common-Lisp style (:thread, :in-reply-to).
Single-pass template expansion: terminates in time linear in the template plus argument size; not Turing-complete; output is not fed back into the expander, ruling out unbounded re-expansion.
Epidemic dialect propagation: gossip-based with Demers et al.’s O(log n) convergence bound; agents independently verify R1–R3 and signatures before installing.
Canonical serialization per RFC 9804 for cryptographic operations — deterministic byte representation as a precondition for signature verification.
Dialect identity by content hash: name collisions resolved by canonical-form hash; downgrade attacks rejected at installation.
Self-expression vs self-adaptation (Zambonelli et al.): traditional ACLs support only parameter tuning within fixed structure; CBCL is a self-expressive protocol whose vocabulary structurally evolves under safety constraints.
Singh-aligned reading of dialect installation: a public commitment to declared semantics, with :examples clauses providing machine-checkable behavioural anchors — semantic divergence as observable breach rather than hidden mental-state mismatch.
Stated limitations: DCFL ceiling means no recursive transformations, no cross-field references (e.g. checksums over fields), no aggregation over variable-length collections, no context-sensitive validation. Standish-taxonomy paraphrastic only — no Orthophrase, no Metaphrase. Trust infrastructure (key distribution, revocation) and dialect-curation policy left to deployment.
Structural-contracts extension (sketched in §VII-D, shipped post-paper as R4 + R5): Ed25519-style dialect signatures plus protocol constraints as causal Merkle DAGs over performative-typed messages, with Visibly Pushdown Languages for shape constraints and coordination-free monotonic verification over an append-only store. Lean-mechanised lattice-homomorphism theorems (verify_monotone, verify_all_is_meet, verify_eventually_consistent) establish that replica verdicts join under G-Set merge.

Connections

Common Business Communication Language — McCarthy’s 1975/1982 origin; CBCL is the formally-verified realisation of that vision.
Security Applications Of Formal Language Theory — Sassaman et al.’s LangSec foundations.
Proof-Carrying Code - Necula — Necula 1997, the architectural ancestor of CBCL’s R4 split (host runs a small certified verifier; producer ships the proof).
Enforceable Security Policies - Schneider — Schneider 2000, the formal warrant for R5 monotone-verdict trace monitoring.
An Axiomatic Basis for Computer Programming - Hoare — Hoare 1969, root of the contract-based verification line CBCL inherits.
Authentication in Distributed Systems - Lampson Abadi Burrows Wobber — Lampson et al. 1992, the Speaks-For Calculus for delegated commitments.
Articulating Reasons - Brandom — Brandom 2000, the philosophical underwriting of Public Semantics (entry point).
Making It Explicit - Brandom — Brandom 1994, the full inferentialist treatise.
Empiricism and the Philosophy of Mind - Sellars — Sellars 1956, the Myth of the Given that makes Semantics-Without-Minds possible.
Philosophical Investigations - Wittgenstein — Wittgenstein 1953, Meaning As Use / language-games / rule-following.
Two Dogmas of Empiricism - Quine — Quine 1951, Semantic Holism.
Assertion - Stalnaker — Stalnaker 1978, Common Ground update semantics — operational analogue of CBCL’s verdict ledger.
Languages and Language - Lewis — Lewis 1975, Convention of Truthfulness picture of how an abstract language gets in force in a population.
Communicative Actions for Artificial Agents - Cohen Levesque — Cohen & Levesque 1995, the Mentalistic Semantics high-water mark CBCL deliberately is not.
FIPA-ACL Specifications — the engineering of FIPA-ACL (envelope, conversation-id, ontology slot) CBCL inherits; the semantics it replaces.
An Ontology for Commitments in Multiagent Systems - Singh — Singh 1999, the formal commitment ontology CBCL’s dialect contracts instantiate.
Jones-Sergot Normative Systems — Jones & Sergot 1993, the Counts-As Relation that gives wire events institutional meaning under a dialect contract.
Exploit Programming - From Buffer Overflows To Weird Machines — weird-machine analysis CBCL is designed to preclude at the parser layer.
PKI Layer Cake - Kaminsky Patterson Sassaman — concrete parser-differential attacks; CBCL’s class-level unambiguity rules these out at the grammar level.
The Halting Problems of Network Stack Insecurity
A Language-Based Approach To Prevent DDoS
LangSec
KQML as an Agent Communication Language
KQML - A Language And Protocol For Knowledge And Information Exchange
FIPA-ACL
ACL Rethinking Principles — Singh’s social-agency critique that CBCL’s “dialect installation as public commitment” inherits.
Agent Communication Languages - Rethinking the Principles
Verifiable Semantics for ACLs
A Common Ontology Of ACLs
Commitment-based Semantics
The State of the Art in Agent Communication Languages
Trends in Agent Communication Language
Toward Principles for the Design of Ontologies Used for Knowledge Sharing — Gruber’s ontological-commitment principle CBCL inherits.
Some Philosophical Problems from the Standpoint of Artificial Intelligence — McCarthy & Hayes’s representation/computation separation.
Elephant 2000 - A Programming Language Based on Speech Acts — McCarthy’s intra-program speech-act counterpart to CBCL’s inter-organisational vision.
Adjectival Modifiers
S-expression
Homoiconicity
Code as Data
Creating Languages in Racket — Flatt’s #lang mechanism that inspired CBCL’s homoiconic self-extension.
Extensibility in Programming Language Design - Standish
Language Extensibility Taxonomy
Paraphrase
Orthophrase
Metaphrase
Self-Expression
Self-Adaptation Self-Expression Self-Awareness ASCENS
Dialects and Idiolects
Keeping CALM - When Distributed Consistency is Easy — CALM theorem underwriting the forthcoming coordination-free contracts extension.
Visibly Pushdown Languages
MCP Landscape Security Threats And Future Research Directions
Survey Of AI Agent Protocols
Survey Of Agent Interoperability Protocols
ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems — concrete LLM-agent worm whose root-cause analysis CBCL’s lang-scoped provenance addresses.
Why AI Agents Communicate In Human Language
Why Do Multi-Agent LLM Systems Fail
Gossiping in Distributed Systems
Gossip-based Aggregation in Large Dynamic Networks

