Agent-to-agent delegation

Consider two agents. A triage agent reads tickets and holds a grant on one read-only tool. A finance agent holds a grant on the refund tool. Somebody wires them together so triage can ask finance to handle a case. If the system evaluates the refund against the finance agent’s permissions because finance is the one making the call, then triage has just acquired the refund tool. Nothing was compromised; the composition did it.

The mechanism that fixes it is that the whole chain is the subject, and the effective permission set is the intersection across it. Token Observe evaluates each link independently against the requested action and returns on the first refusal, with the reason naming which link of how many denied it — so a refusal is diagnosable rather than a flat denial that sends an engineer looking in the wrong place.

Two properties of that design are worth stating because they get lost. First, intersection means adding a hop can only ever reduce what is possible, which makes composition safe by construction rather than by review. Second, the intersection is evaluated at the moment of the call against the current rows, not baked into a token at the start of the workflow, so revoking a grant halfway through a long-running chain takes effect on the next call rather than when something reconnects.

The corresponding cost is real and should be planned for: a chain is only as capable as its least privileged member, so a workflow designed by giving each agent exactly what it needs will find that composing them yields nothing at all until somebody widens a grant deliberately. That is the control working. The failure to accept is widening the least-privileged member to make the chain work, which quietly reintroduces the union.

A header naming the upstream agents is a string the caller chose. So is a header naming the human an agent is acting for. Neither carries a signature, and treating either as a source of authority converts a value the caller controls into a permission — which is the shape of most authorisation bugs, not a novel agent problem.

The safe semantics are one-directional. A delegation chain can only add more links to intersect, which can only reduce the result. A named human can only contribute the roles mapped from their directory groups as another set to intersect, which can only reduce the result. Token Observe implements the second exactly that way: the on-behalf-of mask is off by default, has a shadow stage that computes the intersection and records what it would have refused without acting on it, and when enforcing appends the human’s mapped roles to the delegation chain so it can only narrow. Failures to resolve the principal refuse rather than fall through — unknown principal, disabled principal, no claims, stale claims, unresolved — and a group capture older than a configured maximum age is refused rather than trusted, because those groups are what the identity provider asserted at that person’s last sign-in rather than a live directory read.

The corollary that people miss is that an agent can simply omit the header, which skips the mask entirely. That is why the registry carries a per-agent switch requiring a named human, to be set on the agents where an unattributed call is the anomaly rather than the norm — a copilot, a ticket triager, anything operating inside one person’s authority. Requiring the header estate-wide where the mask does not change any decision would be theatre.

The strongest form of this rule is what happens when the caller has authenticated with something better than a bearer token. Where a request arrives on a capability derived from a signed workload assertion, Token Observe refuses a caller-supplied delegation header outright and binds the session identifier and the named human from the capability instead. A verified claim and an asserted one must not be mixable, because mixing them means the weaker one decides.

There is now an interoperability protocol for agent-to-agent messaging, and the sensible posture towards it is the same as towards any other dialect: accept the subset you can govern completely, refuse the rest with a typed error, and put everything through the same decision path as the rest of the estate.

Token Observe accepts the synchronous text and structured-data subset and deliberately omits the parts it cannot inspect: no dereferencing of URLs or files, no streaming, no push callbacks, no background task store, and no silent downgrade to an older protocol revision. The inference itself is then sent through the ordinary governed route using a derived one-use capability, so authentication, permissions, policy, routing, budget, approvals, redaction, metering and trace closure remain one implementation rather than two that will disagree. Message content is bounded — a cap on content bytes, on the number of parts, and on the depth and node count of structured data — because everything crossing this boundary is untrusted in both directions.

The refusals matter as much as the acceptances. A protocol feature that lets a peer hand you a URL to fetch is a request to make an outbound call on someone else’s behalf, which is an egress control question rather than a messaging feature. A background task store is state you would be holding on behalf of a peer. A silent downgrade is an unbounded compatibility surface, and an unbounded compatibility surface is an unbounded attack surface.

Two smaller things belong here. Agent cards, where they are accepted, are input like anything else and need the same bounds on size, depth and node count. And a peer’s claim about its own identity is worth exactly what the transport authenticated, which is the same rule as the header above, applied to a protocol that makes the claim look more official.