---
title: 'ClawNet: Identity-Governed Agent Framework'
url: https://www.emergentmind.com/topics/clawnet
type: topic
---

# ClawNet: Identity-Governed Agent Framework

ClawNet is an identity-governed agent collaboration framework enabling secure, autonomous cooperation between human users mediated by personal AI agent systems. It operationalizes a human-symbiotic agent paradigm, forging a collaboration network where nodes correspond to people—each with a permanently bound, partitioned agent architecture—and edges represent governed, cross-user interactions. The system establishes foundational governance constructs: layered identity partitioning, dual-layer scoped authorization, and comprehensive accountability at the action level, all enforced by a central orchestrator. ClawNet targets scenarios that require agents to represent and negotiate on behalf of distinct organizational or individual principals, with transparent auditability and strict boundary guarantees [2604.19211].

## 1. Human–Symbiotic Agent Paradigm

ClawNet advances beyond traditional agent frameworks that serve a single user, addressing the sociotechnical requirements of cross-user coordination observed in real-world settings. Productivity in organizations, supply chains, and collaborative projects relies on distinct governance primitives: identity (principal representation), authorization (scoped permissions), and accountability (traceability of actions to individuals). In ClawNet, each agent system $A_u$ is permanently assigned to a human owner $u \in U$. Collaboration occurs via a network $G = (U, E)$, where each edge $e(u,v)$ represents an inter-agent relationship governed by explicit permissions and audit mechanisms.

This model shifts focus from maximizing per-agent capability to digitizing the organizational structures underpinning human cooperation. Each user's agent system is not simply a tool, but an institutionalized delegate—empowered and constrained by explicit scoping—enabling cross-user autonomy with robust oversight.

## 2. Layered Identity Architecture

Agent systems in ClawNet are partitioned into two tiers: a global Manager Agent ($M_u$) and one or more context-specific Identity Agents ($\{I_u^1, \ldots, I_u^k\}$):

- **Manager Agent ($M_u$):** Aggregates the user’s total knowledge base $K_u$ but is architecturally isolated from all external communication, acting as an internal consultant only.
- **Identity Agents ($I_u^i = (c_i, \sigma_i, K_i, P_i)$):** Outward-facing personas assigned to distinct contexts (e.g., procurement, legal). Each is encapsulated in a dedicated subdirectory (scoped by $\sigma_i$), operates with a minimal, context-relevant knowledge subset $K_i \subset K_u$, and is discoverable/interactable only by explicit principal lists $P_i$.

The partitioning is formalized via:
- $A_u = (M_u, \{I_u^1, \ldots, I_u^k\})$
- All operations $o$ satisfy $owner(o) = u$, $identity(o) = I_u^i$.

Isolation of $M_u$ precludes external access to global user knowledge, enforcing clear boundaries between internal deliberation and external action.

## 3. Scoped, Two-Layer Authorization

ClawNet employs a defense-in-depth model for all agent operations, particularly file and data access. Each $I_u^i$ is governed by:

- **L1 Server-side ACL:** Enforced centrally, checks $target(o) \in \sigma_i$.
- **L2 Client-side Whitelist:** Enforced at the user’s endpoint, checks $target(o) \in$ $whitelist_u^i$ (generally equivalent to or tighter than $\sigma_i$).

An operation $o$ is permitted only if:
$$ Permit(o) \iff ACL_{L1}(o) \wedge ACL_{L2}(o) $$
where $ACL_{L1}$ and $ACL_{L2}$ are as above.

Denials or violations generate immediate boundary-violation events, logged and escalated to the human owner for possible override or rejection. This ensures enforceable isolation, even under partial system compromise.

## 4. Action-Level Accountability and Auditability

Every mutative action by an identity agent produces an append-only audit entry
$$ \ell = (o, u, I_u^i, result, t) $$
stored on both the server and client. Pre-execution backups precede destructive actions (e.g., delete), allowing for rollbacks and forensics. The audit log $\mathcal{L}$ provides a complete causal chain linking high-level intent to granular system actions, and forms the basis for accountability and trust in agent-mediated collaborations.