Conceptual Contribution

Claim: Agent communication languages can be simultaneously expressive, runtime-extensible, and tractably verifiable iff every message — including those that extend the language — is constrained to the deterministic context-free language class; this constraint is compatible with first-class self-extension, can be machine-checked end-to-end, and converts the unverifiable-mental-state problem of mentalistic ACLs into a public-commitment problem at the protocol layer.
Mechanism: Eight-performative core grammar (LL(1), DCFL); homoiconic dialect mechanism — dialect definitions are valid CBCL messages with extend clauses describing pattern-template substitutions; three safety invariants R1–R3 enforced at installation (no recursion via DFS cycle detection, declared resource bounds, core-vocabulary preservation); (lang name …) wrapper providing prefix-free deterministic dispatch into per-dialect sub-grammars so the union remains DCFL. Lean 4 formalization (LeanCbcl, ~5,400 LoC, 176 theorems) covering parser soundness/completeness, R1–R3, pipeline totality, and dcfl_preserved; verified parser extracted to a runnable binary (cbcl-parse). Rust reference implementation (cbcl-rs, ~11,000 LoC) with a ResourceContext-tracked single-pass expander, gossip-based dialect propagation (O(log n) per Demers et al.), canonical RFC-9804 serialization for signing, algorithm-agnostic Signer trait, C FFI / WASM bindings, property-based + differential tests, fuzz targets. Draft IETF application/cbcl Internet-Draft and Nostr transport binding.
Concepts introduced/used: Deterministic Context-Free Language, LangSec, Homoiconicity, S-expression, Dialects and Idiolects, Performatives, Self-Expression, Paraphrase, Orthophrase, Metaphrase, Visibly Pushdown Languages, CALM Theorem, Commitment-based Semantics, Public Semantics, Verifiable Semantics, Adjectival Modifiers, Ontological Commitment, Lean 4, Property-Based Testing, Parser Differential Attack, Weird Machine, Gossip Protocols, Canonical Serialization, Nostr, hence
Stance: engineering / formal-methods, with explicit position-taking on the agent-communication design space
Relates to: Realises McCarthy’s Common Business Communication Language vision (1975/1982) by giving formal safety guarantees McCarthy could only gesture at. Sits squarely in the LangSec programme of Security Applications Of Formal Language Theory and Exploit Programming - From Buffer Overflows To Weird Machines, extending it from input-validation analysis to protocol design — claiming, plausibly, to be the first ACL designed from LangSec principles and the first to demonstrate that LangSec is compatible with runtime self-extension. Inherits the DCFL-vs-ambiguous-CFG argument from PKI Layer Cake - Kaminsky Patterson Sassaman and applies it at the message layer rather than the certificate layer. Builds explicitly on Singh’s social-agency critique (ACL Rethinking Principles) and Wooldridge’s verifiability programme (Verifiable Semantics for ACLs) by treating dialect installation as a public commitment whose semantics are anchored by the :examples clause — a machine-checkable analogue of the commitment-trace conformance that Flexible Protocol Specification and Execution (Yolum & Singh) and Commitment Machines - Yolum and Singh establish for protocol actions. Where Pact - A Choreographic Language for Agentic Ecosystems takes the individual-rationality fork to answer “why follow a protocol?”, CBCL takes the publicness/verifiability fork: the meaning of a message is fully determined by the formal grammar plus declared semantics, with no mental-state inference required. Inherits Gruber’s ontological-commitment architecture but replaces “out-of-band agreement” with in-protocol propose/query/teach. The extensibility design draws on Creating Languages in Racket (Flatt’s #lang) and respects the boundary set by Extensibility in Programming Language Design - Standish: paraphrastic only, deliberately excluding orthophrase/metaphrase to keep the attack surface bounded. The forthcoming structural-contracts extension uses Visibly Pushdown Languages for shape constraints and the CALM Theorem for coordination-free verification — a natural bridge to commitment-machine semantics. The LLM-agent threat-model framing (ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems, MCP Landscape Security Threats And Future Research Directions) positions CBCL as the structural alternative to MCP/JSON-RPC-with-natural-language: same extensibility, vastly tighter security envelope.

Agent Infrastructure

Technical systems and shared protocols external to individual AI agents that mediate their interactions with each other, humans, and institutions. Three core functions per Chan et al. 2025: attribution (agent IDs, credentials, audit), interaction shaping (protocols, mechanism design, reputation), and detection & remediation (anomaly detection, rollback, compensation).

In this vault

Distributed Security

Security of distributed/agent systems: mobile code, secure messaging, language-based defences.

An Ontology for Commitments in Multiagent Systems - Singh

An Ontology for Commitments in Multiagent Systems: Toward a Unification of Normative Concepts

Reference: Singh, M. P. (1999). An Ontology for Commitments in Multiagent Systems: Toward a Unification of Normative Concepts. Artificial Intelligence and Law 7(1): 97–113. Kluwer. DOI · Author copy via Academia.edu · Singh publications (NCSU)

Summary

This paper is the formal core of Singh’s commitment-based programme — a piece that sits between the polemical <em>Rethinking the Principles</em> (1998) and the operationalised commitment machines line (Yolum & Singh 2002). Singh argues that the multiplicity of normative concepts used across MAS, deontic logic, and law — obligation, permission, prohibition, promise, contract, delegation, cancellation, release — can be unified by taking the social commitment as the basic ontological primitive and reconstructing the rest as patterns over commitments. A social commitment is a four-place relation: a debtor is committed to a creditor for the fulfilment of some condition in the context of a particular institution or social scope. Once these four roles are fixed, the standard normative operations — create, discharge, cancel, release, delegate, assign — become commitment-state transitions, and the deontic vocabulary becomes a derived layer over the commitment substrate.

