Naftaly Minsky Rutgers University Law-Governed Multi-Agent Systems: From Anarchy to Order “Law is order, and good law is good order” Aristotle, Politics Book 7

2 N. Minsky, SELMAS keynote May/05 Qualification  This talk addresses open (agent) systems, composed of heterogeneous agents, whose membership may change dynamically, and might be very large.  In such system an agent might not know, or trust, the behavior of its interlocutors—and may not even know who they are.  However, in a sense, all large scale systems are open!!

3 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: the effect of laws on the analysis, design, and evolution of MASs—and on reasoning about them.  Conclusion, and the release of LGI.

4 N. Minsky, SELMAS keynote May/05 Introduction  What is common to the following “multi-agent systems”?  Cars moving through an intersection.  People buying produce in a farmer market.  Flock of birds flying in formation.  Celestial motion  The web  Each is critically based on the existence of a law— i.e., on a principle, actually observed by the agents in the systems, which thus induces a regularity in it.  We employ here the physical law as a metaphor—in other respects the metaphor of social law is more apt for our laws

5 N. Minsky, SELMAS keynote May/05 Examples of “Good” Laws  The laws underlying our example MASs  Moving cars: traffic laws—e.g., “stop at red light”  Farmer market: money cannot be forged.  Flock of birds: ??  Celestial motion: Newton’s laws  The web: HTML format & HTTP protocol  The benefits of these laws is rooted in the compliance with them—even if approximate.

6 N. Minsky, SELMAS keynote May/05 Some Potential Benefits of Laws  Mutual trust, which facilitates collaboration [the market]  Safety and security [traffic, market]  Simplification: ability to reason in absence of details [celestial motion].  Lawless open systems cannot be reasoned about.  Robustness: properties that rely on the law alone are independent of system details, thus invariant of changes in them [celestial motion, traffic]

7 N. Minsky, SELMAS keynote May/05 Benefits of Laws (cont)  Laws can impose structure on a system, such as managerial structure, which provides some agents with power over others.  Laws can protect the system against ignorant, careless, or even malicious, agents.  Laws can provide a framework for building a system, for reasoning about it, and for maintaining it.  Just think about how much of our economy depends on the laws governing money.

8 N. Minsky, SELMAS keynote May/05 The Management of a Buying Team—an Example $ $ $ $ $ $ $ The manager should be able to assign tasks and budget to members of the team; and to change the assignments, dynamically. $ task $ Buyers should be able issue POs, subject to their assignments Buyers should be able to exchange assignments $ $ task $ tasks $ tasks $ $ $ $ tasks $ task Buyers must report to the manager Manager Buyers “To manage, is to monitor, and steer”. These capabilities should be established by law!

9 N. Minsky, SELMAS keynote May/05 Making a System Law-Abiding  The difficulty: to be meaningful, a law needs to be observed by everybody subject to it—so, it cannot be localized in a conventional manner.  In social system, laws are established via education, peer pressure, and social enforcement, like police.  In distributed systems, like a MAS:  By manual construction—effective only if the system is uniform [like birds of a feather], or small enough.  By voluntary compliance (e.g., the web)—effective only if it is in the interest of everybody to obey this law. and if the violator cannot damage anybody but himself.  By enforcement

10 N. Minsky, SELMAS keynote May/05 What Should Laws of a MAS be About?  They cannot be about the structure and behavior of the agents themselves—which might be heterogeneous, and unknown—but they can be about the interaction between agents.  Interactions are critical aspect of a system, which do not belong to any particular agent, and thus deserve special attention.  As has been well recognized by the prodigious research on coordination.

11 N. Minsky, SELMAS keynote May/05 Requirements for a Regulatory Mechanism for Software  High expressive power, in particular, laws should be:  Stateful—i.e., sensitive to the history of interaction.  Able to mandate side effects to interactions—in particular, state change.  Proactive—i.e., able to initiate actions.  Decentralized enforcement, for scalability.  Local formulation of laws—necessary for decentralization of enforcement.

12 N. Minsky, SELMAS keynote May/05 Requirements (cont)  Communality: laws should be able to regulated entire communities—contrary to conventions access-control, which is server-centric.  A given system may be subjected to a multitude of laws, which should be:  able to interoperate.  organized into hierarchies  Laws should be allowed to evolve, in a self-regulatory manner.  All these properties need to be met via a single mechanism—for specifying policies, and for enforcing them.

