Twelve tutorials on object capabilities (ocaps) with Endo and Agoric — from a single JavaScript object to a blockchain capability marketplace with a mobile PWA wallet.
Define a Car object with two methods. Wrap it in a "valet key" that only unlocks. Hand the key to a confined guest and watch the guest try (and fail) to drive away. By the end you understand pet names, formulas, Far, harden, eventual send (E()), and the Principle of Least Authority.
Bob moves from a guest on Alice's daemon to his own daemon. Alice issues an invitation, Bob accepts, and Alice delivers the start capability over CapTP — the same capability transport protocol used in Agoric's production blockchain. You meet invitations, the CRDT-backed synced pet store, and the revocation model.
Build a makeRevocableForwarder factory. Mint one wrapper per grantee. Revoke Bob's without touching Charlie's. The Car keeps running. This is the per-grantee wrapper pattern: attenuation and revocation are independent, both expressed in plain JavaScript closures.
Bob asks Alice for a capability instead of waiting for her to push one. Alice sees the request in her inbox, approves or rejects it, and Bob's code handles both outcomes. Covers the Endo mailbox, endo resolve, endo reject, persistent settled requests, and pipelining off a promise before the host acts.
Run untrusted third-party code inside a Hardened JavaScript Compartment. Three escape attempts — fetch, process.env, prototype mutation — each fail cleanly. The same plugin does its legitimate work through an attenuated capability. Covers SES compartments, frozen primordials, supply-chain attack resistance, and the Date.now / Math.random covert channel.
Assemble tutorials 1–5 into a working system: a garage broker that provisions per-grantee forwarders to third-party plugins, audits active grants, revokes any plugin independently, and emergency-stops everything at once. Two plugins — one well-behaved, one adversarial — each get exactly the access they were given.
A bridge chapter. Five things the garage cannot do: trust is personal not contractual, payment and access are not atomic, there is no marketplace, the fob cannot be traded, revocation is Alice's word not the chain's. Each gap maps directly to a part of Agoric's stack — ERTP, Zoe, on-chain marketplaces, the wallet, and a Lit PWA mobile wallet.
Agoric's Electronic Rights Transfer Protocol. Turn the car's access right into a tradeable non-fungible asset. Mint a payment, deposit it into a purse, transfer it to Charlie without Alice's involvement, burn it on revocation. Every ERTP primitive maps to a concept from tutorials 1–3 — supply control, attenuation, revocation — now standardised and financially meaningful.
Port the garage to a Zoe smart contract on a local Agoric chain. Alice lists a CarAccess token for 50 IST. Zoe holds both sides in escrow and releases them atomically. Neither party can cheat. Offer safety is enforced by the contract, not by Alice's goodwill.
Multiple sellers post CarAccess listings at different prices. Buyers browse the board, pick a listing, and buy atomically through Zoe. No central operator, no discovery gap, no trust required between parties. Closes the marketplace gap from tutorial 7.
The Agoric wallet is tutorial 1's three-layer model applied to a blockchain. Pet name → ERTP brand → purse balance. Bob approves a CarAccess purchase through the wallet UI, seeing exactly what he gives and receives before signing. The dapp-wallet bridge is attenuation and offer safety composing at the financial layer.
The capstone. A Lit + Vite PWA installable on iOS and Android. lockdown() fires before any component code. Each <car-fob> web component holds its CapTP reference in a private field — the closure from tutorial 3, running in a browser. IndexedDB stores the offline CRDT replica. Tutorial 1's three-layer model, twelve tutorials later, on a phone connected to a blockchain.
A 12-part series on securing AI agents with object capabilities and information-flow control. Prompt injection is the confused-deputy problem reborn; the fix is least authority, not a better-behaved model.
Prompt injection is the confused deputy reborn, and why "make the model behave" can't be the boundary.
The five reframings that turn an LLM agent into an ocap citizen, and the single axiom underneath.
Ocaps bound what an agent can do; information-flow bounds what it can know; you need both.
Why an LLM is a mixing channel, why confidentiality must be prevented at ingestion, and why the best secrets are designed to decay.
Capabilities, the membrane, the agent-as-vat, and a prompt-injected agent that structurally cannot escalate or exfiltrate.
This is where this series shakes hands with the old one: SES lockdown, a transitive revocable membrane, and shrinking the trusted base to a four-method core.
Grammar-constrained tool calls so the model cannot emit an invalid action, then a frontier model over a gateway. Safety turns out to be model-independent.
Process, container, gVisor, microVM, Firecracker, and finally seL4: the rung where confinement stops being strong and becomes proven.
Sharing is delegation, visibility is information-flow, and the social graph turns out to be the capability graph.
Money as mint-and-purse, ownership as a transferable deed, and the discovery that an AI agent owns property by exactly the same mechanism a human does.
Agoric's Zoe lets an untrusted smart contract run without being able to steal; the worst it can do is refund. That is the same move as confining the model. This post is the bridge back to the Endo-and-Agoric series.
The irreducible limits. The striking part: the authority half of the design has no entries on that list. Everything that stays hard lives in the knowledge, human, and hardware halves — and that's true for everyone, not just us.
Where we want to arrive: a neighbourhood of small agents that live on their owners' devices and hold only the keys they're lent — and the swarm of a thousand we'll build to attack our own claims, so a future us can measure how sincere we were to the north star.
A small AI that lives on your device, holds only the keys you lend it, reads your own content before it speaks, and refuses to make anything up.
Mobile agents were a good idea in 1998. Capabilities and a local model finally make them safe — and useful. A hands-on tour of aiglets you can dispatch yourself.
Infinite-canvas feeds disorient not because they are 2D but because they are blank. Treat the feed as a map — one neutral shared geography, personal landmarks — and a legible city becomes the third feed shape.
A hands-on walkthrough you can type yourself: run a real capability call, have two programs find each other across the internet with no server in the middle, and replicate a signed feed — peer to peer.
Public blockchains show everyone every amount and every link. Here is how we built the opposite — a ledger the network can verify but no one can read — and proved it live, with a deposit whose zero-knowledge proof was generated in a browser, from a passkey.
Endo tutorial 7: connect a React Native app to a remote Endo daemon via CapTP over WebSocket. SES runs on Hermes and JavaScriptCore. The gateway client is the same code as the desktop. The CRDT synced pet store gives the phone an offline-capable local replica of its capability namespace — revocations propagate on reconnect.
Yesterday's morph-as-tool refactor leaves a gap. Once the agent can author tools, the next question is what those tools are written in — and whether compilers and VMs are themselves tools. They are. Which means the privileged layer is a design knob; here's how low you can turn it.
Most agent frameworks split decisions into agent-decidable tools and developer-decidable transitions. Collapse that split — make the transition itself a tool — and the agent can design new modes mid-conversation. A 700-line demo with a verification loop, plus an honest accounting of what's still missing.
The only way to catch what an agent did is to send another agent. A short story about scripted tests rotting under prompt drift, and the small twin we built to fix it.
Most chatbots that try to sell something feel like they're processing you. A good salesperson does the opposite — and now an agent can too.
The ship had three agents in the first deck; now it has one, wearing three masks. When the handoff becomes a change of posture rather than a parcel delivery.
Forty years of coding taught me that safety comes from narrowing possibility. Agents don't work that way. The first part of how I learned, not all at once, to unclench.