The construction is deliberately public: commitments live in the social state, not in the heads of any agent. A commitment exists when a publicly observable act has created it (a promise speech act, a contract signing, an assertion under appropriate sincerity context); it persists until a publicly observable act has discharged or cancelled it. The truth-conditions for “agent A is committed” are externally checkable: they reference the social record, not A’s mental state. This is the exact alternative to the mentalistic semantics of FIPA / Cohen and Levesque 1995 that Rethinking the Principles called for. The paper also sets up the bridge to law: Singh notes the close fit with Jones and Sergot’s “count-as” relation, with deontic logic, and with the speaks-for tradition in distributed systems — establishing commitments as a unifying normative substrate across philosophy, law, MAS, and computer security.

For CBCL and the broader public-semantics line, this is the ontology document: it defines what “commitment” means precisely enough that protocol designers can map performatives onto commitment-state transitions and verifiers can monitor compliance from a transcript. The four-place structure (debtor, creditor, condition, context) maps almost directly onto the ledger-of-commitments architecture in Fornara & Colombetti 2004 and the dialect contracts in CBCL. The paper is also the place to cite when arguing that commitment-based ACL semantics is not merely a behavioural surrogate but a real normative theory with established connections to legal and deontic logic.

Key Ideas

Commitment as the primitive normative concept: a four-place relation C(debtor, creditor, condition, context) — agent x is committed to agent y for the fulfilment of condition q in the social context s. The four roles must always be specified; commitments without a creditor are degenerate.
Standard commitment operations: create (a new commitment comes into being via a public act), discharge (the condition is satisfied), cancel (the debtor unilaterally retracts, possibly incurring meta-commitment), release (the creditor waives), delegate (the debtor passes the obligation to a third party with creditor consent), assign (the creditor passes the entitlement).
Conditional commitments: CC(x, y, p ⊃ q, s) — x is committed to y to bring about q if p holds. The conditional structure handles contracts, contingent obligations, and protocol-state dependencies.
Discharge by satisfaction: a commitment is discharged when its condition is satisfied (in the relevant social interpretation); discharge is monotone — once discharged, the commitment is closed.
Deontic vocabulary as derived: obligation, permission, prohibition, right, and duty are reconstructable from commitment patterns plus the relevant institutional context.
Public, externally checkable semantics: commitments are facts about the social record, not about agent mental states. Verification is by inspection of the transcript and the institutional rules.
Bridges to legal informatics and deontic logic: the framework is explicitly compatible with Jones and Sergot’s count-as relation and with classical deontic-logic operators, positioning commitments as the unifier across philosophy, law, MAS, and distributed-security normative reasoning.

Connections

Conceptual Contribution

Claim: The proliferation of normative concepts across MAS, deontic logic, and law can be unified by taking the social commitment — a four-place relation C(debtor, creditor, condition, context) — as the basic primitive and reconstructing obligation, permission, prohibition, contract, and delegation as commitment patterns. Commitments are public: their existence is determined by observable acts and observable conditions, not by agent mental states.
Mechanism: Define commitments as four-place relations (debtor / creditor / condition / context) and conditional commitments analogously. Specify the operations create / discharge / cancel / release / delegate / assign as commitment-state transitions. Show how standard deontic-logic operators and standard legal concepts (promise, contract, breach, novation) reduce to patterns over these primitives. Sketch the bridge to Jones and Sergot’s count-as analysis of institutional facts.
Concepts introduced/used: Social Commitment, Conditional Commitment, Commitment Operations (create / discharge / cancel / release / delegate / assign), Debtor, Creditor, Condition, Context (Commitment), Deontic Reduction.
Stance: foundational technical paper / unifying ontology.
Relates to: The formal statement of the programme Singh 1998 argued for polemically; the bridge to the operational accounts in Yolum & Singh 2002, Yolum & Singh 2002b, and Fornara & Colombetti 2004. The philosophical complement is Brandom: Singh’s commitments are precisely the commitment leg of Brandom’s deontic scorekeeping triple. The legal complement is Jones & Sergot 1993 — count-as gives the institutional grounding for what makes a publicly observable act count as creating a commitment. The distributed-systems complement is the speaks-for tradition (Lampson et al. 1992) — credentials and delegated assertion authority are commitment patterns of the same family. CBCL’s dialect contracts and verdict ledger directly instantiate this ontology at wire-format granularity.

The Heart of Spritely - Distributed Objects and Capability Security

The Heart of Spritely: Distributed Objects and Capability Security

Reference: Christine Lemmer-Webber, Randy Farmer, Juliana Sims (2025). Spritely Institute whitepaper, May 21 2025. Source file: spritely-core.pdf. URL · Project

Summary

The second paper in Spritely’s three-part design series, this whitepaper lays out the technical core of Goblins — a distributed, transactional, object-programming environment built around object capability security (OCap). The thesis: secure peer-to-peer applications should feel like ordinary programming, not like a separate security discipline, and capability security makes that achievable. The operative slogan is “If you don’t have it, you can’t use it” — authority is conveyed only by holding a reference, never ambient.

The paper works through (1) capability security as ordinary reference-passing, motivated against Access Control Lists and the confused-deputy problem; (2) Goblins itself — a distributed object programming model with promise pipelining, vats as containers of synchronous turns, turns as cheap local transactions, and time-travel debugging; (3) OCapN — a new cross-implementation protocol for secure distributed object communication; (4) portable encrypted storage for capabilities; (5) library/application safety implications. Implementations exist for Guile and Racket Schemes, with a roadmap toward language-heterogeneous object invocation.

