KLAIM: A Kernel Language for Agents Interaction and Mobility

Reference: De Nicola, R., Ferrari, G. L. & Pugliese, R. (1998). KLAIM: A Kernel Language for Agents Interaction and Mobility. IEEE Transactions on Software Engineering, 24(5), pp. 315–330. (Earlier presented at Coordination ’97.) IEEE DOI · Open access PDF (IMT Lucca)

Summary

De Nicola, Ferrari and Pugliese introduce KLAIM (Kernel Language for Agents Interaction and Mobility), a process calculus combining the Linda tuple-space coordination model with explicit locality and mobile-agent migration. The basic move is to extend Linda’s flat global tuple space with named localities — tuples now live at particular sites, and the four primitives out, in, rd, eval carry a locality argument specifying where they operate. The crucial addition is the eval operation lifted to support mobile code: eval(P)@l spawns process P at locality l, allowing computations themselves to migrate. The locality structure makes KLAIM particularly suited to mobile-agent systems where the boundary between sites carries security and access-control implications. The companion type system μKLAIM (subsequently developed) statically constrains which sites an agent may access and what operations it may perform there — a static-typing analogue of capability security for distributed mobile agents. KLAIM was deliberately positioned as the formal counterpart of mobile-agent systems like Telescript and Agent Tcl (Agent Tcl Flexible Secure Mobile Agents) — the same engineering target, with a process-calculus semantics making rigorous reasoning about access control, mobility safety, and information flow tractable. Within this vault, KLAIM is the missing bridge between Linda’s tuple-space coordination and the mobile-agent / distributed-security tradition: it shows how Linda’s decoupled-by-content communication composes with location-aware security policies that distinguish administrative domains.

Key Ideas

Linda + locality: Linda’s flat tuple space is replaced by a network of named localities; tuples reside at specific localities; the four primitives out(t)@l, in(t)@l, rd(t)@l, eval(P)@l carry a locality argument.
Mobile agents via eval: eval(P)@l spawns process P at locality l — the calculus’s primitive for code mobility; combined with locality-aware tuple operations, supports rich mobile-agent patterns (push, pull, weak migration, strong migration).
Names for localities and physical sites: KLAIM distinguishes logical locality names (used by agents) from physical sites, with an allocation environment mapping the former to the latter; supports administrative-domain reasoning and migration transparency.
Type system for access control (μKLAIM, Pugliese et al. 2002): static types annotate localities with the operations agents may perform there (read, write, execute, spawn); type-safe programs cannot violate access policies at runtime — a static counterpart of capability security.
Process-calculus semantics: standard SOS-style operational semantics with structural-congruence-and-reduction rules; bisimulation and may-testing equivalence; supports rigorous reasoning about behaviour and security.
Formal model for industrial mobile-agent systems: KLAIM was developed as the formal counterpart of contemporary mobile-agent platforms (Telescript, Aglets, Agent Tcl) — an attempt to give those engineering systems a tractable formal-methods grip.

Connections

Conceptual Contribution

Claim: Mobile-agent coordination can be expressed cleanly by combining Linda’s tuple-space model with explicit localities — named sites at which tuples reside and operations execute — together with an eval primitive that spawns processes at remote localities. The resulting calculus is amenable to type-system enforcement of access control and to standard process-calculus reasoning about behaviour, mobility, and security.
Mechanism: Extension of Linda primitives with locality arguments; mobile eval(P)@l for code migration; allocation environment mapping logical to physical sites; SOS-style operational semantics; type system (μKLAIM) statically constraining locality access.
Concepts introduced/used: KLAIM, Locality (KLAIM), Distributed Tuple Spaces, Mobile eval, Allocation Environment, Type-System Access Control.
Stance: foundational technical paper; bridges Linda and mobile-agent / process-calculus traditions.
Relates to: Direct extension of Linda (Gelernter 1985) with locality and mobility; sibling of Mobile Ambients (Cardelli & Gordon 1998), which takes a different stance — Mobile Ambients makes locations the primary mobile entity and uses capability-name boundary crossing, while KLAIM keeps Linda’s tuple-space communication model but lets agents (not locations) migrate. Both calculi have type systems controlling mobility / access; the choice between them is largely stylistic. Conceptually adjacent to the engineering systems Agent Tcl Flexible Secure Mobile Agents and DAgents Security Book Chapter — KLAIM gives the formal grip those systems lack. The μKLAIM type system is a static-type formulation of Capability Security in the distributed-mobile-agent setting; the connection to the Dennis–Van Horn capability tradition is direct (capability = unforgeable name; locality access right = capability name held). In the modern setting, KLAIM-style locality-and-tuple-space coordination is recognisable in the distributed-tuple-space libraries used in academic MAS research (CArtAgO’s artifacts are KLAIM-style localised coordination loci) and, more loosely, in the design of agent registries and agent cards for cross-platform LLM-agent interoperability (ANP, A2A).

