1. Naftaly Minsky Rutgers University Law-Governed Multi-Agent Systems: From Anarchy to Order “Law is order, and good law is good order” Aristotle, Politics Book 7

2. 2 N. Minsky, SELMAS keynote May/05 Qualification  This talk addresses open (agent) systems, composed of heterogeneous agents, whose membership may change dynamically, and might be very large.  In such system an agent might not know, or trust, the behavior of its interlocutors—and may not even know who they are.  However, in a sense, all large scale systems are open!!

3. 3 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: the effect of laws on the analysis, design, and evolution of MASs—and on reasoning about them.  Conclusion, and the release of LGI.

4. 4 N. Minsky, SELMAS keynote May/05 Introduction  What is common to the following “multi-agent systems”?  Cars moving through an intersection.  People buying produce in a farmer market.  Flock of birds flying in formation.  Celestial motion  The web  Each is critically based on the existence of a law— i.e., on a principle, actually observed by the agents in the systems, which thus induces a regularity in it.  We employ here the physical law as a metaphor—in other respects the metaphor of social law is more apt for our laws

5. 5 N. Minsky, SELMAS keynote May/05 Examples of “Good” Laws  The laws underlying our example MASs  Moving cars: traffic laws—e.g., “stop at red light”  Farmer market: money cannot be forged.  Flock of birds: ??  Celestial motion: Newton’s laws  The web: HTML format & HTTP protocol  The benefits of these laws is rooted in the compliance with them—even if approximate.

6. 6 N. Minsky, SELMAS keynote May/05 Some Potential Benefits of Laws  Mutual trust, which facilitates collaboration [the market]  Safety and security [traffic, market]  Simplification: ability to reason in absence of details [celestial motion].  Lawless open systems cannot be reasoned about.  Robustness: properties that rely on the law alone are independent of system details, thus invariant of changes in them [celestial motion, traffic]

7. 7 N. Minsky, SELMAS keynote May/05 Benefits of Laws (cont)  Laws can impose structure on a system, such as managerial structure, which provides some agents with power over others.  Laws can protect the system against ignorant, careless, or even malicious, agents.  Laws can provide a framework for building a system, for reasoning about it, and for maintaining it.  Just think about how much of our economy depends on the laws governing money.

8. 8 N. Minsky, SELMAS keynote May/05 The Management of a Buying Team—an Example $ $ $ $ $ $ $ The manager should be able to assign tasks and budget to members of the team; and to change the assignments, dynamically. $ task $ Buyers should be able issue POs, subject to their assignments Buyers should be able to exchange assignments $ $ task $ tasks $ tasks $ $ $ $ tasks $ task Buyers must report to the manager Manager Buyers “To manage, is to monitor, and steer”. These capabilities should be established by law!

9. 9 N. Minsky, SELMAS keynote May/05 Making a System Law-Abiding  The difficulty: to be meaningful, a law needs to be observed by everybody subject to it—so, it cannot be localized in a conventional manner.  In social system, laws are established via education, peer pressure, and social enforcement, like police.  In distributed systems, like a MAS:  By manual construction—effective only if the system is uniform [like birds of a feather], or small enough.  By voluntary compliance (e.g., the web)—effective only if it is in the interest of everybody to obey this law. and if the violator cannot damage anybody but himself.  By enforcement

10. 10 N. Minsky, SELMAS keynote May/05 What Should Laws of a MAS be About?  They cannot be about the structure and behavior of the agents themselves—which might be heterogeneous, and unknown—but they can be about the interaction between agents.  Interactions are critical aspect of a system, which do not belong to any particular agent, and thus deserve special attention.  As has been well recognized by the prodigious research on coordination.

11. 11 N. Minsky, SELMAS keynote May/05 Requirements for a Regulatory Mechanism for Software  High expressive power, in particular, laws should be:  Stateful—i.e., sensitive to the history of interaction.  Able to mandate side effects to interactions—in particular, state change.  Proactive—i.e., able to initiate actions.  Decentralized enforcement, for scalability.  Local formulation of laws—necessary for decentralization of enforcement.

12. 12 N. Minsky, SELMAS keynote May/05 Requirements (cont)  Communality: laws should be able to regulated entire communities—contrary to conventions access-control, which is server-centric.  A given system may be subjected to a multitude of laws, which should be:  able to interoperate.  organized into hierarchies  Laws should be allowed to evolve, in a self-regulatory manner.  All these properties need to be met via a single mechanism—for specifying policies, and for enforcing them.

