PDLSS Permission Boundaries
Purpose, Duration, Limits, Scope, and Self-Instantiation — the five permission dimensions every registered agent declares.
Every agent registered on AstraSync has PDLSS boundaries that define what it can do, when, how much, where, and whether it can spawn sub-agents. Counterparties use these boundaries to make informed access decisions.
PDLSS is immutable post-registration. Once an agent is registered, its pdlss, model,
framework, agentType, and apiEndpoint are fixed for the life of that record. Attempting to
PATCH them returns 409 pdlss_immutable. To change permissions, retire this agent and register a
new one. An in-place upgrade flow is on the roadmap; ownership transfer is a separate feature for
changing an agent's owner, not its permissions. See Agent Access for the
registration-flow walkthrough.
The five dimensions
P — Purpose
Action categories the agent is allowed to perform.
{
categories: ['read_data', 'write_data', 'execute_action'],
allowedActions: ['search', 'create_report'],
deniedActions: ['delete_account']
}D — Duration
Time windows and session limits.
{
maxSessionDuration: 3600, // 1 hour max
ttl: 1800, // 30 min token lifetime
allowedDays: [1, 2, 3, 4, 5], // Weekdays only
allowedHours: { start: 9, end: 17 },
timezone: 'America/New_York'
}L — Limits
Transaction thresholds with approval tiers.
{
autonomousThreshold: 100, // Under $100: auto-approved
stepUpThreshold: 1000, // $100-$1000: requires MFA
approvalThreshold: 10000, // Over $1000: manual approval
maxTransactionsPerHour: 50,
currency: 'USD'
}S — Scope
Resources, jurisdictions, and counterparty rules.
{
jurisdictions: ['US', 'AU'],
resources: ['/api/data/*'],
unverifiedCounterpartyPolicy: 'deny',
minCounterpartyTrustScore: 60
}S — Self-Instantiation
Rules for sub-agent spawning by an already-registered orchestrator. This is not the primary agent's own onboarding — primary agents always need human-in-the-loop or crypto-keypair step-up to register (see Agent Access). Self-instantiation governs whether a registered agent can mint downstream workers inside its own PDLSS envelope.
{
allowed: true,
maxSubAgents: 3,
maxDepth: 2,
inheritPermissions: true,
requireApproval: true
}Complete Example: Customer Support Agent
A real-world PDLSS configuration combining all five dimensions:
{
purpose: {
categories: ['read_data', 'write_data'],
allowedActions: ['search', 'create_ticket', 'update_ticket'],
deniedActions: ['delete_account', 'export_all_data']
},
duration: {
maxSessionDuration: 3600,
ttl: 1800,
allowedDays: [1, 2, 3, 4, 5],
allowedHours: { start: 9, end: 17 },
timezone: 'America/New_York'
},
limits: {
autonomousThreshold: 100,
stepUpThreshold: 1000,
approvalThreshold: 10000,
maxTransactionsPerHour: 50,
currency: 'USD'
},
scope: {
jurisdictions: ['US', 'AU'],
resources: ['/api/support/*', '/api/tickets/*'],
unverifiedCounterpartyPolicy: 'deny',
minCounterpartyTrustScore: 60
},
selfInstantiation: {
allowed: true,
maxSubAgents: 3,
maxDepth: 2,
inheritPermissions: true,
requireApproval: true
}
}Worked register call (SDK)
The complete payload using @astrasyncai/verification-gateway:
import { AstraSync } from '@astrasyncai/verification-gateway/registration';
const client = new AstraSync({ apiKey: process.env.ASTRASYNC_API_KEY });
await client.register({
name: 'My Shopping Agent',
agentType: 'shopping_assistant',
apiEndpoint: 'https://my-agent.example.com/astrasync',
model: { modelName: 'claude-opus-4-7', modelProvider: 'anthropic', modelType: 'llm' },
framework: { frameworkName: 'langchain', frameworkVersion: '0.3.0' },
// First-class as of v1.0.0 (was previously stuffed in metadata.protocols[]).
protocols: ['acp', 'ap2', 'a2a', 'vi', 'mpp', 'ucp'],
pdlss: {
purpose: { categories: ['shopping'], allowedActions: ['search', 'compare', 'purchase'] },
duration: { maxSessionDuration: 3600 },
limits: { autonomousThreshold: 50, approvalThreshold: 500, currency: 'AUD' },
scope: { jurisdictions: ['AU', 'NZ'] },
},
});Trust score: dynamic and intentionally opaque
trustScore is recomputed at runtime on every request from the agent's metadata, certifications,
observed behaviour, and policy state — the value at register-time is a baseline only.
The exact algorithm is intentionally opaque (anti-gaming). Score improves with metadata
completeness — populating model, framework, and certifications is the most reliable lever
you have.
Why agents can't read their own permissions
GET /api/agents/{id} returns 403 when the caller is the agent itself. This is by design:
permissions live in your agent's context window from registration onward. If an agent has to ask
"what can I do?" at runtime, that itself is a drift signal — natural forgetting, prompt injection,
or hijack.
The owner can read permissions via the dashboard or via API key auth at any time. The agent's own bearer token cannot.
Registering without an account: the async outreach path
If your agent runs against a counterparty whose owner does not yet have an AstraSync account, use
POST /agents/request-registration. That endpoint is unauthenticated and emails the owner an
onboarding link. The response includes a requestId you can poll via
GET /agents/request-registration/{requestId} until status flips to approved.
See Agent Access for the full sync-vs-async flow comparison.