SAM, or Sovereign Agent Mesh, is a peer-to-peer network that lets autonomous AI agents discover one another, connect securely, communicate, and invoke tools. It is intended for operators building decentralized, zero-trust agent networks across cloud, local, and edge environments. The catalogue skill and instruction help agents join or work with the mesh.
Borrowing it
Nothing to install: this file belongs to google/sam. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/google/sam/main/AGENTS.mdgit clone --depth 1 https://github.com/google/samWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/google/sam/agents-md)<a href="https://agentmods.dev/instructions/google/sam/agents-md"><img src="https://agentmods.dev/badge/instructions/google/sam/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/google/sam/agents-md"><img src="https://agentmods.dev/badge/instructions/google/sam/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01694 | $0.01694 |
| Opus 5.5 | $0.00678 | $0.00678 |
| Sonnet 5.5 | $0.00339 | $0.00339 |
| Haiku 4.5 | $0.00169 | $0.00169 |
Grade A, and why
sam AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SAM Repository AI Agent Guidelines
You are an expert software engineering assistant helping to develop, maintain, and test the SAM repository.
1. Architecture & Component Independence
- Decoupled Architecture: The
sam-control-plane,sam-routerandsam-nodecomponents are strictly independent. They must not share internal state or tightly couple their logic. - API Communication: All data communication between
sam-control-plane,sam-routerandsam-nodemust happen exclusively via the common API defined inapi/sam.proto. - One schema, two encodings: every request and response on any SAM-defined surface is a message in
api/sam.proto. The mesh protocol — anything a mesh component speaks (node, router, the SDKs undersdk/): enrollment, refresh, keys, leases, auth streams, policy sync, token exchange (/token/exchange), and outbound border JWT minting (/sts/token) — is binary protobuf (application/x-protobuf). The operator plane — what humans, the web console and admin CLIs call (/admin/*,/users/*,POST /policies) — is protojson of the same messages, withUseProtoNamesand unknown fields rejected. Never define a wire shape on a SAM-defined surface as a Go struct withjsontags, an anonymous struct ormap[string]any, and never serialize aninternal/storage(or any other internal) type onto either surface. The sole exceptions are external standard protocols for unmodified third-party clients and cloud federation: OAuth 2.1 / RFC 8693 / RFC 7009 / RFC 9728 (POST /oauth/token,POST /oauth/revoke,/oauth/authorize,/.well-known/*,/jwks), Envoyext_authz/ext_proc, MCP JSON-RPC (/mcp), OpenAI/v1/*, and A2A/.well-known/agent-card.json. Clients incmd/,internal/consoleandsdk/importapi/or its generated bindings only. - Instants are
google.protobuf.Timestamp, named*_time(expire_time,sign_time,event_time), neverint64seconds or milliseconds.Timestamphas fixed units, an explicit unset, renders as RFC 3339 in protojson (anint64renders as a quoted decimal string), and has a first-class conversion in Go, JavaScript, Python and Dart. A receiver treats an unset instant as invalid, never as the epoch. The one exception is a proof-of-possession value: it is the number that appears in the signed text (sam:<endpoint>:<peer_id>:<n>), so it stays anint64namedchallenge_unix_ms, the unit in the name. What a member persists between runs is also a message here (MemberCredential), so a state directory written by one implementation loads in another. - Datalog text is the policy contract: the control plane renders the mesh policy as Datalog rules (
PolicyConfigGetResponse.datalog_rules); every member, in any language, adds that text to its authorizer and none derives rules from roles and bindings itself. Datalog must stay in the form every Biscuit implementation parses: a predicate carries at least one term (presence-only facts arename(true), seeapi.MarkerFact). - Secrets never travel as flag values: binaries read credentials from a file (
--*-path) or the environment, never from a command-line argument that would sit inpsoutput and shell history. Banners and logs name the source of an operator-supplied secret instead of echoing it. - Task-Scoped Authorization & Safe Biscuit Attenuation (
tar_block): SAM acts as the Authority, Policy Decision Point (PDP), and Task-Scoped Credential Layer (site/content/docs/contributing/security-architecture.md). Never add Datalog rules or checks to non-authority Biscuit blocks (block_idx >= 1). Appended blocks must contain 0 rules, 0 checks, and exactly 1tar_block("<base64url-proto>")fact encoding a serializedapi.TaskAuthorizationRule. Verifiers enforce the intersection of Block 0 Datalog RBAC and every appendedTaskAuthorizationRulein Go, TypeScript, and Python. - Two-Token Model & Complementary Gateway/PEP Integration: Inside the mesh, credentials are Biscuits; at both borders, credentials are standard JWTs (
site/content/docs/contributing/security-architecture.md). Inbound platform credentials (OIDC, K8s SA, SPIFFE JWT-SVID) exchange into delegated Biscuits (POST /token/exchange); outbound verified Biscuits mint short-lived ES256 JWTs at the control plane (POST /sts/token) that the egress node exchanges at cloud STS endpoints (CloudTokenExchanger).sam-nodeintegrates with existing gateways (agentgateway, Istio, Envoy) via Envoyext_authz/ext_procand RFC 8693/oauth/token, while native SDKs (sdk/js,sdk/python) attenuate and seal Biscuits in memory. - Policy on Names: egress policy, secret injection and routing decisions are made on the destination name, never on an IP. Deny by default.
- Zero Trust: Enforce a Zero Trust architecture. Assume no implicit trust between nodes, control planes, routers, or external actors. All data passing through the API must be authenticated, authorized, and validated.
- Simple UX: Maintain a very simple User Experience. Configuration, CLI usage, and error messages must be intuitive, minimal, and explicitly clear.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · -2 lines · +80 tokens per session afd624bee9b1
- 1mo ago Changed · +2 lines · +285 tokens per session c124cea119aa
- 1mo ago Changed · +2 tokens per session f5b89202b02a
- 1mo ago Changed · +2 lines · +259 tokens per session 6a1916424404
- 1mo ago Changed · +24 tokens per session e6d95e02421e
- 1mo ago First seen · 45 lines · 1,044 tokens per session scan A eb496331849c
sam AGENTS.md is an instructions file published in the GitHub repository google/sam (1,111 stars, last pushed 8d ago), licensed Apache-2.0. It adds 1,694 tokens to every session, about $0.0068 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
AgentHound copilot-instructions.md
Copilot instructions for adithyan-ak/AgentHound: Keep generated examples local to the fixture project.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).