# Service Architecture¶

Basic promises:

- respond to messages under certain conditions (liveness)
- never send messages satisfying certain criteria (safety)

Kinds of services:

- ordering
- storage
- compute
- bandwidth

## Heterogeneous trust¶

Suppose that program \(P\) instantiates the Anoma protocol, and that an observer \(O\) can interact with \(P\) by sending and receiving messages (locally, in the sense that the interface is trusted).

Assume that:

- The agent \(A\) makes some
*trust assumptions*about how other agents \(A_1, A_2, ... A_n\) will behave. These trust assumptions, for an agent \(A\), are always of the form of a predicate over messages which \(A\) is expected to send, possibly in response to messages they have received. For example, an assumption could be of the form that \(A\) will never send two messages \(M_1\) and \(M_2\) such that, for some predicate \(P\), \(P(M_1, M_2) = 1\) (safety-related), or of the form that in response to receiving message \(M\), \(A\) will eventually respond with message \(M'\), where, for some predicate \(P\), \(P(M, M') = 1\) (liveness-related).

A valid instantiation of Anoma must guarantee:

*Consistency*: if*in fact*\(O\) is*correct*about their trust assumptions, i.e. for each \(A_n\) about which \(O\) makes a trust assumption, \(A_n\) does*in fact*behave in the way in which \(O\) assumes that they will, then for any other observer \(O'\), if \(O\) and \(O'\) are both running program \(P\), in response to an arbitrary query message \(Q\), \(P\) will respond to \(O\) and \(O'\) with the same response \(R\).*Liveness*: if*in fact*\(O\) is*correct*about their liveness-related trust assumptions, i.e. for each \(A_n\) about which \(O\) makes a trust assumption, \(A_n\) does*in fact*behave in the way in which \(O\) assumes that they will, then for any other observer \(O'\), if \(O\) and \(O'\) are both running program \(P\), in response to an arbitrary input message \(M\), \(P\) will eventually respond to \(O\) and \(O'\). (note: \(P\) needs to have the same private information)

## Information flow control¶

Suppose that program \(P\) instantiates the Anoma protocol, and that an agent \(A\) can interact with \(P\) by sending and receiving messages locally.

Assume that:

- The agent \(A\) makes some
*trust assumptions*about how other agents \(A_1, A_2, ... A_n\) will behave. These trust assumptions, for an agent \(A\), are always of the form of a predicate over messages which \(A\) is expected to send, possibly in response to messages they have received. For example, an assumption could be of the form that, given that \(A\) has received some message \(M_1\), \(A\) will never send a message \(M_2\) such that, for some predicate \(P\), \(P(M_1, M_2) = 1\) (this could indicate, for example, that \(M_2\) discloses some information in \(M_1\)).

A valid instantiation of Anoma must guarantee:

*Bounded disclosure*: if \(A\) discloses certain information \(I\) to a set of parties $A_1 ... \(A_n\), with instructions not to disclose it to further parties, and*in fact*\(A\) is*correct*about their trust assumptions, i.e., for each \(A_n\) about which \(A\) makes a trust assumption, \(A_n\) does*in fact*behave in the way in which \(A\) assumes that they will, for all agents \(A'\) not in \(A_1 ... A_n\), \(A'\) will not learn the information as a result of \(A\)'s disclosure of it.*Orthogonal disclosure*: if \(A\) knows certain information \(I\), for an arbitrary function \(F_I\), \(A\) can disclose the result of \(F_I\) to arbitrary other agents without disclosing anything else.