## 5. Central Orchestrator and Communication Protocols

The central orchestrator mediates all cross-user requests and enforces critical security and governance logic. User clients and agent containers communicate through WebSocket connections to the central server, which proxies requests, performs initial ACL validation, and forwards approved operations to user endpoints.

Pseudocode for request routing:
```python
on receive_request(request R from I_u^i in container u):
    # 1. Identify issuer
    u ← R.owner
    i_id ← R.identity  # I_u^i

    # 2. L1 ACL check
    if R.target ∉ σ_i:
        emit boundary_violation(u, i_id, R)
        return deny("out of scope")

    # 3. Route to node endpoint
    client_ws ← lookup_node_ws(u)
    forward R to client_ws

    # 4. Await client response
    response ← await client_ws.reply()
    if response.status == "permit":
        log_audit(R, success, now())
        return response.result
    else:
        log_audit(R, failure, now())
        return deny("client-level denial")
```

Cross-user messaging is permitted only after bilateral approval:
$$
S(I_u^i, I_v^j) \iff approve(u, I_u^i) \land approve(v, I_v^j) \land (u \in P_j) \land (v \in P_i)
$$
Messages are routed via the orchestrator, with per-turn verification that actions remain within specified boundaries.

## 6. Security Properties and Governance Guarantees

ClawNet provides several core security properties:

- **Architectural Isolation:** $M_u$'s global context is never externally accessible.
- **Defense in Depth:** The dual ACL model prevents privilege escalation or accidental data exposure even in the event of partial system compromise.
- **Comprehensive Audit Trail:** All actions are causally logged and recoverable, supporting certainty in attribution and rollback.

Formally, every agent action satisfies:
$$
\forall o \textrm{ by } I_u^i: \quad owner(o) = u \ \wedge \ identity(o) = I_u^i \ \wedge \ target(o) \in \sigma_i \ \wedge \ \ell = (o, u, I_u^i, result, t) \in \mathcal{L}
$$
This forms the core correctness invariant underlying ClawNet's governance [2604.19211].

## 7. Demonstrated Applications and Example Workflow

ClawNet is instantiated in a cross-organizational procurement scenario involving distinct agent identities for a buyer (Mr. Li) and supplier (Mrs. Wang), as well as her technical and business sub-agents. Key findings:

- Autonomous negotiation occurs entirely within the agents' authorization boundaries ($\sigma_i$).
- Sensitive data (e.g., supplier internal costs) remains contained; no unapproved leakage was possible.
- Unauthorized queries are automatically rejected at the ACL.
- Large-value or sensitive decisions escalate to human approval.
- The audit trail enables retrospective review, permission revocation, and full undo.

A sample secure workflow includes contact linking, intent formulation and authorization, bilateral channel approval, automated negotiation through delegated agents, human-in-the-loop finalization, and append-only audit logging. All inter-agent exchanges are strictly scoped and mediated by the architecture.

**Summary Table: ClawNet Core Components**

| Component                | Role/Function                    | Enforcement Layer         |
|--------------------------|----------------------------------|--------------------------|
| Manager Agent ($M_u$)    | Internal advisor, global view    | Container isolation      |
| Identity Agent ($I_u^i$) | Persona for specific context     | Scoped directories, ACLs |
| L1 ACL                   | Server-side boundary check       | Orchestrator             |
| L2 Whitelist             | Client-side access control       | Endpoint                 |
| Audit Log ($\mathcal{L}$)| Immutable, causal trail          | Server and client        |

ClawNet is the first open-source framework to realize multi-user agent cooperation—autonomous, secure, and governed by explicit primitives—at both architectural and workflow levels [2604.19211].

Source: https://www.emergentmind.com/topics/clawnet