Tags

#coordination-languages #klaim #linda-extension #mobile-agents #distributed-systems #foundations #process-calculi

Backlinks

Linked Pages

Agent-to-Agent Protocol

A2A — protocol for inter-agent communication among autonomous LLM agents.

Discussed in:

Agent Network Protocol

ANP — protocol stack for multi-agent networks.

Discussed in:

Capability Security

Access-control style where authority is conveyed by unforgeable object references; lexical scope in languages like Scheme suffices as a capability kernel.

In this vault

DAgents Security Book Chapter

D’Agents: Security in a Multiple-Language, Mobile-Agent System

Reference: Robert S. Gray, David Kotz, George Cybenko, Daniela Rus (1998). Mobile Agents and Security (G. Vigna, ed.), Springer LNCS. Source file: gray-security-book.pdf. URL

Summary

This chapter describes the security architecture of D’Agents (formerly Agent Tcl), a mobile-agent system whose agents can be written in Tcl, Java, or Scheme. The authors frame mobile-agent security as four interrelated problems: protecting the host machine from malicious agents, protecting agents from each other, protecting an agent from a malicious machine, and limiting aggregate resource consumption across groups of machines.

For machine and inter-agent protection, D’Agents relies on PGP-based cryptographic authentication of owners, identity-based resource managers that enforce access-control policies, and secure execution environments (Safe Tcl, Java security managers, Scheme 48 modules) separated cleanly from policy. For group-of-machine protection they plan an electronic-cash market approach; for agent-from-host attacks they survey partial techniques (detection via audit trails, encrypted computation, trusted reference machines) since full prevention requires hardware support they do not assume.

Key Ideas

Four interrelated mobile-agent security problems.
Separation of enforcement mechanism from policy.
Multi-language support with a uniform C/C++ server library.
Cryptographic authentication + per-identity resource managers.
Open problem: protecting agents from malicious hosts without trusted hardware.

Connections

Conceptual Contribution

Claim: Mobile-agent security comprises four distinct but interrelated problems (protecting machine, protecting other agents, protecting agent from host, protecting group of machines); solving them requires layered mechanisms that cleanly separate enforcement from policy and span multiple execution languages.
Mechanism: Architectural description of D’Agents’ four-level stack (transport, server, interpreter, agents); PGP-based owner authentication; language-specific enforcement modules (Safe Tcl, Java security manager, Scheme 48) routed through a language-independent resource manager; planned e-cash market approach for aggregate-resource protection; survey of partial techniques (audit trails, encrypted computation) for the agent-from-host problem.
Concepts introduced/used: Mobile Agent, Four Security Problems, Mechanism vs Policy, Safe Tcl, Resource Manager Agent, PGP Authentication, Audit Trail, Encrypted Computation
Stance: engineering / survey
Relates to: Extends the earlier Agent Tcl Flexible Secure Mobile Agents with a mature security story; shares threat concerns with AI Agents Under Threat and Distributed Security; policy/mechanism separation echoes the sandboxing principles of Extensible Distributed Coordination and Agents Secure Interaction in Data Driven Languages.

Tags

Agent Tcl Flexible Secure Mobile Agents

Agent Tcl: A Flexible and Secure Mobile-Agent System

Reference: Robert S. Gray (1996). Proceedings of the 1996 USENIX Tcl/Tk Workshop, pp. 9-23. Source file: gray-security.pdf. URL

Summary

Gray introduces Agent Tcl, a mobile-agent system built on the Tcl scripting language plus Safe Tcl that supports migration with a single agent_jump instruction, transparent inter-agent communication, and pluggable transport mechanisms. The paper argues that Tcl’s simplicity and ease of embedding make it more accessible than Telescript’s object-oriented language while the Safe Tcl extension provides the sandboxing needed for secure execution — a better balance than the ARA, Tacoma, or SodaBot alternatives.