13 N. Minsky, SELMAS keynote May/05 Conventional Approaches  Conventional approaches for regulating interactions fall into two classes:  Access control, generally focused on security—[not expressive enough, and “server-centric”]  Coordination mechanisms, like Chemical Reaction (Banatre at al.), LO (Andreoli), TuCSoN (Denti & Omicini), EgoSpaces (Roman et al.)—[overly centralized, and unscalable]  These approaches fall short in other ways as well. E.g., they do not support interoperability and hierarchy between policies (laws).

14 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: the effect of laws on the analysis, design, and evolution of MASs—and on reasoning about them.  Conclusion, and the release of LGI.

15 N. Minsky, SELMAS keynote May/05 Law-Governed Interaction (LGI) a Decentralized Regulatory Mechanisms  Satisfies all the above requirements.  Inherently decentralized enforcement— although it provides for a whole spectrum between completely decentralized, to completely centralized—as a means for optimization.  Two languages for writing laws—Prolog & Java—with the same semantics.  Easy and incremental deployment.

16 N. Minsky, SELMAS keynote May/05 Overview of LGI (cont)  Efficiency: overhead of 20 – 200 µs.  History and status:  Has been defined in an 1991 paper in the IEEE Tr. on Soft. Eng.  Prototype implementation in  Beta version of LGI to be released by the end of May 2005, via:

17 N. Minsky, SELMAS keynote May/05 Centralized Enforcement of Communal Policies * The problems: potential congestion, and single point of failure m’ x u v y m ==> y m ==> x m Legend: P---Explicit statement of a policy. I---Policy interpreter S---the interaction state of the community P I S Reference monitor * Replication does not help, if S changes rapidly enough

18 N. Minsky, SELMAS keynote May/05 Distributed Law-Enforcement under LGI L I S x u v y L I $9 L I SvSv L I $1 L I SuSu Move(2) Moved(2) m m ==> y m $7 $3 actor controller

19 N. Minsky, SELMAS keynote May/05 Deployment of LGI via a Distributed TCB (DTCB) I I I I IIx y controller server m’ adopt(L, name) L m’’ adopt(L, name) L m ==> y

20 N. Minsky, SELMAS keynote May/05 The local nature of LGI laws  Laws are defined locally, at each agent:  They deal explicitly only with local events—such as the sending or arrival of a message.  the ruling of a law for an event e at agent x is a function of e, and of the local control state CS X of x.  a ruling can mandate only local operations at x.  Local laws can have powerul global consequences— because of their global purview.  This localization does not reduce the expressive power of LGI laws,  and it provides scalability for many (althouh not all) laws.

21 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: the effect of laws on the analysis, design, and evolution of MASs—and on reasoning about them.  Conclusion, and the release of LGI.

22 N. Minsky, SELMAS keynote May/05 Governance of Virtual Enterprise (a Case Study)  Consider a coalition C of enterprises {E 1,..., E n }, governed by a coalition-policy P C ---where each E i is governed by its own internal-policy P i.  As in: virtual enterprises, supply chains, grid computing, etc. E3E3 E2E2 E1E1 P2P2 P1P1 P3P3 PCPC

23 N. Minsky, SELMAS keynote May/05 Policies Governing a Virtual Enterprise (an Example) E2E2 E3E3 E1E1 Roles: each Ei should have its director Di( * ); and the coalition C a director D C. A director Di can mint Ei-currency $ i needed to pay for services provided by Ei and it can give D C some of this currency A director D C can distribute some of its $ i currency among other directors. $1$1 $1$1 Servers at E1 can send their earning in $ 1 back to their director PCPC P2P2 P1P1 $1$1 $1$1 $1$1 $ i Currency cannot be forged—by anyone! A director D 2 can distribute its $ i budget among agents at its enterprise $1$1 $1$1

24 N. Minsky, SELMAS keynote May/05 The Main Challenges  The flexible formulation of such policies, so that:  they will be consistent, and  their specification and evolution would be manageable.  Enforcement of such policies, and in a scalable manner.

25 N. Minsky, SELMAS keynote May/05 The Compositions Approach…  Given the set {P C, P 1,..., P n } of policies.  Construct a set composed policies: {P i,j = composition (P i, P C, P j )}  Provide these compositions to the reference monitor (RM) that mediates all coalition-relevant interactions.  Compositions were studied by: Gong & Qian 96, and by Bidan & Issarny 98,...