Goblins is the modern distillation of a three-decade lineage running through Mark Miller’s E language, the CapTP protocol, Jonathan Rees’s capability-kernel argument, and Carl Hewitt’s actor formalism. It reframes agent communication as object-reference passing over the network, offering an alternative substrate to the ACL/RPC-stack approach that dominates modern LLM-agent protocols.

Key Ideas

Principle of Least Authority (POLA): grant each piece of code only the authority it needs, no more
Object capability security: authority = unforgeable object reference. Lexical scoping + no ambient authority + no global mutable state
Confused-deputy problem: why ACLs fail when a privileged program is tricked into acting for an attacker
Vat: an isolated synchronous execution context; objects live inside vats; vats communicate asynchronously
Turn: an atomic event loop iteration inside a vat; turns are transactional — errors roll back the turn’s local state
Promise pipelining (from CapTP): chain calls on a reference before the prior call resolves, reducing round trips
Time-travel distributed debugging: replay turns deterministically across the network
OCapN (Object Capability Network): protocol for secure, cross-language distributed object invocation
Revocation and accountability as programmable patterns over references
“If you don’t have it, you can’t use it” — the design-level simplification capability security provides

Connections

Security Kernel Lambda Calculus — Rees’s lexical-scope-as-capability-kernel argument, directly cited
Capability Security
A Universal Modular Actor Formalism for Artificial Intelligence — vats descend from Hewitt actors
Actor Model
Programming Erlang Second Edition — sibling message-passing tradition
Communicating Sequential Processes — contrast in concurrency model
Agent Tcl Flexible Secure Mobile Agents — earlier capability-aware mobile agents
DAgents Security Book Chapter
Sandboxing
Distributed Security
LangSec
End-to-End Arguments in System Design — design-principle neighbour
Principled Design Of The Modern Web Architecture — architectural contrast (REST/ACL vs OCap)
Agent-to-Agent Protocol — OCapN is a capability-secure alternative
Model Context Protocol
Agent Network Protocol
Inter-Agent Trust Models - A Comparative Study — Constraint trust realised at the language level
Constraint Trust
MalTool Malicious Tool Attacks — OCap would structurally preclude many of these attacks
AI Agents Under Threat
ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems — the flat context trust model ClawWorm exploits is precisely what OCap eliminates
Flat Context Trust Model
Principle of Least Authority
Ambient Authority
Confused Deputy
Vat Model
Turn (Goblins)
Promise Pipelining
OCapN
CapTP
E Language
Time-Travel Debugging

Conceptual Contribution

Claim: Secure peer-to-peer applications become routine when authority is conveyed only by holding an unforgeable object reference — no ambient authority, no global mutable state, lexical scope as the capability kernel — and when the network distribution of such references is itself designed as an ordinary message-passing object system.
Mechanism: Goblins realises the E-language tradition in Scheme (Guile, Racket): objects live in vats; each vat runs atomic turns that serve as cheap local transactions; asynchronous inter-vat invocation uses promise pipelining to collapse round-trips; persistence, upgrade, and cross-language interop are handled by OCapN — a capability-preserving transport protocol. Time-travel debugging exploits the turn-level determinism.
Concepts introduced/used: Object Capability Security, Principle of Least Authority, Ambient Authority, Confused Deputy, Vat Model, Turn (Goblins), Promise Pipelining, OCapN, CapTP, E Language, Time-Travel Debugging, Capability Revocation
Stance: engineering / foundational design doc
Relates to: A modern engineering culmination of the capability-security thread rooted in Security Kernel Lambda Calculus (Rees 1995, explicitly cited) — lexical scope as a capability kernel, extended into a full distributed system. The vat model is a direct descendant of A Universal Modular Actor Formalism for Artificial Intelligence (Hewitt 1973) and sibling to Programming Erlang Second Edition but with security-by-reference as a first-class concern. Frames a structural alternative to the modern LLM-agent protocol stack: where Agent-to-Agent Protocol / Model Context Protocol / Agent Network Protocol layer trust on top of ACL/RPC primitives, OCapN encodes trust in the reference graph itself. The flat context trust model that ClawWorm Self-Propagating Attacks Across LLM Agent Ecosystems exploits and that MalTool Malicious Tool Attacks, AI Agents Under Threat catalogue is precisely the ambient-authority failure capability security is designed to prevent — making Goblins / OCapN a serious candidate substrate for Inter-Agent Trust Models - A Comparative Study’s Constraint trust dimension.

Object Capability

Designation-and-authority-fused unforgeable reference to an object. Possession of an object capability is permission to invoke its methods. The substrate of Object Capability Security and of Spritely / OCapN.

In this vault

Speaks-For Calculus

Programming Semantics for Multiprogrammed Computations

Reference

Dennis, Jack B.; Van Horn, Earl C. “Programming Semantics for Multiprogrammed Computations.” Communications of the ACM, 9(3):143-155, March 1966. URL

Summary

The Dennis & Van Horn paper is the origin point of the capability concept in computer science. Written during the Project MAC era and responding to the needs of multiprogrammed, multi-user systems like MULTICS and the SABRE reservation system, it defines a set of meta-instructions that a supervisor provides to user programs to express the five core requirements of multiprogrammed computation: (1) parallel processing; (2) creating, suspending, and resuming computations; (3) protection of a computation from other computations; (4) debugging support; and (5) shared access to data and procedures.

The paper’s lasting contribution is the introduction of the capability (called a C-list entry) as the fundamental access-control primitive. A capability is an unforgeable pair of a unique-name (naming a segment or other object) and an access-indicator (X, R, RW, RWX) that determines what may be done with the object. A computation’s sphere of protection is defined precisely by its C-list. Crucially, a process cannot name a resource it has no capability for - designation and authority are unified. The paper introduces principals (the human or organisational accountability unit), processes as loci of execution, and the meta-instructions for fork/join, lock/unlock, I/O function invocation, and capability transfer.

