Skip to main content
Version: v5.7.0

Specialised AI-agent domain packs (packs:ai-agents-<domain>)

packs:ai-agentspacks:ai-agents-<domain>

Beyond the general LLM lane (AI agents) sits a family of specialised packs, one per SME domain — packs:ai-agents-oracle, packs:ai-agents-aws — each a separately-licensed entitlement delivering a domain-expert AI agent as pack content. Each member requires packs:ai-agents; only the family shape is registered in the product, which is why this page covers the family and carries no entitlement of its own — no single licence grants the placeholder name.

The family name, validated by shape​

A member is the prefix packs:ai-agents- followed by a non-empty domain. The licence vocabulary registers the family row, not members: opschain admin licence features lists packs:ai-agents-<domain> with its gate description — the specialised AI-agents pack for one SME domain (requires packs:ai-agents) — and a lookup of a concrete member answers that family row carrying the queried name. Minting accepts any pack-shaped name (grant-side strictness and document tolerance are the entitlements page's rules); registering the family shape fixes the spelling that minting, listings and any future enforcement site share, so they can never drift on it.

The dependency chain​

A domain pack is the top rung of a four-rung stack:

  1. packs:agents — the platform floor: agent registration and session establishment of any type, the agents limit bounding concurrently connected instances.
  2. packs:agent-governance — the governance funnel over the floor: the trust-grant lifecycle, recommendations, the review surfaces.
  3. packs:ai-agents — the LLM lane: AI-type enrolment, model-provider brokerage, the adapter's governed tool surface.
  4. packs:ai-agents-<domain> — the domain's specialised agent content, licensed separately per domain.

The first three rungs are server-enforced at the agent plane: an AI-type enrolment hard-depends on packs:agent-governance + packs:ai-agents, refused with every missing pack named. The domain pack's own dependency on packs:ai-agents is declared in the family's registration and stated verbatim by its vocabulary row; the server-enforced teeth stay the rungs beneath — a domain agent is an AI-type agent, so without the packs below it cannot even enrol, whatever domain grants the licence carries.

How a domain agent ships​

A domain pack is delivered as content, never server code — three parts, with the Support SME as the reference delivery shape (opschain docs getting-started/12-8-the-bundled-smes):

  • The agent itself — a process on the Python agent SDK (sdk/python/opschain_agent.py) with a model adapter (the Claude Agent SDK adapter or the OpenAI adapter), typically packaged on the hardened reference image (examples/ai-agent-image/: outbound-only, non-root, no credential of any kind baked into a layer).
  • The seeded configuration — a seed script that creates the governance shape around the agent: the verb-path authorisation policies, the named owner, the trust assignment and the capped SUPERVISED grant, and the signed AgentRelease freezing the manifest's AI disclosures (model, adapter, custody mode, tool surface, data flow) — plus the editable domain rules and configuration the estate tunes.
  • The entitlement — the domain's packs:ai-agents-<domain> grant on the licence, beside the packs:ai-agents dependency.

Enrolment is ordinary AI-type enrolment, nothing domain-specific: a registration token (opschain admin agent-token create), the type: ai manifest with its attested disclosures, brokered model custody through a ModelProvider record. The runbooks: opschain docs getting-started/12-1-what-an-agent-is (enrolment and the two agent kinds), opschain docs getting-started/12-6-model-providers-and-budgets (brokered custody) and opschain docs getting-started/12-8-the-bundled-smes (the reference domain agent end to end).

What the family gates today​

Stated honestly: no server code path consults a concrete domain grant beyond the vocabulary — the family's registration serves name validation and the features listing. Enforcement rides two existing gates:

  • the generic pack-use gate — a LimePoint-signed action pack whose verified manifest declares packs:ai-agents-<domain> as its required entitlement refuses without the grant, with the named pack refusal (the gate mechanics and the verbatim refusal are on entitlements);
  • the AI-agents gates beneath — AI-type enrolment and the model-provider writes gate the lane every domain agent runs on, whatever domain grants the licence carries.

Lapse follows the general pack posture: a pack document's features layer beside the base while valid or in grace and stop contributing once expired; refusals are named with the apply remedy, and nothing destructive happens to stored configuration.

  • AI agents — the Claude Agent SDK lane — the pack the family layers on, and its own composition section.
  • Entitlements and licensing — gate mechanics, the pack vocabulary, lapse lifecycle.
  • opschain docs agent-plane — the governance fabric every agent runs under.
  • opschain docs getting-started/12-8-the-bundled-smes — the reference domain agent, fence by fence.