Small World: Every Agent Lives in Its Own Projection

AFS is our filesystem abstraction for agents: databases, APIs, local files, tools, and memory all become paths an agent can mount, read, and write. Inside it lives a design principle that keeps growing on us. We call it Small World. In one sentence: every agent, every application, every process sees not the global world, but a small world projected specifically for it. Anything outside that world isn't "access denied". It simply doesn't exist.

A traditional permission model answers with Permission Denied: I know there's something there, but you can't see it. Small World answers with Not Found: the thing you're asking about is not in your world.

The gap between those two answers is bigger than it looks. The first one means the agent knows there's something behind the wall. It can enumerate, reason about it, look for a way around. The second means the thing it's looking for isn't part of its world at all. Crossing the boundary isn't blocked; asking only ever returns Not Found, and even the fact that there's something behind a wall never reaches it. This post covers where the idea comes from, why it's more than a security mechanism, and how to try it yourself.

The real world never had a god view

Your doctor knows your medical history. Your bank knows your balance. The tax office knows your income. Your friends know where you went last weekend. No single person, no single institution sees the whole truth about you. Everyone sees only the small world centered on themselves, and the world runs fine. It has run this way for thousands of years.

Computer systems picked up the opposite habit: root, admin, super user. There's always some role that sees everything. Carry that habit into the agent era and it breaks, because agents don't come in ones and twos. They come in hundreds, and every one of them can be hijacked, injected, or socially engineered. Leaving every agent a path to god mode means leaving attackers hundreds of doors.

So Small World takes a position: decentralization is not just about data having no center. The way reality gets observed has no center either. Every observer, whether it's a person, an agent, an app, or a process, lives inside its own projection. That's not a restriction. That's how the world already works.

From "everything is a file" to "everything is a projection"

The idea didn't come out of thin air. Unix gave us a great abstraction in the 1970s: everything is a file. In the early nineties, Plan 9 at Bell Labs went further: the file-system namespace is not system-wide; each process can own its own. The same path, /dev/mouse, points to a different mouse stream for programs in different windows. A program doesn't know where the real hardware is, and doesn't know other windows exist. From inside, its namespace is the entire world.

AFS owes a lot to both systems, and Small World's technical ancestry traces straight back to Plan 9's per-process namespaces. But we're not recreating Plan 9; we're generalizing it. From processes to any observer: agents, applications, blocklets (the application units on our platform), workflows, people. From file resources to data, capabilities, tools, memory, identity. AFS itself walked this same line: first everything is a path, so databases, APIs, and local files can all be found through one path scheme; then Small World takes the next step, everything is a projection, and even "what you can see" is itself decided by a projection.

The word projection is chosen deliberately. A projection is not a copy and holds no data. It is the way one dataset appears to one observer. Take a customer record: CRM sees a relationship, finance sees receivables, support sees a ticket history. There is one reality. There can be unlimited projections of it.

One reality; each observer gets a projection, not a separate copy of the universe.

I started out treating it as a security feature

Honestly, the first draft of this post didn't look like this. Before writing it, I jotted down a rough description in an issue, and it was all about isolation: blocklets can't see each other, permissions can't leak, nothing can spill over. All true, and all framed as defense.

Then I handed that draft to an AI to keep the conversation going, and it pushed back: your draft is all isolation, but what we'd talked out before goes one layer further. Isolation is the consequence, not the essence. The essence is how reality gets observed: AFS describes reality; Small World describes the reality each observer sees.

It was right. That's also how our writing usually works: the judgment is mine, but sometimes the AI corrects me with things I said earlier 🤣.

Once that clicked, other pieces moved into place. To an observer, a projection is not "a trimmed-down global filesystem". It is the whole of reality; what AFS hands an agent is that agent's entire universe. Security stops being the purpose and becomes a property the design happens to have.

It's not theory. It runs in code

This April, while building multi-agent collaboration (the kind where a parent agent hands work to a group of sub-agents), we hit a concrete problem: the paths a sub-agent received wouldn't resolve in its own environment. The fix wasn't a special case. We wrote one of Small World's properties into the implementation: small worlds are recursive. Project a parent agent's small world one more time, and you get the child's small world. To the child, the parent's world is "global", except the child doesn't even know the parent exists, let alone reach the actual global view.

