X-11 · Accepted

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

An agent holds its user’s capabilities, including Administrator when an administrator starts it (owner decision, 2026-10-30)

Breaks	Status	Mitigation	Closes in
Correct (authority)	Accepted	By design, not a defect: agents are not treated differently from their users in what they may do. Every request is attributed to the agent in the executor log; who started it is in the hash-chained journal; it has no login session or terminal, so it cannot approve an AskFirst change through the daemon’s terminal check (unless it allocates its own pty, the known weakness of §16), and its own AskFirst proposals are its user’s, which that user cannot approve (I19)	—

The guarantees it narrows