The architecture has four layers (transport, server, interpreter, agents) and supports PGP-signed agents, resource-manager-based authorization, direct-connection and message-passing communication, and a flat namespace of named agents. Gray details how the Tcl core was modified to capture complete interpreter state (stack, procedure frames, variables) for transparent migration at arbitrary points, and outlines a plan to add Java and Scheme as additional agent languages.

Key Ideas

Single-instruction migration (agent_jump) that transparently captures/restores state.
Safe Tcl for sandboxed execution with policy decoupled from mechanism.
Layered architecture supporting multiple languages and transports.
Security approach: PGP-signed code + resource managers + Safe Tcl.
Explicit interpreter stack rewrite to enable mid-execution migration.

Connections

Conceptual Contribution

Claim: A mobile-agent system can be both simple and secure by building on an interpreted scripting language (Tcl) augmented with Safe Tcl sandboxing, exposing migration as a single instruction that transparently captures/restores complete interpreter state.
Mechanism: Modifies the Tcl core to use an explicit command stack (replacing recursive Tcl_Eval) so full execution state is capturable; primitives agent_begin/submit/jump/send/receive/meet/accept provide uniform mobility and messaging; security via PGP-signed agents + per-identity resource managers + Safe Tcl trusted/untrusted dual interpreters with link substitution.
Concepts introduced/used: Mobile Agent, agent_jump, State Capture, Safe Tcl, Sandboxing, Explicit Command Stack, Flat Namespace, Resource Managers
Stance: engineering
Relates to: Precursor to DAgents Security Book Chapter which formalises the security model; contemporary alternative to Telescript/ARA/Tacoma (discussed in the D’Agents chapter); shares interpreter-level security philosophy with Agents Secure Interaction in Data Driven Languages.

Tags

Mobile Ambients

Reference: Cardelli, L. & Gordon, A. D. (1998). Mobile Ambients. In Foundations of Software Science and Computational Structures (FoSSaCS ’98), LNCS 1378, pp. 140–155, Springer. Journal version: Theoretical Computer Science 240(1), pp. 177–213, 2000. DOI · Open access PDF (UPenn)

Summary

Cardelli and Gordon argue that the Pi-Calculus models communication elegantly but does not natively model administrative domains — the bounded, named, hierarchically nested regions across which computation moves on the actual Internet (firewalls, address spaces, processes, machines, networks). Their ambient calculus makes the location itself the primary mobile entity. An ambient n[P] is a named bounded region containing a process P. A small set of capabilities — in n.P, out n.P, and open n.P — drive movement: in n enters a sibling ambient named n; out n exits the parent ambient if it is named n; open n dissolves the boundary of a child ambient named n, merging its contents with the current location. Communication is local: (x).P reads from a shared anonymous channel within the surrounding ambient. Mobility and access control reduce to one question — does a process possess the capability to cross a particular boundary? The calculus has standard structural-congruence-and-reduction operational semantics, a logical companion (the ambient logic, with location-modal connectives), and type systems regulating mobility. It supplies the formal substrate for reasoning about agents that physically relocate — mobile-code platforms, container migration, and (today) WASM components moving between hosts.

Key Ideas

Locations as first-class movable entities: the basic mobile thing is a named bounded region, not a name-as-channel; this captures administrative-domain structure that pure π struggles to express.
Three capabilities — in, out, open — suffice: every mobility scenario reduces to a sequence of crossings governed by capability possession; access control becomes “do you have the capability name?”
Spatial nesting as syntax: ambient terms form trees n[P | m[Q] | …]; the structural-congruence laws are spatial as well as algebraic. The ambient logic adds location modalities (@n reads “at ambient n”) for spatial reasoning.
Bounded computation: an ambient acts like a bag carrying its computation; its contents proceed concurrently inside the boundary, distinct from the outside world.
Communication restricted to local anonymous channels: a deliberate departure from π’s named channels — values are read off the local “ether” within an ambient. Gives an asymmetric model where mobility is global but communication is local.
Type systems for mobility: subsequent work (Cardelli, Ghelli, Gordon 1999/2000) gives type disciplines that statically constrain which ambients may cross which boundaries — the ancestor of capability-typed mobile-code systems.
Deliberate engineering target: motivated explicitly by Java applets, Telescript-style mobile agents, and firewall-bounded computation — process-calculus theory aimed at the engineering reality of distributed systems.