This is the paper that every later capability system - Plessey 250, CAP, KeyKOS, EROS, seL4, E, Spritely - is ultimately paying tribute to. It is also striking how many apparently recent ideas (unforgeable references, segment-level fine-grained protection, per-process authority sets, mutually suspicious processes on one machine) are already present here in 1966.

Key Ideas

Capability as an unforgeable (unique-name, access-indicator) pair; the first definition in the literature.
C-list per process: the exhaustive list of a computation’s authorities.
Sphere of protection = closure of what a process can name and do via its C-list.
Principal vs process: accountability vs. execution.
Meta-instructions as the supervisor’s API for computations: fork, join, quit, lock, unlock, execute i/o function, create segment, enter block, etc.
Multiprogramming as access-control problem: protection, sharing, and scheduling are one design problem, not three.
Designation and authority unified: a name in a program is dereferenced through the C-list, so “unknown” resources are also “unreachable” - the ancestral seed of “no designation without authority.”
Mutually suspicious computations as a first-class goal.

Connections

The Heart of Spritely - Distributed Objects and Capability Security
Capability Security - this is the paper that invents the concept.
Object Capability Security - Miller-era ocap refines Dennis & Van Horn’s C-list into object references.
E Language - E’s reference-passing rules are a memory-safe OO realisation of Dennis-Van-Horn C-lists.
CapTP
Ambient Authority - designation-without-authority, which ambient-authority systems permit, is precisely what this paper eliminates by construction.
Confused Deputy - Hardy’s 1988 paper points back to Dennis & Van Horn as the road not taken.
Principle of Least Authority - C-lists make POLA expressible at segment granularity.
Distributed Security
Security Kernel Lambda Calculus
A Universal Modular Actor Formalism for Artificial Intelligence - Hewitt’s actors and Dennis-Van-Horn capabilities are parallel 1960s-70s answers to concurrent computation; Miller’s E later unifies them.
Actor Model
Vat Model

Conceptual Contribution

Capability Myths Demolished

Reference

Miller, Mark S.; Yee, Ka-Ping; Shapiro, Jonathan S. Capability Myths Demolished. Technical Report SRL-2003-02, Systems Research Laboratory, Johns Hopkins University, 2003. URL

Summary

This short, polemical technical report dismantles three widely repeated myths about capability-based security that had accreted in the literature over the preceding two decades and were being cited as reasons to avoid capability models or to pile extra access checks on top of them. The three myths are: (1) the Equivalence Myth - that ACL systems and capability systems are formally equivalent views of Lampson’s access matrix; (2) the Confinement Myth - that capability systems cannot enforce confinement; and (3) the Irrevocability Myth - that capability-based authority cannot be revoked.

The authors’ strategy is to disentangle three very different things all called “capability” in the literature: Model 2 (capabilities-as-rows of the access matrix), Model 3 (capabilities-as-keys / unforgeable bitstrings), and Model 4 (object-capabilities, where capabilities are object references in a memory-safe object language). They define seven security properties - including “no designation without authority,” dynamic subject creation, subject-aggregated authority management, and composable confinement - and show how the three models differ on each. Under this lens, the Equivalence Myth collapses: ACLs and object-capabilities have fundamentally different rules for how the access matrix is updated, even if both can be drawn as an access matrix at an instant.

The Confinement Myth is refuted by pointing to KeyKOS factories (Hardy 1988) and the EROS constructor, which demonstrably achieve confinement in object-capability systems. The Irrevocability Myth is refuted via the Redell forwarder/facet pattern (1974), elegantly explained with a simple diagram: Alice hands Bob a forwarder to Carol and keeps the revoker; dropping the revoker drops Bob’s access. The paper is the go-to reference whenever these myths resurface and is essential intellectual groundwork for the ocap tradition.

Key Ideas

Three distinct capability models: capabilities-as-rows, capabilities-as-keys, object-capabilities - not interchangeable.
The access-matrix snapshot lies: static snapshots ignore the update rules that actually distinguish ACL systems from capability systems.
No Designation Without Authority (Property A): in an ocap system, to name a resource is already to have authority to use it; ACL systems decouple designation from authority, which is the root of confused-deputy problems.
Subject-Aggregated Authority Management (Property C): in ocap, you edit your own C-list; in ACLs, changing one authority requires editing a resource’s ACL.
Confinement is achievable via factories / constructors; KeyKOS and EROS are existence proofs.
Revocation by forwarders (facets): give Bob not Carol but a forwarder F; keep R as revoker; R !stopForwarding revokes Bob cleanly.
Object capabilities subsume Lampson while avoiding the ambient-authority pitfalls that produce confused deputies.

Connections

The Heart of Spritely - Distributed Objects and Capability Security
Capability Security - this paper is the canonical clarification of what capability security actually claims.
Object Capability Security - Model 4 in this paper is the object-capability model.
E Language - examples and diagrams use E-flavoured ocap reasoning.
CapTP - distributed ocap relies on the same non-myths.
Ambient Authority - the Equivalence Myth’s error is essentially failing to see ambient authority in ACL systems.
Confused Deputy - the paper leans on Hardy’s example to justify Property A.
Principle of Least Authority - POLA is called out as a motivation for preferring ocap.
Distributed Security
Security Kernel Lambda Calculus
Capability Revocation - Redell forwarders / facets are explained here.
Capability Bounding

Conceptual Contribution

Decentralized Identifiers

W3C-standardised globally resolvable identifiers (DIDs) that are created, owned and controlled by their subject without a central registry. Each DID resolves to a DID Document containing public keys and service endpoints, supporting self-sovereign agent identity.

