Scoped delegation for agent handoffs

Multi-agent systems pass work from one agent to another. A planner may send a research task to a worker, and that worker may ask another agent to fetch data. Scoped delegation keeps each handoff smaller than the authority above it.

Scoped delegation

Scoped delegation is a recorded grant from one agent to another. The grant contains the parent agent, the child agent, the scopes being passed, an expiration time, and optional restrictions.

In AgentTrust ID, a child can receive only a subset of the parent's authority. A chained delegation can narrow again. The chain cannot widen scope at a later hop.

Credential copying risk

Copying a credential down an agent chain gives every hop one blast radius. The agent closest to untrusted input can end up holding the planner's power. Revocation becomes coarse because every holder depends on one secret.

Scoped delegation gives each hop its own handle. You can revoke one delegation without stopping the parent agent or every sibling task.

Delegation example

The Python SDK exposes delegation as a first-class API. This example gives a worker only web:search, then opens a session from that delegation.

from agenttrustid import AgentTrustClient

client = AgentTrustClient.from_env()

planner = client.agents.create(
    name="planner",
    framework="custom",
    capabilities=["web:search", "docs:read", "reports:write"],
)

researcher = client.agents.create(
    name="researcher",
    framework="custom",
    capabilities=["web:search", "docs:read"],
)

delegation = client.delegations.create(
    from_agent_id=planner.id,
    to_agent_id=researcher.id,
    scope=["web:search"],
    ttl_seconds=900,
    restrictions={"purpose": "collect public references"},
)

session = client.delegations.init_session(delegation.id)

allowed = client.actions.check(
    agent_id=researcher.id,
    session_id=session.session_id,
    tool_name="web:search",
    tool_input_summary="Find public references for the report.",
    action_effect="read",
)

denied = client.actions.check(
    agent_id=researcher.id,
    session_id=session.session_id,
    tool_name="reports:write",
    tool_input_summary="Write the final report.",
    action_effect="mutating",
)

assert allowed.allowed is True
assert denied.allowed is False

The worker may search because that scope was delegated. It may not write the report because the delegation did not include that action.

Prevention

Treat each handoff as a new grant with a smaller scope and a short TTL. The handoff should be visible, revocable, and tied to the child agent that received it.

Test the negative case. A delegation test should prove that the child can use the delegated action and cannot use an action left outside the scope.

Solving this with AgentTrust ID

AgentTrust ID stores delegation records and creates sessions from active delegations. The session scope becomes the ceiling for later action checks. A request outside that ceiling is denied before the tool runs.

Revocation is one call:

client.delegations.revoke(delegation.id)

After revocation, sessions and checks tied to that delegation lose the grant. The parent agent keeps its own authority. The revoked child grant stops carrying work forward.

To add scoped handoffs between agents, start with the SDK guide. To talk through delegation boundaries for your workflow, join the waitlist.

• Read the SDK guide
• Join the waitlist