Connections

Conceptual Contribution

Claim: Modelling internet-scale distributed computation requires a process calculus in which the location is the primary mobile entity, not the channel; three boundary-crossing capabilities (in, out, open) suffice to express administrative-domain mobility, and capability possession is the natural account of access control.
Mechanism: A process language extending π-style parallel composition with ambient brackets n[P] and capability prefixes; small structural-congruence-and-reduction operational semantics; an ambient logic with spatial / location modalities; type systems controlling which ambients can perform which capabilities.
Concepts introduced/used: Mobile Ambients, Ambient Calculus, Capabilities (Ambient), Mobility, Spatial Logic, Boundary (administrative domain).
Stance: foundational technical paper.
Relates to: Sibling of the Pi-Calculus — both Milner 1992 and Cardelli & Gordon 1998 lift CCS-style fixed-topology concurrency, but along different dimensions (channel-mobility vs location-mobility). Conceptually upstream of all capability-based mobile-agent security work in the vault: Agent Tcl Flexible Secure Mobile Agents and DAgents Security Book Chapter take the engineering view, while ambients give the formal model. The capability-as-token view aligns directly with Capability Security (Dennis & Van Horn 1966, Miller’s E lineage in Robust Composition - Towards a Unified Approach to Access Control and Concurrency Control) — possession of a capability name confers, and only confers, the right to act. Modern realisations include WebAssembly modules with WASI capabilities, container ingress/egress, and sandboxed JS with capability-secured imports — a re-discovery of ambient-style boundary control under different syntactic skins.

Tags

#process-calculi #mobile-ambients #cardelli #gordon #mobility #capability-security #foundations

Generative Communication in Linda

Reference: Gelernter, D. (1985). Generative Communication in Linda. ACM Transactions on Programming Languages and Systems (TOPLAS), 7(1), pp. 80–112. (Companion: Carriero, N. & Gelernter, D. (1989). Linda in Context. Communications of the ACM 32(4), pp. 444–458.) DOI · Open access PDF (UCSD)

Summary

Gelernter introduces Linda, a coordination model for parallel and distributed programming organised around tuple spaces rather than message passing. A tuple space is a logically shared, content-addressable bag of tuples; processes communicate by writing tuples into the space (out), reading them with associative pattern matching (rd, in), and creating new processes through tuple-space operations (eval). The four operations — out (write), in (consume on match), rd (read on match without consuming), and eval (turn a tuple into a live computation) — together comprise the entire coordination language. Linda is generative in that produced tuples have an existence independent of the producer: once out is invoked, the tuple lives in the space and can be matched by any process at any time. This decouples senders from receivers in space, time, destination, and form — the four “dimensions of decoupling” Gelernter argues are essential for scalable parallel programming. The model is embedded: Linda is a coordination language designed to be combined with any host computation language (the original implementations were C-Linda and Fortran-Linda). The headline architectural claim is the separation of computation and coordination: a parallel program is a computation (algorithmic logic) plus a coordination (how concurrent activities synchronise and communicate); Linda provides the coordination layer in a way that is largely orthogonal to the host language. Linda directly inspired JavaSpaces (1998), TSpaces (1999), and the Klaim mobile-agent extension; it is the conceptual root of a substantial sub-tradition of coordination-language research that includes Reo (Arbab 2004) and Klaim (De Nicola, Ferrari & Pugliese 1998), and supplies one of the standard answers to “how do agents in a multi-agent system communicate without point-to-point addressing?”

Key Ideas

Tuple space as the universal medium: a logically shared, content-addressable bag of tuples; processes communicate exclusively through out / in / rd / eval on this single store.
Four operations:
- out(t) — write tuple t to the space (non-blocking).
- in(template) — atomically consume a tuple matching template (blocks until one exists).
- rd(template) — read but do not consume a matching tuple (blocks until one exists).
- eval(t) — like out, but each non-actual field is evaluated by a fresh concurrent process; producing a live, in-tuple-space computation.
Associative pattern matching: a template is a tuple containing actual values and typed wildcards; a tuple matches a template iff the structural shapes agree, the actual values are equal, and the wildcards bind to fields of the matching type.
Four dimensions of decoupling: Linda decouples sender and receiver in space (no shared address space), time (writer and reader need not co-exist), destination (no addressing — match by content), and form (any tuple format can be matched by an appropriate template).
Separation of computation and coordination: Linda is a coordination language deliberately orthogonal to the host computation language; a parallel program decomposes into a sequential computation plus a Linda coordination structure.
Generative communication: produced tuples have an existence independent of the producer — they live in the space, persist until consumed, and can be matched by any process. The producer-consumer decoupling this implies is what made tuple spaces attractive for systems with unpredictable producer/consumer matching.
Implementation tractable but not trivial: efficient Linda implementations distribute the tuple space (statically by tuple shape, dynamically by hashing), specialise frequent matching patterns, and treat in/rd as conditional rendezvous; significant systems-engineering work, but feasible.

