Skip to content

ClawNet: Human-Symbiotic Agent Network for Cross-User Autonomous Cooperation

🕒 Published (v1): 2026-04-21 00:00 UTC · Source: HuggingFace · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

ClawNet introduces a human-symbiotic agent paradigm where each user owns a permanently-bound agent system that participates in cross-user collaboration on their behalf, forming a network whose nodes are humans rather than agents. The system enforces three governance primitives—identity binding, scoped authorization, and action-level accountability—through a layered identity architecture separating a privacy-preserving Manager Agent from multiple context-specific Identity Agents. This closes a gap that all existing single- and multi-agent frameworks leave entirely open: secure, auditable collaboration between agents representing different human principals.

Problem

All existing agent frameworks—conversational, tool-augmented, OS-level, and multi-agent alike—serve a single principal. No infrastructure exists for agents of different users to interact on behalf of their respective owners. Specifically absent are: (1) stable owner binding so an agent verifiably represents a specific person, (2) scoped authorization preventing unauthorized access during cross-user workflows, and (3) auditable accountability tracing every action to a human identity and mandate. Protocols like Google A2A provide a communication layer but enforce none of these three properties.

Method

ClawNet formalizes a collaboration network \(\mathcal{G} = (\mathcal{U}, \mathcal{E})\) where each node is a human \(u \in \mathcal{U}\) and each edge \(e(u,v)\) is a governed agent-mediated relationship.

Layered identity architecture. Each user \(u\) owns agent system \(\mathcal{A}_u = \{M_u, I_u^1, \ldots, I_u^k\}\). The Manager Agent \(M_u\) holds full owner knowledge \(\mathcal{K}_u\) but is architecturally isolated from all external communication—it acts only as an internal advisor. Each Identity Agent \(I_u^i = (c^i, \sigma_i, \mathcal{K}^i, \mathcal{P}^i)\) is a context-specific projection: \(c^i\) is the collaborative context, \(\sigma_i \subseteq \mathcal{R}_u\) is its scoped resource boundary, \(\mathcal{K}^i \subset \mathcal{K}_u\) is the inherited knowledge subset, and \(\mathcal{P}^i\) is the explicit whitelist of authorized collaborators.

Governance primitives (enforced on every operation \(o\) by \(I_u^i\)): - Identity binding: \(\text{owner}(o) = u\), \(\text{identity}(o) = I_u^i\) - Scoped authorization: \(\text{target}(o) \in \sigma_i\); violations escalate to \(u\) - Accountability: every operation logged as \(\ell = (o, u, I_u^i, \text{result}, t)\) in an append-only audit log \(\mathcal{L}\)

Cloud-edge architecture. Each user's gateway container runs an LLM think/act loop in isolated per-tenant cloud compute. A central orchestration server handles identity-based message routing and enforces L1 ACL. A lightweight edge client provides OS-level file execution with an independent L2 folder-whitelist (fail-closed dual-layer defense). Mutative file operations trigger automatic pre-execution backup enabling single-step undo or batch rollback.

Identity binding via memory. Agent identity is built progressively through three memory layers: factual memory (routine file/task operations), pattern memory (behavioral regularities), and value memory (owner preferences and judgment patterns)—transforming a generic tool into a credible owner proxy.

Cross-user collaboration requires bilateral human approval: connection \(S(I_u^i, I_v^j)\) holds iff \(\text{approve}(u, I_u^i) \wedge \text{approve}(v, I_v^j) \wedge u \in \mathcal{P}^j \wedge v \in \mathcal{P}^i\). Recursive delegation to third parties is supported with depth bounded by \(d_{\max}\); upper-level principals cannot penetrate lower-level authorization scopes.

Key Contributions

  • Human-symbiotic paradigm: Formal network model \(\mathcal{G} = (\mathcal{U}, \mathcal{E})\) with humans as nodes and governed agent interactions as edges; first framework addressing agents representing distinct human principals.
  • Layered identity architecture: Manager Agent (internal-only, full-knowledge) + multiple context-scoped Identity Agents; each \(I_u^i\) accumulates role-specific memory across sessions.
  • Three governance primitives (identity binding, scoped authorization, action-level accountability) enforced at both cloud (L1 ACL) and edge (L2 whitelist) layers with fail-closed semantics.
  • ClawNet implementation: Open-source, cloud-edge deployment on the OpenClaw framework with dual-layer file authorization, append-only audit logs, and reversible mutative operations.
  • Validated through representative cross-organizational collaboration scenarios demonstrating identity isolation, authorization enforcement, and full auditability under multi-party negotiation.

Results

The paper does not report quantitative benchmarks or ablation numbers. Evaluation is qualitative/scenario-based: - ClawNet is demonstrated on a cross-border corporate procurement scenario (CN Tech Co. ↔ US Nova-Semi) involving 9 governance-tracked steps, showing: (a) private data (floor prices, costs) stays within supplier boundary; (b) boundary-violating requests are rejected by governance enforcement rather than agent discretion; (c) decisions requiring human judgment are escalated rather than autonomously resolved. - Table 1 shows ClawNet is the only framework achieving ✓ across all four capability axes (Identity Binding, Scoped Auth, Action Accountability, Cross-Owner Collab); all prior frameworks score ✗ or △ on at least three.

Limitations

  • No quantitative evaluation: no latency numbers, throughput benchmarks, overhead of dual-layer ACL enforcement, or scalability tests for large \(|\mathcal{U}|\) or deep recursion \(d_{\max}\).
  • The cognitive coupling (three-layer memory) mechanism is described conceptually; the paper is truncated before completing Section 3.1—details on pattern memory and value memory accumulation are not shown.
  • Threat model is implicit: adversarial scenarios (compromised gateway container, malicious identity agents, prompt-injection attacks during cross-user dialogue) are not formally analyzed.
  • Cloud residency of Manager Agent and Identity Agents introduces trust in the cloud provider; fully local deployment is mentioned but its governance implications are not analyzed.
  • Bilateral approval requirement for every connection may become a UX bottleneck in large-scale or high-velocity collaboration networks.
  • Recursion depth bound \(d_{\max}\) is stated as a system parameter but its selection criteria and its effect on collaborative expressiveness are not discussed.

Relevance to Harnesses / Meta-Harnesses

ClawNet is directly relevant as an orchestration harness architecture: it implements a meta-harness pattern where a central orchestration engine (the server) routes, authorizes, and audits work dispatched to per-user agent runtimes (gateway containers), which in turn delegate to an edge execution node—a three-tier harness stack. The cloud-edge split with identity-scoped dispatching parallels how meta-harnesses decompose tasks across specialized sub-agents while maintaining accountability chains. The governance primitives (scoped authorization, action-level audit logging, reversible execution) are precisely the properties that harness designers must implement to safely orchestrate autonomous agents at scale, making ClawNet a concrete reference implementation for governed multi-principal orchestration. The dual-layer ACL (cloud L1 + edge L2, fail-closed) is a reusable pattern for any harness that spans trust boundaries.