Small World: Every Agent Lives in Its Own Projection

Technology Deep Dive

Security comes from shaping existence, not only denying actions

Small World’s consequential move is to remove out-of-scope resources from an agent’s namespace instead of merely blocking them. The contrast between [Path not found: /notes/todo.md] and [Operation "write" denied] separates two controls: projection decides what can be discovered, while permissions govern actions inside what remains. This reduces the information available for enumeration and reasoning, so an injected agent cannot search for a resource that its world never exposes.

Composition turns isolation into an architecture

The design scales because projection is declared through filter, rewrite, restrict, and compose rather than scattered checks. Its key scaling property is that [small worlds are recursive]: a child receives another projection of the parent’s already bounded world. That makes isolation compositional across agents and blocklets; the same underlying data can support different visible paths without copying the data or granting a shared global namespace. The consequence is that multi-agent delegation can inherit a narrow boundary by construction rather than asking every child to enforce the parent’s full policy.

Stronger boundaries create explicit operational debt

The model does not eliminate security work; it relocates it. Prompt injection can still manipulate an agent inside its world, and the blast radius is only as small as the declared projection. Operations also lose an automatic god view: the article says an administrator view is [not wired in yet], while debugging must reconstruct why a path was projected away. Composition itself is order-sensitive because [Filter-then-rewrite and rewrite-then-filter can produce completely different worlds]. The design is therefore strongest when projection definitions, reflection, and wider audit views are treated as first-class infrastructure rather than assumed side effects.