In this vault

SPKI-SDSI

SPKI / SDSI: A Simple Distributed Security Infrastructure with Linked Local Names

Reference: Rivest, R. L. & Lampson, B. (1996). SDSI — A Simple Distributed Security Infrastructure. (Working document, MIT.) Followed by: Ellison, C., Frantz, B., Lampson, B., Rivest, R., Thomas, B. & Ylonen, T. (1999). SPKI Certificate Theory. RFC 2693, IETF. (Also: Clarke, D. E., Elien, J.-E., Ellison, C., Fredette, M., Morcos, A. & Rivest, R. L. (2001). Certificate Chain Discovery in SPKI/SDSI. Journal of Computer Security 9(4).) Open access (RFC 2693) · SDSI 1.0 (Rivest-Lampson, MIT) · Chain discovery (Elien MIT MS thesis 1998)

Summary

Rivest, Lampson, Ellison and the SPKI working group develop SPKI/SDSI, a public-key infrastructure that takes a sharply different stance from the X.509 / hierarchical-CA tradition: instead of a global namespace of certified identities rooted in a chain of certificate authorities, SPKI/SDSI gives each principal its own local namespace and certificates that bind keys to authorisations rather than identities. SDSI’s central innovation is linked local names: K_alice's friends is a name in K_alice’s namespace; K_alice's friends's secretary is a chain of links — no global registry needed. Authority delegation is similarly local: a certificate K_a → K_b : auth issued by K_a grants authority auth to K_b, optionally with delegation rights. Authority is what matters, not who — a distinction Lampson summarised as “we’re moving from authentication to authorization.” The SPKI Certificate Theory (RFC 2693) formalises this: certificates are 5-tuples <Issuer, Subject, Delegation, Authority, Validity>; chain discovery (Clarke et al. 2001) gives a sound and complete algorithm for deriving “does this principal have this authority?” from a collection of certificates. The design directly anticipates modern decentralised identity / object-capability composition: SPKI/SDSI is the conceptual bridge between the object-capability tradition (E, Spritely) and the cryptographic-identity tradition (X.509, PGP). DIDs and Verifiable Credentials inherit substantial conceptual machinery from SPKI/SDSI; Macaroons (Birgisson et al. 2014) are SPKI-style attenuable capability tokens for HTTP APIs.

Key Ideas

Authorization, not authentication: certificates bind keys to authorities — what the principal is permitted to do — rather than to identities. The question “who is this key?” is replaced by “what is this key allowed to do?”
Local namespaces (SDSI): each principal has its own namespace; names are local identifiers like K_alice's bob, with no global resolution. Linked local names chain across namespaces: K_alice's bob's friends resolves through K_alice’s and then K_bob’s namespaces.
Delegation as a first-class certificate field: a certificate may grant authority with or without the right to re-delegate; chains of delegated certificates are the principal authority-derivation mechanism.
5-tuple certificates: <Issuer, Subject, Delegation-flag, Authorization-S-expression, Validity> (RFC 2693 §2.4 calls the field “Authorization”, not “Authority”); the Authorization is an S-expression in a structured language (action, object, qualifier) that supports rich access-control specifications.
Chain discovery (Clarke et al. 2001): given a goal K_principal has authority A, the chain-discovery algorithm searches the certificate collection for a derivation; sound and complete; polynomial in the size of the certificate collection for many practical fragments.
No mandatory identity binding: certificates may bind keys to local names (SDSI-style) or directly to authorisations (SPKI-style) — identity is just one kind of authority. The system can be used without ever assigning a global “real name” to a key.
Capability composition: SPKI authorities compose under intersection and chain; the resulting authority is the most-restrictive intersection along the chain. This is exactly the capability-security composition rule lifted to a certificate-based distributed setting.

Connections

Conceptual Contribution

Claim: A distributed security infrastructure should bind cryptographic keys to authorisations (what they may do) rather than to identities (who they “really” are); each principal should have its own local namespace; authority delegation should be first-class with an explicit chain-discovery algorithm. The X.509 hierarchical-CA model is the wrong fit for most distributed-system access-control needs.
Mechanism: 5-tuple certificate format (issuer / subject / delegation / authority / validity); local namespaces with linked-local-names resolution; sound and complete chain-discovery algorithm; authority composition under intersection.
Concepts introduced/used: SPKI, SDSI, Linked Local Names, Capability Certificate, Authority-not-Identity, Chain Discovery.
Stance: foundational systems-design paper / IETF specification.
Relates to: Direct conceptual bridge between the object-capability tradition (Dennis & Van Horn 1966, EROS, the E-language line in Miller 2006) and the cryptographic-identity tradition (X.509, PGP). SPKI/SDSI explicitly takes the capability stance — unforgeable name = capability — and lifts it into a distributed cryptographic setting where the unforgeability comes from the public-key cryptography rather than from memory protection. The Macaroons paper (Birgisson, Politz, Erlingsson, Taly, Vrable & Lentczner 2014) is SPKI/SDSI’s most-deployed modern descendant: HMAC-chained authority tokens with attenuation, used in production at Google and elsewhere. Modern decentralised-identity standards — W3C DIDs, Verifiable Credentials, the Authorization Capabilities (zCaps) work — inherit substantial conceptual machinery from SPKI/SDSI even when they do not cite it directly. Within this vault, SPKI/SDSI is the missing distributed-cryptographic counterpart of the in-process capability work in Capability Myths Demolished and Robust Composition - Towards a Unified Approach to Access Control and Concurrency Control — it is what those frameworks become when keys cross machine boundaries. The Lowe/PKI Layer Cake - Kaminsky Patterson Sassaman-style critiques of X.509 PKI are simultaneously arguments for SPKI-style local-name systems: parser differentials and the trust-collapse-by-CA-misissuance problem largely vanish when certificates bind authority rather than identity.