Small worlds are recursive: the child never sees the true global view.

Blocklets work the same way. Two blocklets running for the same user, on the same machine, in the same runtime: one sees its own /data, the other sees its own /data. Some underlying data may be shared, but each lives entirely in its own world. This is not a sandbox in the "fence it off" sense. Each blocklet's world was projected separately from the start.

The mechanism itself is small. A projection is a handful of tiny operators composed together: filter drops paths from view, rewrite reshapes them, restrict tightens read/write access, and compose chains them. The composition is declared, not scattered through the code as special cases. All of it ships in @aigne/afs, with tests.

If you want to try it

You can reproduce the difference from the opening with the packages published on npm. Install two of them:

npm install @aigne/afs@2.0.0-beta.15 @aigne/afs-json@1.1.0

Set up a "reality" containing both mail and notes, then project a read-only world for the mail agent that contains only /mail:

import { compose, filter, restrict } from "@aigne/afs";
import { AFSJSON } from "@aigne/afs-json";

// The underlying reality: one dataset, both mail and notes inside
const reality = new AFSJSON({ jsonPath: "./reality.json" });

// The mail agent's small world: /mail only, and read-only
const world = compose(
  filter({ allow: ["/mail", "/mail/**"] }),
  restrict({ mode: "readonly" }),
)(reality);

await world.list("/");                  // only /mail; /notes doesn't exist
await world.read("/mail/inbox.md");     // reads fine
await world.read("/notes/todo.md");     // throws
await world.write("/mail/inbox.md", { content: "x" });  // throws

The two errors it actually throws are worth a look:

read /notes/todo.md  →  Path not found: /notes/todo.md
write /mail/inbox.md →  Operation "write" denied — mount access mode is "readonly"

Look at the first one. It's not Permission Denied. It's Path not found. For this agent, /notes was never part of its world. That's the difference between Small World and an ACL, compressed into one error line. The second error tells the other half of the story: inside the world, read and write permissions still exist, and that's the only place denied shows up. Outside the world it's about existence; inside the world it's about permission.

Boundaries: what this design gives up

Small World is not free. A few things are worth laying out before you adopt it.

First, there is no free global view. Once you give up the god view, auditing, debugging, and operations, things that used to come along for free, all have to be built deliberately. AFS's answer is a reflection interface on every projection: a world can query how it was projected, meaning its own projection chain and the policy currently in effect. An administrator's view for auditing how projections relate to each other is drawn up in the design but not wired in yet. One thing we can already be precise about, though: the administrator is also just an observer holding a wider projection. The accurate statement is that a global view may exist as an implementation detail, but it is not the default world of any observer.

Second, troubleshooting changes shape. When the error says Not Found instead of Permission Denied, "why can't I see this path" is no longer answered by reading a permission table. You have to ask how your world was projected in the first place. If you're used to ACLs, the first encounter feels roundabout.

Third, it shrinks the blast radius; it doesn't prevent deception. Inside its own world, an agent can still be tricked by prompt injection into doing the wrong thing. What Small World guarantees is that a deceived agent still cannot reach anything outside its world; the damage stays inside that boundary. And where that boundary sits is whatever was declared when the world was projected. A sub-agent's world, for example, defaults to a read-only projection of its parent's; paths the parent shares are visible to it by default, and giving it a smaller world means declaring a narrower projection. Expecting it to stop every attack is expecting the wrong thing from it.

And to be candid, some engineering details are still open: projection caching strategy, cross-system federation. Operator composition is also not commutative. Filter-then-rewrite and rewrite-then-filter can produce completely different worlds, so declarations need thought.

Which brings us back to the opening, said another way. The traditional model asks "do you have permission to see this". Small World asks "does this exist in your world". One keeps checking credentials at the door. The other decides what's behind the door in the first place. We think the second is the right default for the agent era, not because it's more secure (although it is), but because it's closer to how the world already works.

Nobody lives in a god view. No agent has to either.

References