13. 13 N. Minsky, SELMAS keynote May/05 Conventional Approaches  Conventional approaches for regulating interactions fall into two classes:  Access control, generally focused on security—[not expressive enough, and “server-centric”]  Coordination mechanisms, like Chemical Reaction (Banatre at al.), LO (Andreoli), TuCSoN (Denti & Omicini), EgoSpaces (Roman et al.)—[overly centralized, and unscalable]  These approaches fall short in other ways as well. E.g., they do not support interoperability and hierarchy between policies (laws).

14. 14 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: the effect of laws on the analysis, design, and evolution of MASs—and on reasoning about them.  Conclusion, and the release of LGI.

15. 15 N. Minsky, SELMAS keynote May/05 Law-Governed Interaction (LGI) a Decentralized Regulatory Mechanisms  Satisfies all the above requirements.  Inherently decentralized enforcement— although it provides for a whole spectrum between completely decentralized, to completely centralized—as a means for optimization.  Two languages for writing laws—Prolog & Java—with the same semantics.  Easy and incremental deployment.

16. 16 N. Minsky, SELMAS keynote May/05 Overview of LGI (cont)  Efficiency: overhead of 20 – 200 µs.  History and status:  Has been defined in an 1991 paper in the IEEE Tr. on Soft. Eng.  Prototype implementation in 1996.  Beta version of LGI to be released by the end of May 2005, via: http://www.cs.rutgers.edu/moses/

17. 17 N. Minsky, SELMAS keynote May/05 Centralized Enforcement of Communal Policies * The problems: potential congestion, and single point of failure m’ x u v y m ==> y m ==> x m Legend: P---Explicit statement of a policy. I---Policy interpreter S---the interaction state of the community P I S Reference monitor * Replication does not help, if S changes rapidly enough

18. 18 N. Minsky, SELMAS keynote May/05 Distributed Law-Enforcement under LGI L I S x u v y L I $9 L I SvSv L I $1 L I SuSu Move(2) Moved(2) m m ==> y m $7 $3 actor controller

19. 19 N. Minsky, SELMAS keynote May/05 Deployment of LGI via a Distributed TCB (DTCB) I I I I IIx y controller server m’ adopt(L, name) L m’’ adopt(L, name) L m ==> y

20. 20 N. Minsky, SELMAS keynote May/05 The local nature of LGI laws  Laws are defined locally, at each agent:  They deal explicitly only with local events—such as the sending or arrival of a message.  the ruling of a law for an event e at agent x is a function of e, and of the local control state CS X of x.  a ruling can mandate only local operations at x.  Local laws can have powerul global consequences— because of their global purview.  This localization does not reduce the expressive power of LGI laws,  and it provides scalability for many (althouh not all) laws.

21. 21 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: the effect of laws on the analysis, design, and evolution of MASs—and on reasoning about them.  Conclusion, and the release of LGI.

22. 22 N. Minsky, SELMAS keynote May/05 Governance of Virtual Enterprise (a Case Study)  Consider a coalition C of enterprises {E 1,..., E n }, governed by a coalition-policy P C ---where each E i is governed by its own internal-policy P i.  As in: virtual enterprises, supply chains, grid computing, etc. E3E3 E2E2 E1E1 P2P2 P1P1 P3P3 PCPC

23. 23 N. Minsky, SELMAS keynote May/05 Policies Governing a Virtual Enterprise (an Example) E2E2 E3E3 E1E1 Roles: each Ei should have its director Di( * ); and the coalition C a director D C. A director Di can mint Ei-currency $ i needed to pay for services provided by Ei and it can give D C some of this currency A director D C can distribute some of its $ i currency among other directors. $1$1 $1$1 Servers at E1 can send their earning in $ 1 back to their director PCPC P2P2 P1P1 $1$1 $1$1 $1$1 $ i Currency cannot be forged—by anyone! A director D 2 can distribute its $ i budget among agents at its enterprise $1$1 $1$1

24. 24 N. Minsky, SELMAS keynote May/05 The Main Challenges  The flexible formulation of such policies, so that:  they will be consistent, and  their specification and evolution would be manageable.  Enforcement of such policies, and in a scalable manner.