In this vault

BAN Logic

The belief logic of Burrows, Abadi & Needham (1990) for analysing cryptographic authentication protocols. A small modal language with operators P believes X, P sees X, P said X, P controls X, fresh(X), P shares K with Q. Inference rules (message-meaning, nonce-verification, jurisdiction) propagate beliefs as messages are received and decrypted. Verification proceeds by idealising the protocol, stating initial beliefs, and deriving the goal beliefs (typically: authenticated session-key agreement). The first widely-adopted formal method for protocol analysis; superseded by Spi Calculus / ProVerif for rigorous use, but still pedagogically dominant.

In this vault

A Logic of Authentication

Reference: Burrows, M., Abadi, M. & Needham, R. (1990). A Logic of Authentication. ACM Transactions on Computer Systems, 8(1), pp. 18–36. (Earlier DEC SRC Research Report 39, 1989.) ACM DOI · Open access PDF (Stanford)

Summary

Burrows, Abadi and Needham introduce BAN logic — a belief logic for reasoning about the authentication properties of cryptographic protocols. The setting is the symbolic Dolev-Yao world: principals communicate by exchanging cryptographic messages over an untrusted network. BAN provides a small modal language whose primary modality is P believes X (“principal P believes X”) together with auxiliary operators (P sees X, P said X, P controls X, fresh(X), P has K, K is shared between P and Q). Its inference rules (the message-meaning rule, nonce-verification rule, jurisdiction rule, freshness rule, etc.) capture how beliefs propagate as messages are received and decrypted — for instance, if P believes K is a key shared with Q and P sees {X}_K and P believes X is fresh, then P may conclude that Q recently sent X. Verification proceeds by idealising the protocol (replacing each message by the abstract belief-statement it is intended to convey), making explicit assumptions about initial beliefs, and then deriving the goal beliefs (typically, that the principals share a fresh authenticated session key). The paper analyses Kerberos, the original Needham-Schroeder protocol, the Andrew Secure RPC handshake, and several others — finding errors and clarifying intended semantics. BAN was a watershed: the first widely-adopted formal method for authentication-protocol analysis. Its limitations (no explicit attacker model, the idealisation step is informal, soundness is debatable for unintended uses) drove the development of more rigorous frameworks — notably the Spi Calculus (process-calculus equivalence-based) and the symbolic provers ProVerif / Tamarin — but the belief-logic style remains in widespread teaching use as the most intuitive entry to protocol verification.

Key Ideas

Belief modalities: P |≡ X (P believes X), P ⊲ X (P sees / receives X), P |~ X (P once said X), P ⇒ X (P has jurisdiction over X — i.e. is an authority on it).
Cryptographic primitives appear in formulas: {X}_K (X encrypted with K), <X>_Y (X with secret Y), (X, Y) (concatenation), with associated extraction rules.
Inference rules as belief-derivation: e.g. message-meaning — if P believes K is shared with Q and sees {X}_K, then P believes Q once said X. Nonce-verification — if P believes Q once said X and P believes X is fresh, then P believes Q currently believes X. Jurisdiction — if P believes Q controls X and P believes Q believes X, then P believes X.
Idealisation: each protocol message is rewritten into an abstract form that makes its intended belief-meaning explicit (typically, the protocol designer has to do this — and the soundness of the analysis depends on the idealisation being faithful).
Goal beliefs: an authentication protocol is correct (in BAN) iff the participants reach the intended mutual beliefs about a fresh session key (P |≡ P ↔K Q, Q |≡ P ↔K Q, often with belief-about-belief: P |≡ Q |≡ P ↔K Q).
Found bugs in real protocols: BAN-style analysis of Needham-Schroeder shared-key protocol revealed that one party could not prove freshness of a session key — the bug Lowe later exploited symbolically.

Connections

Conceptual Contribution

Claim: Authentication properties of cryptographic protocols can be derived in a small modal belief logic whose inference rules capture how beliefs propagate when messages are received and decrypted; verifying a protocol becomes (i) idealising it as a sequence of abstract belief-statements, (ii) stating initial beliefs, and (iii) deriving the goal beliefs. This is rigorous enough to find real bugs in deployed protocols.
Mechanism: Modal language with believes / sees / said / controls / fresh / shares-key operators; ~20 inference rules covering message-meaning, nonce-verification, jurisdiction, freshness, and decomposition; idealisation step from concrete protocol messages to belief-statements; standard goal beliefs for authentication and key establishment.
Concepts introduced/used: BAN Logic, Belief Modality, Idealisation (of protocols), Nonce-Verification Rule, Jurisdiction Rule, Crypto Protocol Verification, Mentalistic Semantics (in the cryptographic setting).
Stance: foundational technical paper — the first widely-adopted formal method for cryptographic-protocol analysis.
Relates to: Conceptually parallel to the mentalistic-semantics family in the ACL literature (KQML, FIPA-ACL) — both treat communication as belief-update under explicit modal operators. BAN is exactly what one gets if one specialises mentalistic ACL semantics to cryptographic-protocol exchanges. The critique that struck mentalistic ACLs (Singh’s argument that beliefs cannot be observed by third parties) hits BAN in the same way: the idealisation step is informal, and “soundness” presupposes the very mental-state assumptions one cannot verify externally. The Spi Calculus (Abadi & Gordon 1997) is BAN’s process-calculus counterpoint — equivalence-based rather than belief-based, with the attacker built in as an arbitrary context. The Lowe attack on Needham-Schroeder, derivable from a careful BAN analysis but missed by the original 1978 informal argument, is the canonical worked example demonstrating why formal protocol verification matters and why even rigorous methods need more rigorous successors. BAN’s belief modalities also share semantic ground with Halpern & Moses 1990 — both apply epistemic logic to distributed/multi-agent systems, with BAN specialising to authentication and Halpern–Moses staying general.