26 N. Minsky, SELMAS keynote May/05 … and its Problematics  It is unlikely for arbitrary, and independently formulated, policies to be consistent—so such composition is likely to fail.  Policy composition is computationally intractable (McDaniel & Prakash 2002)—and, we need N^2 such compositions!  Inflexibility: consider changing a single P i...

27 N. Minsky, SELMAS keynote May/05 The Proposed LGI-based Approach  Instead of creating N^2 compositions (P i, P C, P j ), we enable each enterprise E i to create it own policy P i, subject only to the constraint that P i would conform to P C  We will then allow E i and E j to interoperate, each enforcing its own policy, P i & P j respectively

28 N. Minsky, SELMAS keynote May/05 Hierarchy Organization of Coalition Policies PCPC P1P1 P2P2 PnPn superiorsubordinate P i is defined as subordinate to P c, as thus constrained to conform to it.

29 N. Minsky, SELMAS keynote May/05 Interoperability  Let us focus on the interoperability between E 2 and E 1 E3E3 E2E2 E1E1 P2P2 P1P1 P3P3 PCPC

30 N. Minsky, SELMAS keynote May/05 Interoperability (cont.) imported(x,P 2,m) E2E2 E1E1 x y Authenticated by CA 2 and CA C Authenticated by CA 1 and CA C controller P1P1 P2P2 C x C y CS x II m export(m,y,P 1 )

31 N. Minsky, SELMAS keynote May/05 Outline  On the Governance of Software: the nature of laws, and their potential benefits  Law-Governed Interaction (LGI)—a very short overview.  Interrelationship between laws, and their evolution— using a virtual enterprise as a case study.  Methodological observations: implications to the analysis, design, and evolution of MASs—and to reasoning about them.  Conclusion, and the release of LGI.

32 N. Minsky, SELMAS keynote May/05 Specification and Design  Law has been part of the initial specification and design of social systems.  The USA has been “specified and designed” by its constitution.  The initial design of a transportation systems, involved the traffic laws  This must be the case for any open systems.  In particular, because roles —like that of a manager—often imply laws.  This was recently “discovered” by Zambonelli at al. about Gaia—in their 2003 paper.

33 N. Minsky, SELMAS keynote May/05 Implementation  Thesis: laws must be part of the system and not just part of its design.  This is chiefly due to the globality of laws, which:  Makes it hard to implement a law manually.  And makes it easy to violate a law, anywhere in a given system.  Being “part of the system” means that the very act of writing the law formally means enacting it. Thus, laws need to be enforced.

34 N. Minsky, SELMAS keynote May/05 Evolution  Evolution of the Code  The existence of a law naturally constrains the code of the various parts of the system, and the evolution of this code.  This is generally a good thing, which bridges the gap between the specification of a system and its code.

35 N. Minsky, SELMAS keynote May/05 Evolution (cont)  Evolution of the laws themselves, involves several issues:  “hot update” of a law, while the community governed by it operates.  How a given law can be changed? I believe that laws, like the constitution of a country, must be self regulatory—but this is a wide open question.  Who is to be allowed to initiate a valid change of a law, and under which circumstances.

36 N. Minsky, SELMAS keynote May/05 Reasoning  Lawless open systems cannot be reasoned about.  But how does one actually reason about systems governed by explicit laws?  This, very much open, question has two aspects:  How does one reason about a law alone?  How does one combine the knowledge of a law, and of some code (i.e., code of certain agents) to make conclusions about the system?

37 N. Minsky, SELMAS keynote May/05 Conclusion  The idea of laws that governs software is far from new—every programming language imposes such laws.  But laws are critical for open distributed systems—like MASs—and require a fresh approach.  LGI provides one such approach, with an effective, and quite general, middleware to support it.

38 N. Minsky, SELMAS keynote May/05 Conclusion (cont)  A Beta version of LGI is to be released in May 2005, via:  This release would not include law-hierarchy, and hot- update of laws  Papers about this subject are available through my website:  LGI is very much work-in-progress. There is much work to be done, on both the LGI mechanism itself, and on its various applications and implications.  And I hope some of you will take a look at these issues.