Connections

Conceptual Contribution

Claim: Coordination of parallel and distributed processes can be elegantly expressed via a content-addressable shared tuple space accessed through four primitives (out, in, rd, eval); this decouples senders and receivers in space, time, destination, and form, and supports a clean separation of computation and coordination. Coordination is its own first-class concern, distinct from the computation it orchestrates.
Mechanism: Logically shared bag of tuples; associative pattern matching with typed wildcards; four primitive operations forming a small coordination language; embedded combination with any host computation language (C-Linda, Fortran-Linda, Java for JavaSpaces, etc.); distributed implementation via tuple-shape partitioning and matching specialisation.
Concepts introduced/used: Generative Communication, Linda (coordination), Tuple Matching, Tuple Spaces, Coordination Language, Separation of Computation and Coordination, Four Dimensions of Decoupling.
Stance: foundational systems-engineering paper.
Relates to: Direct ancestor of JavaSpaces (Sun, 1998), TSpaces (IBM, 1999), GigaSpaces (commercial), and the academic descendants KLAIM (De Nicola, Ferrari & Pugliese 1998 — Linda + mobile-agent locality), and (more loosely) Reo (Arbab 2004 — connector-based coordination as algebraic counterpoint to Linda’s tuple-space model). The conceptual move “coordination is a separate first-class concern from computation” is shared with Kowalski’s Algorithm = Logic + Control (1979) — algorithm = logic + control = computation + coordination — and with the entire blackboard-architecture line in AI. Within this vault Linda is the missing canonical reference under the existing Tuple Spaces concept stub. In the agent-communication setting, tuple spaces supply an alternative to KQML/FIPA-style facilitator mediation: where KQML’s Facilitators route messages by content, tuple spaces let agents publish content into a shared medium and let consumers match on what they want — the Agents and Artifacts (JaCaMo / CArtAgO) framework explicitly takes this stance, treating the shared environment as a first-class artefact agents communicate through. The pattern is also foundational for stigmergic coordination (the world is the shared medium) and for Ripple Effect Protocol-style sensitivity sharing among agents.

Tags

Distributed Tuple Spaces

A network of tuple spaces partitioned across multiple physical sites, each typically associated with a locality in the KLAIM sense. Combines Linda-style content-addressed coordination with location-aware access control and migration semantics. Production realisations include JavaSpaces over Jini, TSpaces, and GigaSpaces; KLAIM is the canonical formal model.

In this vault

Locality (KLAIM)

In KLAIM, a locality is a named site where tuples reside and operations execute; the four Linda primitives carry a locality argument (out(t)@l etc.). An allocation environment maps logical locality names (used by agents) to physical sites (used by the runtime). Mobile agents migrate by eval(P)@l. Localities make administrative-domain structure first-class and are the units the μKLAIM type system constrains for access control.

In this vault

KLAIM

De Nicola, Ferrari & Pugliese’s (1998) Kernel Language for Agents Interaction and Mobility — a process calculus combining Linda’s tuple-space coordination with named localities and mobile eval for code migration. The companion type system μKLAIM statically enforces locality-access policies, giving a static-typing analogue of Capability Security for distributed mobile agents. The formal counterpart of mobile-agent platforms like Telescript and Agent Tcl.

In this vault

Linda (coordination)

Gelernter’s (1985) coordination language built around a shared content-addressable tuple space accessed through four operations: out (write), in (consume on associative match), rd (read on match), eval (turn a tuple into a live computation). Decouples senders and receivers in space, time, destination, and form. The canonical example of separation of computation and coordination. Direct ancestor of JavaSpaces, TSpaces, KLAIM, and stigmergic-coordination frameworks.

In this vault

Agents and Artifacts

Agents and Artifacts (A&A)

Meta-model treating the agent environment as first-class artefacts agents interact with, implemented in JaCaMo / CArtAgO.

