My thought was that to do applications with agents, what you really need is a filesystem and perhaps an entire access rights policy that can handle the notion of agent-acting-on-behalf-of
I'm not sure if Unix groups could be leveraged for this, it would have to be some creative bending of the mechanism which would probably rile the elders.
Perhaps subusers or co-users are needed. They have their own privilege settings and can do the intersection of their own privileges and the client for which they act.
The main distinction would be the things they create are owned by their client, and they can potentially create things and then revoke their own access to them effectively protecting things from future agent activity, but leaving all of the control in the users hands.
I'm not sure if Unix groups could be leveraged for this, it would have to be some creative bending of the mechanism which would probably rile the elders.
Perhaps subusers or co-users are needed. They have their own privilege settings and can do the intersection of their own privileges and the client for which they act.
The main distinction would be the things they create are owned by their client, and they can potentially create things and then revoke their own access to them effectively protecting things from future agent activity, but leaving all of the control in the users hands.