Agency Engineering and the O3 Framework

This is the graduation day and the more researchy day. So I'm glad to kick things off by talking about some of my favorite research topics and, update demos. I guess you'll see a bit of philosophy and then a whole bunch of demos, throughout. I'm also presenting on behalf of Shin in absentia. He regretfully couldn't make it, and, this keynote talk is largely me trying to synthesize, you know, my understanding of, a philosophy that he developed, or we brainstormed a bunch on, agency engineering and what it means. So, you know, you'll hear my version of it.

So I'm kind of fascinated with just the word agent and agency because it has two meanings, and they're almost the opposite meaning, if you think about it. So usually encounter agency in terms of agents where an agent acts on behalf of a principal. So if you're not the principal, then you're the agent, and you're a tool of the principal. The principal has intents, and you're just carrying out actions on behalf of the principal. That's sort of like a low agency thing. There's also agent, which is just something that acts upon its environment. You may notice that the Wi-Fi password for the school is high agency. And, you know, broadly, agency engineering is any sort of intentional effort or technology used to stimulate agency or create more action, more intentions expressed.

I think you can just do things as a kind of trendy, you know, form of, wordsmith agency engineering.

This talk is then also going to be about, guerrilla delegation and this, topic we've coined called OAuth 3. That is like a design space for kind of edgy applications. One of the ways in which you lose your agency or see your agency and suppressed is by having your attention basically hijacked by powerful platforms, information feeds, algorithmic feeds like YouTube Shorts, which I watch a shit ton of, and, Twitter. This is basically where the platforms collect all of your data as much as they can. They learn everything about you that they possibly can, and they use this to model you to make decisions about what to show on their platform, not for your best interests or to help you express yourself and get what you want out of life, but to keep you a captive, passive, advertising, clicking, e-commerce, paying, tool for them.

And something that's interesting is also then they really don't make it easy for you to get access to yours or work together with other of your friends to understand your information diet, what you're subject to. Actually, the, feeds themselves, are not available by any of the delegation systems that they offer. So most people know that platforms have OAuth. OAuth is a way that you can have applications that, adapt or make use of, the platforms. Like, you can have Twitter apps, you can have YouTube apps. But actually, they have the information diet itself, like your For You page, your algorithmic feed, off-limits. Like, they're not available as endpoints that you can access by OAuth. And so what I'm showing here are actually a couple of apps.

These are one-shot versions of apps that we used to spend a lot of effort making. Shin put these two initially together called Timeline Peek and Feedling. And these are basically shareable versions of your algorithmic Twitter feed and of your YouTube Shorts feed. And again, this is sort of miraculous because you're not supposed to be able to do this. There's no official way of doing delegation that lets you share your For You page on either of these platforms, and yet I'm able to demo that we're doing it here. So what's going on behind the scenes is a technology we call OAuth 3. If you search for OAuth 3 on the internet, you just find a page that says, "OAuth 3 does not exist."

That makes it a sort of safe space for, subliminal work. It's like an anti-memetic space because there's already an official-looking page that says it doesn't exist, so we can't get in trouble for it because it doesn't exist. And what actually this is doing is that it is a browser extension that you run on your laptop that copies the cookies from any of the pages that you click on to make them available in OAuth 3 for delegation of this kind. And it teleports them into another instance of a browser that is running safely on a dstack TEE in a secure cloud somewhere, running the OAuth 3 open source code, so you can see everything exactly that it does.

It makes audit logs. You basically get to issue fine-grained scopes that show how to use this browser where the browser is fully logged into these platform websites. And so now you can bring your own policy or, you know, download open source plugins or run your own whatever you to do delegation scopes, including these ones like your For You page, whether the platforms want you to be able to or not. So that's how this mechanism works and why it uses TEEs to be a secure thing to do. This is a very edgy thing to do regarding, like, the, you know, the, policies of these. It's basically your own browser that you get to control. It just happens to be, running remotely, and that's only justified because it's in the secure TEE and running the open source code.

So I gave you these examples of being able to share your For You page. What this has to do with agency engineering is a couple of things, but it's like being able to, first of all, be informed better about what algorithmic feed consists of and be able to see where your algorithmic feed matches up with your friends, just for example. This is kind of an interesting design space, so just one other example. This is, a partially delegatable shopping cart app. So this is an app where you share your Amazon shopping cart using OAuth 3, and what you do is allow your friends to be able to substitute some of the items in your carts. Like, if you have a friend that is better at shopping at certain things that you do, or you have a friend that is really into organic foods and you want to allow them to swap out any non-organic foods in your shopping cart for the organic version that they choose, you basically give them a scope to basically swap items out of your shopping cart.

