Agent NAS v0.2
English

Glossary

This glossary defines every term Agent NAS uses: the nine named concepts and the supporting vocabulary. The concept names are coined terms and stay in English in every language.

v0.2 Draft specification Updated

The nine concepts

Agent Home
An Agent Home is a directory per role, with history: instructions, skills, memory, journal and workspace, all as plain files. Any runtime can enter it, and you can take all of it with you when you leave.
Agent Branch
An Agent Branch lets each run work on a copy-on-write branch. Changes reach the protected main line only through a reviewed merge (an Agent PR), and you can checkpoint and restore at any time.
Flight Recorder
A Flight Recorder is an append-only, hash-linked record kept per run: what the run read (the read manifest), what it wrote, what was allowed or denied, and who approved what. It sits beside the data and answers one question: “what may have influenced this change?”
Capability Lease
A Capability Lease is an authorization for specific data and specific operations, with an explicit expiry and budgets. It is issued to one run and is the only way a run touches the NAS. A child lease can only be narrower than its parent.
Human Gate
A Human Gate is a policy-triggered checkpoint: before an irreversible, outward-facing or privilege-raising action takes effect, a person (or a designated approver) approves one fully rendered, concrete action. It is designed to be rare, specific and hard to rubber-stamp.
Trust Labels
Trust Labels are two very small label sets attached to data, origin (owner, agent, external) and sensitivity (public, private, secret), plus session taint. The NAS enforces the Rule of Two as a session invariant: a session cannot have all of [A] has read external content, [B] touches sensitive data and [C] changes protected state or communicates outward. Completing the third requires a Human Gate.
Agent Memory
Agent Memory = notes you can read and edit + indexes you can throw away at any time. Every note cites its sources; indexes (full-text, vector, graph, outline) are only derivatives of the notes; and background maintenance jobs only propose edits and never rewrite the raw journal.
Budgeted Reads
Budgeted Reads are reads measured in a token budget: the same file can be read at different levels of detail, from outline and section to line range and full text. The agent asks for “the best view that fits in N tokens” and gets evidence pointers back to the exact source.
Cascade Forget
Cascade Forget is deletion along lineage: when a source is deleted, or someone asks to be forgotten, the NAS finds everything derived from it, including summaries, embeddings, notes that cite it, caches and share links, deletes it or re-derives it without that source, and issues a report: what was done, and what could not be.

Supporting terms

Principal
An entity that can be authenticated and held accountable: a human, an agent, a service or a node.
Run
One execution with a start, an end, a purpose and a responsible party. A run holds one root lease and owns one branch.
Protected tree
A tree that can only be updated through a reviewed merge and never accepts direct writes, for example main.
Read manifest
The aggregated record of the paths, commits, ranges and content hashes a run has read. It contains no content.
Evidence pointer
A verifiable reference of the form nas://<node>/<tree>/<path>@<commit>#L12-L18 to exact lines in one commit.
Derived data
Data computed from notes by a recipe, such as an index, an embedding or a summary. It can be discarded and rebuilt.
Recipe
Everything needed to produce a derived object: the model and its version, the chunker and the settings.
Lineage
The dependency graph between derived objects and the inputs they were computed from.
Session taint
The union of the labels of everything a session has read. It only grows within a session and decides what the session may do next.
Rule of Two
A heuristic from Meta: until prompt injection is reliably solved, a session should have at most two of three properties: [A] processes untrustworthy input, [B] accesses sensitive data, [C] changes state or communicates externally.
Declassification
Lowering the sensitivity of data, or raising the trust in its origin. Only through a Human Gate or a schema-validated structured handoff.
Policy envelope
A range set in advance by the owner within which leases are issued automatically. Requests outside it go to a Human Gate.
Credential Broker
A component that holds long-lived secrets and mints short-lived downstream tokens only for approved egress actions. Models and runs never see the long-lived secrets.
Agent PR
A structured proposal to merge a branch into a target, with the diff, provenance, check results and a label summary.
Retention class
One of scratch, normal or sensitive, chosen at write time. It decides backups, history and whether the data can be shredded.
Crypto-shredding
Destroying a key so that every copy encrypted with it becomes unreadable.
Conformance level
A level from L0 to L4. Each corresponds to a set of concepts and a set of executable acceptance tests.
MCP
Model Context Protocol: an open protocol between agents and tools or data sources.
A2A
The Agent2Agent protocol: an open protocol for agents to collaborate on tasks.

Cite this page

Stable addresses and a suggested citation for people, search engines and agents.

Suggested citation
Agent NAS project. “Glossary.” agentnas.com, 2026-11-11. https://agentnas.com/glossary/