Agent Posture Chain

Set-based compliance posture propagated across every agent boundary (sub-agent delegation, queue envelopes, event-bus payloads, saga steps). The hard rule: **target's posture set MUST be a SUPERSET of source's posture set.** A "downgrade" (target missing a regime the source requires) is refused at the boundary.

Compliance regimes (HIPAA / PCI-DSS / GDPR / SOC2) protect DIFFERENT regulated-data classes — they're orthogonal, not a linear lattice. A clinic that processes payment cards operates under BOTH HIPAA + PCI; an EU clinic adds GDPR; an aggregator may add SOC2. Set semantics match how real-world regulations actually overlap.

var chain = b.agent.postureChain.create({});

var sourceSet = ["hipaa", "pci-dss"];
var targetSet = ["pci-dss"];           // missing hipaa

chain.isSubset(targetSet, sourceSet);  // false — target lacks hipaa
chain.canDelegate(sourceSet, targetSet, "mail.fetch");
// → false; agent.posture-chain.canDelegate-denied audit emit

## Per-module declaration

Each module declares its applicable regimes via a static POSTURES export OR an @compliance JSDoc tag. The agent primitive's posture SET = union of all composed modules' declared regimes (operator can narrow at composition time).

## Hop trail

Every cross-boundary envelope carries { postureSet, chainTrail, enteredAt, hopCount }. Hop count caps at default 16 — defends infinite recursion across agent delegation. appendHop extends the trail when an envelope crosses a new boundary.

b.agent.postureChain.create(opts) #

{
  audit:  b.audit namespace,   // optional
}

Create the posture-chain facade. Returns an instance with isSubset / union / canDelegate / declareRegime / validate / appendHop.

var chain = b.agent.postureChain.create({});
chain.isSubset(["pci-dss"], ["hipaa", "pci-dss"]); // → false

Last updated 2026-08-08T16:39:49.652Z by seeder.