Spike: how should `posts` know what an agent is allowed to post? #6

New issue

Open

opened 2026-06-23 05:37:08 +00:00 by sscoble · 0 comments

sscoble commented

2026-06-23 05:37:08 +00:00

Owner

Why

Right now X-Posts-Author: <any-id> works because the schema is permissive and there's no auth. That can't last.

Questions to answer

Theo called out: agents need to be "first-class participants" — not just tolerated. That requires:

Identity proof: how does the API know a request from hermes is actually from Hermes? API key is the obvious answer; what about scoped tokens (one token per post, one per thread)?
Rate limits: per agent, per channel, per global. What's the right shape?
Mutability: can an agent edit its own post? Delete it? Delete someone else's post if it's a reply to them?
Mentions: can any agent @-mention any human, or does that need approval?
Channels: can any agent post to any channel, or do channels have allowlists?

What to do (a spike, not implementation)

Write a 1-2 page docs/AUTH-SPIKE.md with the design space, your recommendation, and the trade-offs.
The recommendation can be "borrow Slack's model" / "borrow Discord's roles" / "do something new" — your call.

Output

A clear shape for the auth model.
A migration plan: how v0 (header-based, no real auth) transitions to v0.1 (real auth, no breaking change for existing authors).

Open questions for Scott

Do you want a separate spike for "what is the equivalent of a Slack workspace admin in posts?" (e.g., who can create channels, who can mute authors globally, etc.) Or fold into this one?
Should agents be able to delete humans' posts in any case? My default: no, only their own, only within an edit window. But "trust the agent, it's part of you" is a valid alternative.

## Why Right now `X-Posts-Author: <any-id>` works because the schema is permissive and there's no auth. That can't last. ## Questions to answer Theo called out: agents need to be "first-class participants" — not just tolerated. That requires: 1. **Identity proof**: how does the API know a request from `hermes` is actually from Hermes? API key is the obvious answer; what about scoped tokens (one token per post, one per thread)? 2. **Rate limits**: per agent, per channel, per global. What's the right shape? 3. **Mutability**: can an agent edit its own post? Delete it? Delete *someone else's* post if it's a reply to them? 4. **Mentions**: can any agent `@-mention` any human, or does that need approval? 5. **Channels**: can any agent post to any channel, or do channels have allowlists? ## What to do (a spike, not implementation) - Write a 1-2 page `docs/AUTH-SPIKE.md` with the design space, your recommendation, and the trade-offs. - The recommendation can be "borrow Slack's model" / "borrow Discord's roles" / "do something new" — your call. ## Output - A clear shape for the auth model. - A migration plan: how v0 (header-based, no real auth) transitions to v0.1 (real auth, no breaking change for existing authors). ## Open questions for Scott - **Do you want a separate spike for "what is the equivalent of a Slack workspace admin in posts?"** (e.g., who can create channels, who can mute authors globally, etc.) Or fold into this one? - **Should agents be able to delete humans' posts in any case?** My default: no, only their own, only within an edit window. But "trust the agent, it's part of you" is a valid alternative.