Collective Intelligence Network Get involved

Get involved

For builders

Good ideas only matter once someone writes the code. Some of the most useful building blocks are small enough that you could ship them this month.

When cities first wired homes for electricity, early appliances often plugged straight into bare wall lines without fuses or grounding wires. When a toaster shorted out, the whole house could catch fire. Engineers didn't solve that by writing essays about electrical ethics. They invented the five-cent fuse, the three-prong plug, and the circuit breaker box.

Today's AI agent frameworks look a lot like those early ungrounded circuits. An agent is handed a user's master login, given full network access, and told to read untrusted web pages while holding the keys to email and payments. When something goes wrong, there is no fuse in the wall and no receipt on the table.

You don't need permission from a standards committee to build better plumbing. Five small engineering patterns, each small enough to ship in a sprint, can change how software agents behave in the wild.

Comparison of an ungrounded agent execution circuit versus a capability-scoped delegated circuit Diagram contrasting an ungrounded circuit with ambient keys and prompt-injection hazards on the left, with a grounded circuit using quarantined readers, external policy checks, and short-lived delegated tokens on the right. UNGROUNDED CIRCUIT High hazard 1. Input Ingestion Untrusted text mixed into tool context 2. Credential Authority Permanent master key in environment 3. Safety Boundary Policed only by model prompt rules 4. Failure Mode Injected text triggers unauthorized tools No fuse · No checkable receipt GROUNDED CIRCUIT Protected 1. Input Ingestion Quarantined reader with zero tools 2. Credential Authority Short-lived delegated token (15-min lease) 3. Safety Boundary Deterministic gate outside the model 4. Output Provenance Dual-signed receipt saved on user device Fuses active · Verifiable receipt
An ungrounded agent circuit exposes permanent credentials to untrusted text without a fuse; a grounded circuit quarantines reading, validates intent through an external gate, and uses short-lived tokens that leave a signed receipt.

Five building blocks you can ship this month

1. Give every agent a valet key, never a master key. When you hand your car to a parking attendant, you give them a valet key that starts the engine and turns the wheels, but cannot open the trunk or the glovebox. And when you pick up your car an hour later, the key comes back to you.

Most agent frameworks do the opposite: they store long-lived API keys or session cookies in an environment variable where any tool call can reach them. Instead, wrap every outward tool in a short-lived, narrowly scoped lease. State the exact action allowed, the maximum count or limit, and a fifteen-minute expiry timestamp.5 If the agent needs more, it has to ask the person again.

2. Separate the mailroom from the control room. Imagine a bank where anyone who slipped an unsigned note under the front door could walk straight into the vault and rewrite the standing orders. That is what happens when an AI agent reads an untrusted email or webpage in the same context window that holds its tool-calling permissions.

Build a hard wall between reading untrusted text and taking outward actions. Let a quarantined reader process summarize incoming text with zero tool access. Require a separate, deterministic policy check before any outward network or file action executes.4

3. Turn raw debug logs into human receipts. Engineers love JSON stack traces; ordinary people hate them. Think of the difference between a car's onboard diagnostic stream and the printed itemized receipt from a neighbourhood garage. Both describe the same repair, but only one lets the car owner see what was replaced and challenge an unfair charge.

Whenever your software acts on a user's behalf, emit a compact, signed action receipt that answers three plain questions on one screen. Who authorised this task? What rule or lease permitted it? What exact external state changed? Store that receipt locally on the user's device first, so the user owns the record even if your server goes offline.

4. Stamp files and builds with a real postmark. An unsigned file on the internet is like an anonymous typewritten sheet left on a park bench. Nobody can tell whether it came from a camera, a sensor, or a language model.

Add C2PA content credentials to media pipelines so cameras and editing tools leave a tamper-evident postmark.1 Sign your software releases, model weights, and agent policy bundles with Sigstore and in-toto attestations so downstream users can verify exactly how a build was produced before running it.2

5. Give software workloads their own licence plates. When a bot logs in using a human employee's password, audit trails blame the human when the software misfires. Follow emerging workload identity standards like IETF WIMSE so every automated agent carries a distinct cryptographic badge tied to an accountable owner, never a borrowed human login.3

How to stress-test and build with us

We publish our working specifications, client code, and simulation harnesses in the open so engineers can inspect every line and point out where a design is brittle. Here are three concrete projects where an open-source builder can jump in right now:

  • Critique our IETF draft and wire envelopes. Read our working Internet-Draft on accountable agent sessions and tell us where the packet framing, lease revocation, or nat-traversal assumptions break under real network conditions.
  • Build a lightweight receipt viewer or browser extension. Help us turn signed agent action logs into a calm, zero-tracking local inspector that a non-technical parent or clinic clerk can read in five seconds.
  • Contribute to the Shared Horizon client and path library. Our interactive scenario engine is built in dependency-free HTML, CSS, and JavaScript with strict accessibility and security checks. New scenario cards, institutional adapters, and test cases are always welcome.

Write to us at contact@collectiveintelligencenetwork.org with a link to what you are building, or a blunt note on what we got wrong. A person reads every message, and your code can help people use capable AI without handing over the keys to their lives.

1. Coalition for Content Provenance and Authenticity (C2PA), C2PA Technical Specification, v2.1 (2024).

2. Sigstore documentation, docs.sigstore.dev/about/overview, and Zachary Newman, John Speed Meyers, and Santiago Torres-Arias, "Sigstore: Software Signing for Everybody," ACM CCS (2022), pp. 2353–2367; in-toto specifications, in-toto.io/specs, and Santiago Torres-Arias et al., "in-toto: Providing farm-to-table guarantees for bits and bytes," USENIX Security Symposium (2019), pp. 1393–1410.

3. J. Salowey, Y. Rosomakho, and H. Tschofenig, Workload Identity in a Multi System Environment (WIMSE) Architecture, IETF Internet-Draft (2026).

4. Edoardo Debenedetti et al., CaMeL: Defeating Prompt Injection via Capability-Based Access Control, arXiv:2503.18813 (March 2025); Dimitrios Stamatios Bouras, Yihan Dai, and Sergey Mechtaev, Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents, arXiv:2609.08371 (September 2026); and Jack B. Dennis and Earl C. Van Horn, "Programming Semantics for Multiprogrammed Computations," Communications of the ACM, Vol. 9, No. 3 (1966), pp. 143–155.

5. Abhishek Goswami, Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents, arXiv:2509.13597 (September 2025); and Brian Campbell, Chuck Mortimore, Michael B. Jones, and Yaron Y. Goland, RFC 8693: OAuth 2.0 Token Exchange, Internet Engineering Task Force (January 2020).