In this vault

An Interaction-oriented Agent Framework for Open Environments

An Interaction-oriented Agent Framework for Open Environments (Mercurio)

Reference: Baldoni, Baroglio, Bergenti, Marengo, Mascardi, Patti, Ricci, Santi (2011). AIIA 2011 (Italian AI Association)*. Source file: cbcl-ref/AI_IA2011.pdf. URL

Summary

The authors propose Mercurio, an agent-programming framework for open multi-agent systems that unifies direct (speech-act) and indirect (environment-mediated) communication under a single social/observational semantics based on commitments. Mercurio has three levels — specification (constitutive and regulative rules over a domain model), programming abstractions (Agents and Artifacts in the A&A meta-model), and infrastructure (built on JaCaMo integrating Jason, CArtAgO, and MOISE).

Commitment-based protocols give a public, verifiable meaning to actions (replacing mentalistic ACL semantics); constitutive rules define what counts as what, while regulative rules impose temporal constraints on the social state. Artifacts reify interaction patterns and the social state itself, enabling the environment to monitor and detect violations. The framework thus conjugates MAS flexibility with software-engineering modularity and compositionality, targeting e-government, cross-business, and service-oriented applications.

Key Ideas

Commitment-based social semantics replaces mentalistic ACL semantics.
Three levels: specification, programming abstractions, infrastructure.
Separation of constitutive and regulative rules.
Artifacts (A&A / CArtAgO) as first-class environment entities.
JaCaMo stack (Jason + CArtAgO + MOISE) as reference infrastructure.

Connections

Conceptual Contribution

Claim: Open multi-agent systems need a single, publicly verifiable interaction semantics that unifies direct (speech-act) and indirect (environment-mediated) communication; commitments plus Agents-and-Artifacts supply it and can be layered onto an existing AOP stack.
Mechanism: Mercurio stratifies into three levels. (1) Specification: a domain model plus constitutive rules (“what counts as what”) and regulative rules (temporal constraints on the social state). (2) Programming abstractions: the A&A meta-model (agents + artifacts) where artifacts reify interaction patterns and the social state itself. (3) Infrastructure: the JaCaMo stack (Jason + CArtAgO + MOISE) runs the above so violations are environment-detectable and the social state is inspectable.
Concepts introduced/used: Mercurio Framework, Commitment-Based Protocol, Constitutive Rules, Regulative Rules, Agents and Artifacts, JaCaMo, Jason, CArtAgO, MOISE, Social State
Stance: engineering
Relates to: Concretely instantiates the social-semantic programme of Agent Communication Languages - Rethinking the Principles and the open-issue agenda of Trends in Agent Communication Language and The State of the Art in Agent Communication Languages; its environment-reified interaction complements the self-organisation of A Composite Self-organisation Mechanism in an Agent Network.

Tags

Agents Secure Interaction in Data Driven Languages

Reference: Mahdi Zargayouna, Flavien Balbo, Serge Haddad. INRETS / LAMSADE / LSV-CNRS. Source file: ladspaper9.pdf. URL

Summary

The authors focus on a distinct class of Multi-Agent Systems where agents coordinate indirectly through a shared, data-driven space (like Linda tuple spaces or Klaim) rather than via point-to-point ACL messaging. They argue existing data-driven coordination languages conflate security with the data layer, leaving no principled way to separate agent-level access-control policies from the shared space. They propose LACIOS (Language for Agent Contextual Interaction in Open Systems), which introduces properties (predicate-based descriptions) and symbolic matching as a richer alternative to tuple templates.

Security in LACIOS is handled as an orthogonal layer of access-control rules expressed in the same language as agent behavior: global rules restrict who may see what, and local rules let each agent hide or expose parts of its own state. The paper gives syntax and informal semantics for spawn/add/update/look primitives and discusses a prototype implementation in Java-LACIOS.

Key Ideas

Tuple-space / data-driven coordination separated from message-passing MAS.
Properties + symbolic descriptions replace rigid tuples.
Security as an orthogonal layer of global/local access rules.
Unified language for behavior and security policies.
Enables fine-grained contextual perception in open MAS.

