REVIEW — Native agents, external models, tools, and provider substitution

[satonakaoshimoto]

Native identity and authority must remain separate from the model or provider

A Native M5Agent is canonically defined inside the M5 environment and acts only under bounded authority. An external model, hosted API, plugin, MCP server, search provider, data source, or specialized service may supply computation or information, but it does not inherit the native agent's identity or authority.

The member should be able to choose local/offline or approved external models and replace providers without losing identity, permissions, provenance, evidence, or the ability to revoke access.

Help us review

• What proves native-agent identity, version, accountable principal, and current delegation?
• Which functions must remain local or offline, and which may use external services?
• What minimum disclosure is required before private context leaves the M5POD boundary?
• How should model, tool, API, and data-provider substitutions preserve behavior and receipts?
• How are discovery, read, write, invoke, disclose, sign, pay, transfer, and administer permissions separated?
• How should an external service prove deletion, retention limits, regional processing, and subcontractor boundaries?
• What happens when a model is unavailable, compromised, deprecated, or changes behavior?
• Which conformance tests demonstrate no silent authority transfer to the provider?

Start with the M5-agent hub · Read M5AGT Credentialed Operations · Read the L0–L8 + ZK map

Do not post production endpoints, credentials, private model prompts, member context, or confidential integrations.