25. 25 N. Minsky, SELMAS keynote May/05 The Compositions Approach…  Given the set {P C, P 1,..., P n } of policies.  Construct a set composed policies: {P i,j = composition (P i, P C, P j )}  Provide these compositions to the reference monitor (RM) that mediates all coalition-relevant interactions.  Compositions were studied by: Gong & Qian 96, and by Bidan & Issarny 98,...

26. 26 N. Minsky, SELMAS keynote May/05 … and its Problematics  It is unlikely for arbitrary, and independently formulated, policies to be consistent—so such composition is likely to fail.  Policy composition is computationally intractable (McDaniel & Prakash 2002)—and, we need N^2 such compositions!  Inflexibility: consider changing a single P i...

27. 27 N. Minsky, SELMAS keynote May/05 The Proposed LGI-based Approach  Instead of creating N^2 compositions (P i, P C, P j ), we enable each enterprise E i to create it own policy P i, subject only to the constraint that P i would conform to P C  We will then allow E i and E j to interoperate, each enforcing its own policy, P i & P j respectively

28. 28 N. Minsky, SELMAS keynote May/05 Hierarchy Organization of Coalition Policies PCPC P1P1 P2P2 PnPn superiorsubordinate P i is defined as subordinate to P c, as thus constrained to conform to it.

29. 29 N. Minsky, SELMAS keynote May/05 Interoperability  Let us focus on the interoperability between E 2 and E 1 E3E3 E2E2 E1E1 P2P2 P1P1 P3P3 PCPC

30. 30 N. Minsky, SELMAS keynote May/05 Interoperability (cont.) imported(x,P 2,m) E2E2 E1E1 x y Authenticated by CA 2 and CA C Authenticated by CA 1 and CA C controller P1P1 P2P2 C x C y CS x II m export(m,y,P 1 )

31. 31 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: implications to the analysis, design, and evolution of MASs—and to reasoning about them.  Conclusion, and the release of LGI.

32. 32 N. Minsky, SELMAS keynote May/05 Specification and Design  Law has been part of the initial specification and design of social systems.  The USA has been “specified and designed” by its constitution.  The initial design of a transportation systems, involved the traffic laws  This must be the case for any open systems.  In particular, because roles —like that of a manager—often imply laws.  This was recently “discovered” by Zambonelli at al. about Gaia—in their 2003 paper.

33. 33 N. Minsky, SELMAS keynote May/05 Implementation  Thesis: laws must be part of the system and not just part of its design.  This is chiefly due to the globality of laws, which:  Makes it hard to implement a law manually.  And makes it easy to violate a law, anywhere in a given system.  Being “part of the system” means that the very act of writing the law formally means enacting it. Thus, laws need to be enforced.

34. 34 N. Minsky, SELMAS keynote May/05 Evolution  Evolution of the Code  The existence of a law naturally constrains the code of the various parts of the system, and the evolution of this code.  This is generally a good thing, which bridges the gap between the specification of a system and its code.

35. 35 N. Minsky, SELMAS keynote May/05 Evolution (cont)  Evolution of the laws themselves, involves several issues:  “hot update” of a law, while the community governed by it operates.  How a given law can be changed? I believe that laws, like the constitution of a country, must be self regulatory—but this is a wide open question.  Who is to be allowed to initiate a valid change of a law, and under which circumstances.

36. 36 N. Minsky, SELMAS keynote May/05 Reasoning  Lawless open systems cannot be reasoned about.  But how does one actually reason about systems governed by explicit laws?  This, very much open, question has two aspects:  How does one reason about a law alone?  How does one combine the knowledge of a law, and of some code (i.e., code of certain agents) to make conclusions about the system?

37. 37 N. Minsky, SELMAS keynote May/05 Conclusion  The idea of laws that governs software is far from new—every programming language imposes such laws.  But laws are critical for open distributed systems—like MASs—and require a fresh approach.  LGI provides one such approach, with an effective, and quite general, middleware to support it.

38. 38 N. Minsky, SELMAS keynote May/05 Conclusion (cont)  A Beta version of LGI is to be released in May 2005, via: http://www.cs.rutgers.edu/moses/http://www.cs.rutgers.edu/moses/  This release would not include law-hierarchy, and hot- update of laws  Papers about this subject are available through my website: http://www.cs.rutgers.edu/~minsky/  LGI is very much work-in-progress. There is much work to be done, on both the LGI mechanism itself, and on its various applications and implications.  And I hope some of you will take a look at these issues.