Connections

Conceptual Contribution

Claim: Data-driven coordination languages (Linda, Klaim, SecSpaces, SecOS) lack a principled separation between application logic and security; a richer, property-based description model with orthogonal access-control rules fixes this without abandoning the shared-space paradigm.
Mechanism: Introduces LACIOS with four primitives (spawn, add, update, look), replaces rigid tuples with descriptions (property→value maps) and symbolic descriptions parameterised by variables; specifies global access rules controlling perception/retrieval and local rules enabling contextual self-hiding by agents; defines process syntax and sketches a Java-LACIOS implementation.
Concepts introduced/used: Data-Driven Coordination, Tuple Spaces, Properties, Symbolic Descriptions, Access Control Rules, Coordination-Security Separation, Open Multi-Agent Systems
Stance: engineering / formal-semantic
Relates to: Extends the Linda/Klaim lineage with a security concern that parallels DAgents Security Book Chapter and Agent Tcl Flexible Secure Mobile Agents but at the coordination-language level rather than the mobile-code level; offers a stigmergic alternative to the message-centric view of Multiagent Systems Sycara.

Tags

Mobility

In process-calculus terms, the dynamic reconfiguration of a system’s communication topology — links between processes can be created, communicated, and revoked at runtime. The Pi-Calculus gives the canonical formal account through Name-Passing and Scope Extrusion: a private channel may be communicated outside its original scope, expanding the set of processes that can use it. Mobile Ambients (Cardelli & Gordon 1998) takes a different stance — the mobile entity is a location (an ambient) rather than a name. Mobile-agent systems like Telescript and Agent Tcl are the engineering realisations.

In this vault

Process Calculi

A family of formal languages for describing concurrent and distributed systems algebraically. A process calculus fixes a small syntax of process terms (parallel composition, action prefix, restriction, choice) and gives an operational semantics — usually as a labelled transition system — together with a behavioural equivalence such as Bisimulation. Canonical members:

CCS (Milner 1980) — fixed-topology synchronisation.
CSP (Hoare 1978) — synchronous channel rendezvous; refinement-based equivalences.
ACP (Bergstra & Klop 1984) — equational laws as primary; ad-hoc-extensible signature.
π-calculus (Milner, Parrow & Walker 1992) — name-passing; mobile communication topology.
Mobile Ambients (Cardelli & Gordon 1998) — mobile locations.
Join calculus (Fournet & Gonthier 1996) — asynchronous; pattern-matching on joins.
Spi calculus (Abadi & Gordon 1997) — π + cryptographic primitives.
Applied π-calculus (Abadi & Fournet 2001) — equational theories over terms.

Process calculi supply the formal substrate underneath Session Types, Choreographic Programming, and most modern accounts of distributed-system semantics.

In this vault

Pi-Calculus

A process calculus introduced by Milner, Parrow & Walker (1992) in which the names communicated between processes are themselves channels. Combines the parallel-composition and synchronisation primitives of CCS with name-passing, giving a single primitive that subsumes communication and dynamic network reconfiguration. The standard substrate for Session Types, Choreographic Programming, and modern formal accounts of Mobility and Concurrency. Comes in monadic, polyadic, asynchronous, higher-order, and applied (with cryptography) variants.

In this vault

A Calculus of Mobile Processes — Milner, Parrow & Walker 1992 (original)
A Calculus of Communicating Systems — Milner 1980 (predecessor)
Communicating Sequential Processes — Hoare 1978 (sibling)
Mobile Ambients — Cardelli & Gordon 1998 (locations-first sibling)
Spi Calculus — Abadi & Gordon 1997 (cryptographic extension)
Join Calculus — Fournet & Gonthier 1996 (asynchronous reformulation)
Sjoin Calculus
Session Types
Multiparty Asynchronous Session Types
Structured Communication-Centred Programming for Web Services
Choreographic Programming
Pact - A Choreographic Language for Agentic Ecosystems
Name-Passing
Scope Extrusion
Bisimulation
Mobility
Process Calculi

Coordination Language

A language designed specifically to express the coordination (synchronisation, communication, composition) of concurrent activities, distinct from any computation language that would express the activities’ internal logic. The framing is Gelernter’s: a parallel/distributed program = computation + coordination. Examples: Linda (1985), KLAIM (1998), Reo (2004), Manifold, GAMMA, Orc. Coordination languages are typically embedded — combined with a host computation language — and emphasise separation of concerns between what is computed and how concurrent computations interact.

In this vault

Tuple Spaces

Linda-style associative shared memories where processes coordinate by inserting, reading, and removing typed tuples via pattern matching, decoupling producers and consumers in space and time.