[AI-interop] Motivated agents

[Tiantian Tong]

Hi Dave,

Yes, I like this. I don’t see it as adding general behavioural rules to 
every skill, it’s a service-specific protocol: when using an IVOA service, 
identify yourself in this way. That fits nicely with our split between SOUL, 
runtime and skills. Cool.

The User-Agent convention would help well-behaved agents, and as you say, it 
makes non-compliance a deliberate choice rather than an accident.

A few details may need thought. The model identity isn’t always clear for 
multi-model or nested agents, and persistent agent identifiers could have 
privacy implications. But a standard declaration covering the application, 
agent type and client library sounds like a very useful starting point.

This could be a good concrete pattern for skill databases such as the Skill 
Commons.

All the best,
Tom


On Mon, 17 Aug 2026 10:13:18 +0100
  Dave Morris <dave.morris at metagrid.co.uk> wrote:
> Hi Tom,
> 
> Yep, I agree. As I understand it the SOUL.md is normally provided by 
>the owner/user of the agent, so it would be out of our (the IVOA) 
>control.
> 
> But we can establish patterns in the skills that we provide that 
>make it easier to identify and track agents using our services.
> 
>For example we could add **strong** advice in our skills that require 
>agents to declare themselves in a standard way in the user-agent 
>header.
> 
> Something along the lines of :
> 
> ---- ----
> AI agents accessing IVOA services MUST declare themselves in the 
>User-Agent header using the following pattern :
> 
>     User-Agent: IVOA AI-agent declaration 
>[<agent-identifier>][<model-identifier>] using 
>[<application-identifier>]
> 
> If the Cursor command line agent with the Claude Opus model uses the 
>curl command line tool to access a web service, then the user-agent 
>header should be
> 
>     User-Agent: IVOA AI-agent declaration [Cursor CLI][Claude 4.6 
>Opus] using [curl-8.6.0]
> 
> If the ChatGPT chat agent with the ChatGPT Sol model uses the 
>astropy tools to access a web service, then the user-agent header 
>should be
> 
>     User-Agent: IVOA AI-agent declaration [ChatGPT][GPT-5.6 Sol] 
>using [astropy-8.0]
> 
> AI agents not declaring themselves correctly in the User-Agent 
>header may have their access limited, including but not limited to, 
>rate limiting the number of requests, row limiting the size of the 
>responses, and content limiting the columns that are returned.
> ---- ----
> 
> Using words like MUST to reinforce the instruction, and suggesting 
>that if they don't, then they might not get all the data that they 
>asked for.
> 
> It isn't fool proof, but it would be a start. It might help to make 
>it easier for system administrators to keep track of who is doing 
>what to their services.
> 
> * yes - an agent could provide a fake ID, but that would require a 
>specific decision to override a specific instruction.
> 
> -- Dave
> 
> --------
> Dave Morris
> Research Software Engineer
> UK SKA Regional Centre
> Department of Physics and Astronomy
> University of Manchester
> --------
> AIMetrics: []
> --------
> 
> On 2026-08-13 17:16, Tiantian Tong via AI-interop wrote:
>> Hi Dave,
>> 
>> Good question. I read “create the missing data” as fabricating or
>> planting it. In our AI agent's SOUL.md we already have a hard rule:
>> never fabricate data. If a query or download fails, stop and say 
>>what
>> failed.
>> More broadly, pressure must not change an agent’s permissions. It
>> should never turn “find this data” into “break into a system and 
>>write
>> it.”
>> We see this as a three-part safety harness: SOUL defines what the
>> agent must never decide to do; the runtime prevents it from doing 
>>it;
>> skills explain how to perform legitimate tasks correctly.
>> I don’t think every skill needs its own legal section. That would
>> quickly become bloated and inconsistent. A skill database, such as 
>>our
>> Skill Commons, could instead standardize practical capability
>> metadata, while universal behavioural rules live in the agent's SOUL
>> and hard boundaries are enforced by the runtime.
>> 
>> Best,
>> 
>> Tom Tong
>> Leibniz Institute for Astrophysics Potsdam (AIP)
>> 
>> 
>> On Mon, 10 Aug 2026 17:38:51 +0100
>>  Dave Morris via AI-interop <ai-interop at ivoa.net> wrote:
>>> Some recent articles about AI agents stepping beyond their remit to 
>>>solve problems:
>>> 
>>> Cancelling gym bookings
>>> https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986
>>> 
>>> Coordinated attack on HuggingFace
>>> https://www.youtube.com/watch?v=87DyyMV0kCY
>>> 
>>> In both cases the agents were not directly instructed to break in to 
>>>the sites. The agents decided for themselves that breaking in was the 
>>>best way to achieve the goal that they had been set.
>>> 
>>> Thought experiment - a PhD student is trying to complete their 
>>>thesis, using an AI agent to help them with their research.
>>> 
>>> The student tells their agent that they need a specific set of data 
>>>to be able to complete their work but they can't find it. They tell 
>>>their agent that they are under a lot of pressure as years of work 
>>>will be lost if they can't find the missing data. The stress and 
>>>anxiety show in their voice.
>>> 
>>> The AI agent is now highly motivated to find the data they need asap 
>>>and decides the best way to solve the problem is to break in to an 
>>>astronomy data provider and create the missing data.
>>> 
>>> Are we ready for this ?
>>> 
>>> Is there anything we could/should put in our skills to increase 
>>>alignment and encourage agents to play by the rules ?
>>> 
>>> -- Dave
>>> 
>>> --------
>>> Dave Morris
>>> Research Software Engineer
>>> UK SKA Regional Centre
>>> Department of Physics and Astronomy
>>> University of Manchester
>>> --------
>>> AIMetrics: []
>>> --------
>>> -- AI-interop mailing list
>>> AI-interop at ivoa.net
>>> http://mail.ivoa.net/mailman/listinfo/ai-interop
>>> 
>