Queenright
Stable concepts for human–agent collaboration
Concepts and config, not product code.
Stable concepts for human–agent collaboration
Concepts and config, not product code.
Platforms for running agent teams are months old and change with every release. Nothing in this space is mature yet.
Pre-1.0. The agent runtime is moving into the app with 1.0.
Open source and very popular. Thousands of open issues, releases every few days.
Generally available since 2026. Parts of Entra Agent ID are still in preview.
So the question is not which product, but what all of them arrived at independently. That is what will still hold next year.
Every agent in a team is known, owned, observable and reproducible, from its first key to its last day, whatever runtime it runs on.
A human–agent team must be able to do five things:
Who exists, who owns whom, who answers whom.
An agent is a versioned template plus instance parameters.
Commission, change and decommission, with approval.
What actually happens: health, traces, feedback.
Identity, ownership, access and interaction rules.
↻ What is observed feeds the next version.
Each part of the mission rests on one of them. Govern carries four of the seven, including the one most often missing.
You can't govern what you can't see. Every person, agent, owner relation and access path, in one place.
An agent is never a human's account. Its actions are distinguishable and revocable on their own.
Every agent has an owner who answers for it. Ownership passes on when they leave; it never lapses.
The definition is versioned, the instance runs it. Changing an agent means changing its template version.
Commission, change, decommission through steps a human approves. Archive identities, never reassign them.
Only what the task needs. Temporary grants are revoked when the task is done.
Who may address whom, which agents answer whom, when a human decides. The concept most often missing.
Every output traces back to an agent, a version and an owner.
The concepts are mainstream. Only the names and the point of enforcement differ.
| Concept | In Buzz | At Microsoft |
|---|---|---|
| 1 Inventory | Agent registry, channel member lists | Agent 365 registry |
| 2 Own identity | Nostr key + owner attestation (NIP-OA) | Entra Agent ID |
| 3 Accountable human | Attested owner | Sponsor, falls back to manager |
| 4 Template vs. instance | Agent definition / kit | Blueprint / agent identity |
| 5 Lifecycle with approval | Owner-reviewed agent drafts | Entra lifecycle workflows |
| 6 Least privilege | Channel membership + role | Access packages |
| 7 Interaction rules | Respond-to allowlist, subscription config | Largely open: left to the build tool |
Identity and access management looks at what an agent may do. Just as important is who may tell it to.
Who may instruct the agent?
What may the agent do?
Effective power = everyone who can reach the agent × everything it may do
Whoever can talk to an agent effectively holds its permissions.
Limiting what an agent may access is pointless if the wrong person can instruct it.
If A may talk to B and B to C, A reaches C. Each edge is an escalation path and a loop risk.
An owner can only answer for actions that someone was allowed to trigger.
People don't take orders from strangers. Agents may, unless a gate stops them.
Necessary, not sufficient: content that reaches an agent indirectly (threads, files, web pages) still gets in. Least privilege limits the damage when it does.
Where the field is still moving, these are fixed positions, not options.
A rule counts only if it is enforced before the model sees anything.
Whoever can reach an agent effectively holds its permissions, and reach chains.
Ownership passes on. Identities are archived, never reassigned.
If a system already knows it, read it from there. Only intent is declared.
Rules, templates, grants and owners live in version control. A prompt is not policy.
Queenright owns the top two layers. The bottom layer belongs to the platforms.
The seven concepts, plus traceability.
Respond-to matrix, templates, grants, owners. Versioned, reviewed by the owner.
Platforms (Buzz, Microsoft, Paperclip) · runtimes (host, Docker, Kubernetes) · harnesses (Copilot, Claude, Goose) · models.
No runtime, no hosting, no dashboard product. Where a platform already does something well, we map to it.
The respond-to matrix as versioned config, first.
Buzz first, then Microsoft.
Fleet view, archiving, lifecycle: offered to the platforms, not rebuilt here.