Data

What an action consumes and what it leaves behind: where its values come from, what goes out, how long everything is kept, and what happens only once. What caps several actions is a budget.

Where a value comes from

A guard checks an action, not the origin of its values. set_by does (see Skills):

    params:
      amount:    {type: price, set_by: [read, person], max: "$params.max_amount"}
      recipient: {type: email, set_by: [read, identity]}   # never the model
      note:      {type: text,  set_by: [llm, person]}

A value whose origin is not permitted is refused (phase 3 of the guards).

What goes out

A read brings a salary into the context; a later write — an e-mail to the candidate — could carry it outside. Two declarations prevent this:

apis:
  - name: gmail
    operations: [{id: sendEmail, access: write, audience: external}]
skills:
  - name: read-contract
    present:
      fields:
        salary: {from: gross_salary, type: price, class: confidential}

A write to an external audience cannot carry a value of class confidential or higher. Core checks this on the values, since it knows what the room has read. A smart policy can detect a paraphrase; it does not replace this check.

class	can go
public	everywhere
internal	within the organisation
personal	where the person concerned expects it; reduced in the output to the model when possible
confidential	never to an external audience
secret	never to the model (removed by output_filters)

Keep only what a place needs (GDPR): read traces keep only what the following guards read and what the person must see.

Durations

• The room: empty, it is deleted after 24 h; inactive, after 90 days. These are the default durations, adjustable per tenant. What it contains — selection, conversation thread, records, identity data — follows it. See Context.

• The log is kept for the time the law requires of the tenant, longer than the room.

• Health data is never kept: a room does not retain it.

• An approval is tied to a version of the action — a fingerprint of its arguments. If the action changes, the approval falls.

• valid_for on a skill: a quote valid for 30 days. Beyond that, the action is checked again before the submit.

• A read trace can be stale; a submit guard can require a recent read.

A rule that changes during a journey

The room keeps the config version it started with — a three-day journey does not change rules along the way. One exception: a tightening applies at once, a loosening only to new journeys. Revoking a sub-identity does not wait.

Uniqueness

unique: "$params.invoice" on a skill: the same invoice is not refunded from two tickets.