The new workload · agent fleets

Git assumes the committer can be fired.

Every control Git inherits — a signing key, an SSH credential, a branch protection rule, a CODEOWNERS file — assumes one accountable human behind one identity. Point a fleet of agents at that model and you are handing each of them a person's full reach, then reconstructing what happened from commit messages.

Agent documentation →Capability tokens

Today

One credential, unlimited reach

The agent authenticates as a person, so its authority is that person's authority.
Scope is whatever the runner happens not to attempt.
Parallel agents contend for one index and one working tree.
Attribution is a string in a commit trailer, written by the thing being attributed.
Revocation means rotating a human's key.

With TOVIO

Many tokens, each with an edge

The agent holds its own capability token, bounded before it is issued.
Scope is enforced by the system, and checked before a seal rather than after.
Each agent works its own lane under agent/<name>/**, in parallel.
Provenance is recorded on the work and travels with the stable change ID.
Expiry is a field on the token. Revocation does not touch a human key.

Anatomy of a capability token

Authority you can read off the object.

A capability token is not a role name that something resolves later. Every dimension of what the holder may do is a field, and the field has an edge.

tok_9f3ac1SIMULATED EXAMPLE · illustrative field values

agentrefactor-botThe identity every operation under this token acts as. Not a person's.

path_scopesrc/**, tests/**Path-scoped. Everything outside the glob is out of scope.

branch_scopeagent/refactor-bot/**Agents write in their own namespace, not on your lanes.

allowed_opsread, write, commitA closed enumeration. Modifying policy and obliterating objects are not among them.

secret_clearancefalseChecked at seal and before a protected read — not after.

can_issue_sub_tokensfalseOff here; where it is on, a sub-agent can be handed strictly less, never more.

expires_at1787508000Unix seconds (2026-08-23T18:00Z). Required on every token, not a policy someone remembers.

Parallelism

A fleet on one repository, without a queue.

There is no single staging area to contend for. The working copy auto-snapshots into a change, so agents accumulate work on their own lanes and land through the same review and policy gates a person does.

main

agent/claude/**

agent/review-bot/**

agent/refactor-bot/**

Illustrative diagram. Lane names follow the reserved agent namespace; landing still passes authorization, protected-lane, review, and integrity checks.

Provenance

Ask what an agent did, and get an answer that is not a commit message.

Provenance attaches to the change, and change IDs survive amend, rebase, and cherry-pick — so the record does not evaporate when the history is tidied before review.

Change	Entity	Task	Scope	Result
`chg:4e1a08`	claude	`task-2291`	`src/parser/**`	landed
`chg:9b30f2`	claude	`task-2291`	`src/parser/**`	proposed
`chg:c71d55`	review-bot	`task-2294`	`tests/**`	proposed
`—`	refactor-bot	`task-2301`	`deploy/**`	refused

Illustrative rows, not captured output. tovio log --entity and --task-id are the real query surface; the last row is what an out-of-scope write looks like — refused, with nothing sealed.

The honest boundary

TOVIO authorizes what an agent does through TOVIO. Sandboxing the runner, the shell it can spawn, and the network it can reach are separate operator responsibilities, and a capability token does not substitute for them.
Scoped means scoped, not supervised. A token bounds reach; it does not make the agent's judgement good. Review gates still exist for a reason.
The SDK and MCP edge are functional, not yet published. The Node SDK and MCP server are built and exercised, and package publication sits in the open Phase 5 work tracked on the roadmap.

Give an agent exactly the authority it needs.

Tutorial: agent access →MCP server The machine contract What is still open

For the agents themselves: this site serves llms.txtand the full operating corpus at llms-full.txt — the command surface, the --json error contract, and the recovery index for each catalogued error code, generated from the specification.