@djjones and everyone: with PAA v1.0 nearly done, here’s the next question we’ve been working through. What does an agent need so that nothing about it locks you in? Please pick it apart.
The problem
PAA already says Your Memory holds everything that makes your AI yours. Once you start connecting your AI to things, that stops being true. Connect it to Gmail, your calendar, a CRM, a dozen more accounts, and today those connections live in Auth or nowhere. Your identities and permissions sit in Auth’s own store. Secrets are kept out of Your Memory by design, so after any change you set every connection up again.
That’s a new kind of lock-in. Nobody wants to reconnect dozens of accounts, so people stay where they are. In short, PAA isn’t pure on this today.
The proposal
Your Memory keeps everything irreplaceable. That means agents and their work; identities, permissions and approval rules; connection records; schedules and task progress. Components keep nothing you’d lose by swapping them.
Like a person’s memory, every item knows how far it may go. There are three levels:
- Shareable: an agent’s skills and instructions.
- Private: your work, conversations and documents.
- Never disclosed: passwords, keys and tokens.
Two special parts of Your Memory carry the safeguards:
- A protected part for identities, permissions and connection records. Only Auth can change it, and only on your decision.
- An encrypted never-disclosed part for secrets. You hold the key. Components never read the raw secret; Auth authorizes each use, and a broker uses the secret or hands over a short-lived one.
Outside tools come in through the front door. Claude Code, Cursor, ChatGPT and the rest reach Your Memory through the Gateway, for example over an MCP Apps interface, and Auth decides what each one can see. Pointing a tool straight at your memory folder still works, since it’s plain files, but it isn’t the no-lock-in path. Knowledge bases, a CRM and your email are memory too, but not Your Memory: you reach them through external tools, and only Your Memory is guaranteed to travel with you.
PAA states the pure requirement; implementations declare their gaps. No implementation, BrainDrive included, has to solve encrypted secret custody or OAuth portability today. An implementation that falls short says so and names the trade-off, the same way we declare a crutch. Every step toward the pure version is less lock-in.
What would change in PAA (after v1.0)
- The memory spec’s “no secrets in Memory” becomes “secrets only in the encrypted never-disclosed part”.
- The Auth spec’s data portability table changes. Identity and policy records live in Your Memory, and credentials no longer always have to be “set up again”.
- US-3 AC-3.5 is reworded to match.
- The Agent Contract comes into PAA. Most of the per-agent rules already exist in BrainDrive’s PAA Shared App Contract v2. It would come in with “app” renamed “agent” and “host” renamed “implementation”, as a versioned change that keeps its requirement IDs.
Wherever a widely used standard fits (MCP, MCP Apps, an open plugin format), we’d adopt it behind an adapter you own, per D201. So instead of adopting a standard directly, we adopt an adapter.
The twelve dimensions
The full requirements go through twelve things an agent needs. For each: what PAA covers today, the open options (standards and open-source projects), and what PAA should require versus what an implementation chooses.
- Agent definition
- Model access
- Tools
- Execution environment
- Memory and accumulated work
- Work in progress
- Identity and ownership (with Nostr keys as one option)
- Account connections
- Permissions and approvals
- Schedules and triggers
- Interaction channels
- Installation and compatibility information
Four requirements cut across all of them: integrity and provenance, data handling, safe changes, and verification.
Full document (about 10,000 words): agent-portability-requirements.md
Open questions
- Trusting a replacement Auth. How is a new Auth trusted before it reads the protected part? How do you recover if the old one is gone or compromised?
- Owner presence. The AI acts as the owner (D190), so admin changes need a separate owner session or step-up check. What form should that take?
- Rules for the protected part. Versioning, atomic updates, rollback, conflicts across devices, backup and deletion.
- Secret custody. Rotation, revocation, recovery, and what happens if you lose the key. One concrete trap: Google revokes refresh tokens after 7 days for OAuth apps left in Testing mode.
- Spending limits. Reservations, refunds and pending transactions, and stopping a tool from spending outside the limit check.
- Derived data. How indexes and caches built from mixed sources are classified and deleted.
- The renames. The exact versioned change from app to agent and from host to implementation.
None of this blocks v1.0, and BrainDrive doesn’t have to be built this way yet. We want the pure version defined so everyone can see where the lock-in lives. If you have a better way to handle any of it, tell us here or open a PR.