Advanced · Systems

Agent Credential Delegation

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. Passing a scoped, verifiable credential from a principal to an agent — or from agent to sub-agent — so it can act on their behalf.

Technical Definition

Passing a scoped, verifiable credential from a principal to an agent — or from agent to sub-agent — so it can act on their behalf.

How it works

Credential delegation lets an agent act for a user or another agent without ever holding the principal's raw secrets. The principal issues a derived token that is attenuated (narrower scope), time-bounded, and traceable back through the delegation chain. Sub-delegation must only narrow, never widen, authority. Done well, delegation gives clean answers to the two questions auditors ask about autonomous systems: who ultimately authorized this action, and could the agent have exceeded that authorization?

Related Concepts

• Agent Authorization Protocol (AAP) — A protocol that determines which actions an authenticated agent is permitted to perform, on whose behalf, and within what limits.
• Agent Delegation — Handing part of a task, and the authority needed to complete it, from a human to an agent or from one agent to another.
• Delegated Authority — The specific, bounded permission a principal transfers to an agent so it can act on their behalf.
• Agent Credential Exchange — The handshake in which agents present, verify, and accept each other's credentials before doing business.