Authentication in Distributed Systems: Theory and Practice

Reference: Lampson, B., Abadi, M., Burrows, M., & Wobber, E. (1992). Authentication in Distributed Systems: Theory and Practice. ACM Transactions on Computer Systems (TOCS) 10(4): 265–310. November 1992. (DEC SRC Report 83, 1992.) URL (Microsoft Research) · DOI

Summary

The ABLP paper (named for Abadi–Burrows–Lampson–Plotkin’s later refinement, but originating here) introduces the speaks-for calculus: a clean formal vocabulary for distributed authentication, delegation, and who is entitled to assert what on whose behalf. The setting: a distributed system in which principals (users, processes, machines, services) send requests that must be authorised. The traditional access-control question — is this principal allowed to perform this action on this object? — presupposes a prior question the paper answers: who is the principal whose request this is? That prior question becomes hard once requests pass through delegation chains (a user logs in to a workstation, which authenticates to a file server, which calls a database service on the user’s behalf): authentication is no longer one-to-one between principal and request but a chain of compound principals.

The technical heart of the paper is the speaks-for relation A ⇒ B: principal A speaks for principal B means that any statement A makes can be treated as if B had made it. Speaks-for is reflexive, transitive, and closed under conjunction and group membership. From A ⇒ B and A says s, the system derives B says s. Compound principals are built from atomic ones via conjunction (A ∧ B says s requires both to assert s), quoting (A | B says s means A is making a statement on behalf of B, but A retains responsibility), roles (A as R is A acting in role R), and for-channel (A for K is A speaking over channel/key K). The calculus is implementable: speaks-for facts are encoded in signed certificates, the access-control matrix grants rights to principals at any level of compoundness, and authentication reduces to checking a chain of certificates.

For the agent communication and security agenda this vault tracks, the speaks-for calculus is the formal vocabulary for delegated commitments and signed credentials. When agent B accepts a commitment from a process speaking on A’s behalf, the question “did A really commit?” is answered by the speaks-for chain witnessed by the credential. The paper is the philosophical and engineering ancestor of SPKI/SDSI (Rivest–Lampson–Ellison’s capability-style PKI, which Lampson designed using the speaks-for vocabulary), DIDs and Verifiable Credentials, object-capability facets, and modern attribute-based authorisation. For CBCL, speaks-for is the natural answer to “who signed this commitment?” — the dialect contract specifies which principals may emit which verdicts under which delegation rules, and the speaks-for chain provides the proof.

Key Ideas

Principals are first-class: a principal is anything that can make a statement — users, processes, machines, services, public keys, roles, groups, conjunctions, quotations. The system reasons uniformly about all of them.
The says operator: A says s is the primitive — principal A has asserted statement s. Authentication delivers says judgements; authorisation uses them.
The speaks-for relation: A ⇒ B means everything A says, B says. Reflexive, transitive, closed under conjunction. The delegation primitive.
Compound principals: built by conjunction (A ∧ B), quoting (A | B — A speaking on behalf of B), roles (A as R), and for-channel (A for K). A workstation acting on behalf of a user over a particular key is a compound principal at the leaf of an authentication chain.
Certificates as speaks-for witnesses: a signed certificate stating K ⇒ A (this key speaks for that principal) is the wire-format proof of a speaks-for fact. Authentication is verifying a chain of such certificates.
Access control on compound principals: the access-control list grants rights to principals at any level — Alice as Admin, Workstation | Alice for K, Group(Engineers). The complex authorisation patterns of real systems become tractable.
Trusted Computing Base separation: each principal has its own TCB; speaks-for chains let one principal delegate trust to another without fully merging TCBs.
Implementable: the paper describes the Taos system (DEC SRC) implementing the calculus; the design influenced Windows NT’s authentication architecture.

Connections

Conceptual Contribution

Claim: Distributed authentication and delegation can be cleanly formalised by the speaks-for relation A ⇒ B over a rich algebra of principals (atomic, conjunction, quoting, role, for-channel) together with the says operator. Authorisation reduces to checking that the speaker’s principal-expression has been granted rights to perform the requested action.
Mechanism: Define principals as a recursive algebra (atomic, A ∧ B, A | B, A as R, A for K). Define A says s (primitive) and A ⇒ B (speaks-for, reflexive-transitive-conjunctive). Encode speaks-for facts as signed certificates; authentication chains certificates from a trusted root to the requesting principal. Access-control lists grant rights to any principal expression; the request is authorised iff the deduced speaker’s principal is on the ACL. Implement the calculus in the Taos distributed OS as a concrete proof of practicality.
Concepts introduced/used: Speaks-For Calculus, ABLP Logic, Says Operator, Compound Principal, Quoting Principal, Role Principal, Delegation, Access Control List, Trusted Computing Base.
Stance: foundational technical paper / industry-grade reference design.
Relates to: The formal vocabulary that makes SPKI/SDSI (Rivest–Lampson–Ellison) intelligible: SPKI is the speaks-for calculus packaged as a PKI. DIDs and VCs inherit the same algebraic structure. Object capabilities (Dennis–Van Horn / EROS / Miller) are a dual view of the same problem (rights attached to objects rather than chains of delegation); the Spritely / OCapN line composes both views. For agent communication, speaks-for is the natural vocabulary for delegated commitments: when an agent’s process commits on the agent’s behalf, the speaks-for chain witnesses authority. The pair with Singh 1999 is direct: commitments without authority chains are weak, and authority chains without commitments are unactionable. CBCL’s signed-verdict architecture is a speaks-for application: the dialect contract names which principals may emit which verdicts under which delegation rules. The cryptographic complement is BAN logic (1990) and Spi calculus (1997) — BAN reasons about protocol soundness, ABLP reasons about who.