Reference
The controlled vocabulary of Ambient Agency and Computational Stewardship Theory.
Every term below is defined exactly as it functions in the theory. Use this page as a quick reference while reading the paper; each entry links back to where the concept does its work.
A computational model in which intelligent systems operate as persistent, context-aware participants embedded in human cognitive, organizational, and environmental systems. Ambient agents are not invoked; they observe, model, anticipate, and intervene continuously, largely beneath the threshold of conscious interaction.
The theory that treats ambient agents not as tools but as computational fiduciaries holding delegated authority over a principal's goals, attention, and decision environment under structurally incomplete supervision.
A persistent computational system entrusted with maintaining and advancing the goals, preferences, and decision environment of a principal under conditions in which the volume of its action necessarily exceeds the principal's capacity to observe it.
What replaces the tool relation when all four tool properties fail. Not autonomy — the agent is not acting for itself — but the relationship of a trustee, legal agent, or guardian acting continuously, under discretion, outside the supervision of the party whose interests are at stake.
The pivotal assumption: supervision is not merely costly but impossible at scale. The theory therefore reasons about what can substitute for verification rather than how much to buy.
Evidence that a steward's authority is properly bounded and its exercise properly accountable after the fact. The theory's central claim is that legitimacy — not capability — is the binding constraint on ambient systems.
The agent as extended mind. By holding state the principal would otherwise hold, it becomes a genuine component of cognition. Its obligation is continuity: a mind that silently forgets inflicts a cognitive injury, not a software bug.
The agent as delegated authority. The principal stands to it as a citizen to an office. Its obligation is non-usurpation: the steward must never quietly expand its own mandate.
The agent as environment-shaper, acting on environments rather than decisions — determining which questions reach you. Its obligation is deliberative integrity: shape environments so as to preserve, not pre-empt, the capacity to deliberate.
When one steward serves multiple principals and their preferences conflict (e.g., an organization vs. an individual user).
A fixed, declared ordering of whose mandate prevails in which domain. Auditable after the fact — unlike opaque probabilistic weighting. Weighting hides the conflict; hierarchy adjudicates it in the open.
The philosophical basis for the cognitive layer: a coupled human–artifact system can constitute a single cognitive system when the artifact reliably carries cognitive load.
Given divergent temporal representations of a principal — an authorized past self, an inferred present self, and a projected future self — determine which ought to govern an action when authorization and execution are separated in time and the present self is only partially observable. Not a preference-learning problem: perfect inference does not dissolve it.
Pt₀The principal who granted authority at time t₀ and whose commitments are on record. Fidelity to it is what makes delegation trustworthy at all.
P̂t₁The largely unobserved principal at action time, whose current preferences must be inferred with calibrated confidence c.
P̃t₂The principal whose welfare present interventions will determine over the horizon t₂, but who cannot yet be consulted.
The rule the steward optimizes: V(a) = λ·u(a|Pt₀) + (1−λ)[c·u(a|P̂t₁) + (1−c)·u(a|Pt₀)] + γ·u(a|P̃t₂). Adjudicates between an authorized past self and an inferred present self.
λ — fidelity weight, a function of reversibility & stakes (→1 for irreversible/high-stakes). c — inference confidence; low c collapses to the recorded mandate. γ — future-welfare discount, guarding against satisfying you today at your later expense.
Constraining authority rather than actions: the principal grants a bounded, revocable, auditable mandate within which the steward acts freely — as a constitution bounds an office rather than vetting each decision.
Specifies five things: delegable powers, non-delegable powers, escalation conditions, reversibility requirements, and audit requirements.
Powers reserved to the principal absolutely. Not arbitrary but derived: an act is reserved to the extent it is irreversible, high-stakes, or identity-constituting — the cases where the fidelity criterion drives λ→1 anyway.
A mandate issued with an explicit scope-and-expiry envelope, beyond which authority lapses and must be renewed. A tuple ⟨domain, blast radius, expiry, renewal rule⟩. Makes consent graduated and self-expiring rather than perpetual.
The systemic impact of an action rather than its surface category. Scoping by blast radius lets low-impact interventions flow with minimal friction while structural changes face tight governance.
An append-only, state-isolated record logging, for every consequential action: the action, the mandate clause and Consent Horizon, the inferred preference state and confidence c, and the reversibility class. Not a debug log — a legitimacy artifact.
Continuously acquires environmental signals, and must decide what is worth attending to without a task to define relevance.
Maintains persistent representations of the people, organizations, and objectives in the principal's life. Maintains a shadow state via immutable event sourcing so polluted states can be cleanly rolled back.
Maintains the temporal representations Pt₀, P̂t₁, P̃t₂ and is responsible for keeping confidence c honest.
Optimizes the time-discounted fidelity criterion over long-horizon goals rather than immediate requests.
A gate, not a generator. Admits an action only within an active Consent Horizon and the delegable set; escalates, blocks the non-delegable boundary, and writes to the ledger regardless.
The constitutional layer may veto the reasoning layer, but never the reverse — the architectural expression of non-usurpation. Without it, delegation is merely advisory.
Long-horizon alignment with the principal's objectives, assessed retrospectively against the Legitimacy Ledger.
The rate at which the agent surfaces genuine choices versus forecloses them.
Diversity of the decision environments constructed and their freedom from manipulative framing.
The expected systemic cost of undoing autonomous interventions — a first-class optimization target, not merely a metric.
The rate at which actions remain within the active mandate, and the integrity of the non-delegable boundary.
Above a threshold of action volume and temporal span, trust is governed more strongly by legitimacy than by capability. Stated to be falsifiable, with a described refuting experiment.