It's as though they're following you around shopping and just, like, removing things out of your cart. So this is, like, no sane kind of delegation that Amazon officially supports, but no one can stop you from doing this. And the ability to get more interaction out of your friends and peers is, the provocative, you know, increases your agency certainly within your own group in a way that, you know, platform stores generally prefer to be like hub and spoke, interact with just you as one consumer at a time. Like, no one wants to interact with you as, like, a, I was gonna say a cartel, but what's the other word that I'm thinking of? A union, right?

Like, so this basically allows any group of people to turn into a union. That's a form of agency engineering for sure. Some other applications that are fun. I'm really proud to say that we got this, paper called Login With Everything based on OAuth 3 into the SIGBOVIK conference. Just ignore The Brainrot Box in the corner. I make it larger if I feel like I'm losing control of the presentation. So SIGBOVIK is a peer-reviewed but satire, computer science conference. I'm really proud to have landed something in there. We got an award for being the possibly practical version. So in the joke conference, we're possibly practical. Anyway, you can use this to log in with all sorts of interesting things that you wouldn't think of as credentials but, you know, can be used that way.

I'll just quickly mention one example of an earlier application that Xinyuan put together, before this particular form of OAuth 3, but it's Deal With the Devil. It basically turns Twitter delegation into a commitment device that you can use with your friends. So the premise is that you would post on Twitter a commitment that you want to pledge yourself to follow. So this says, "I'm not going to tweet, anything that's bearish about cryptocurrencies." And you delegate your account as a form of collateral because if you violate your, commitment, then you get punished by having an AI agent called Satan roast you from your own account. So this is someone who did tweet about something that was bearish, and then he got, quote tweeted from his own account.

You know, it looks like it's from his own account, but this is the agent tweeting on behalf of him, and then it also changed his profile photo to a sloth. Being able to make commitments by, you know, daring yourself to do something and having your friends help with that is also a form of agency engineering. Okay, so the last technical thing that I'll say that's pretty cool about this, I explained this as a technology that's based on using, browsers as a way of, carrying out these, delegation scopes. The browser is kind of a heavyweight way of doing this, but this is the most generally applicable. On the other hand, what you really want to be able to have is, like, a reverse engineered or an unofficial API that's cheaper than actually running the whole browser.

So what we've just prototyped and have seen this working a little bit, but it's not super reliable, but it's in this category of, automatic improvement loops, is that if you run, you know, some random new long-tail website that no one's seen before, you can obviously control the browser with visual model and mouse click actions issued through the X11 container. And after you've done that a few times, the OAuth 3 instance records the trajectories, like the debug traces of the JavaScript, the requests before and after, and the responses, and then it sends some DeepSeq agents to go and see if they can work out what is the API code that would run that automatically. If this is successful, then basically after you've done a few requests, you no longer have to run the expensive heavyweight browser.

You're just able to run the reified unofficial API. So this is an improvement loop exhibited there, and I think a lot of what we've been learning to do throughout this program is how to establish healthy, improvement loops. That was true for ordinary product development Web2 style, but even more so the focus in, modern agent-driven stuff. But I think that this kind of thing of figuring out how to do coordination at the edge together, whether a central platform wants us to be able to or not, is one of the most important things we should do.

I've kind of focused on Twitter and YouTube as the big bad platforms, but right now it's really the frontier model companies that are the scary platforms. And what we have to be able to do to fight back against them is basically figure out how to do coordination and aggregation of data ourselves without having to just publish the data where it's, going to be used against us or the value of it scooped up by frontier model companies to a better degree than we're able to use it. And so the ability to use TEE technology, other privacy-enhancing technology, to achieve coordination of our private data and be able to make contracts and commitments with each other is, like, the key ingredient that I'm optimistic about giving us some chance to be able to fight back against these.

I think the last thing that I will say is, an instance of this kind of tech use for this platform is this, emerging campaign that we're starting to put more into. This is, James' slide. He and I conceived of this idea, and he exhibited agency engineering by really hyping me up about this, so now I'm extremely excited and gonna put a lot of effort into this, so you'll hear more about it coming further. But it's basically about encouraging grad students, people at the frontier of research who are often isolated to start with, but to encourage them and they have reasons to be because they're afraid of scooping each other, for example.

But we're going to try to use this technology to find ways that they can collaborate better. That's how we're going to build a more powerful research mesh of human researchers. And again, this is in the, scope of finding ways to fight back against, centralizing powers you know, two biggest model companies, just for example.