Layer 03
Authority narrows. It never widens.
In multi-agent systems, a planner hands tasks to sub-agents, which call tools. Each hand-off is a chance to pass on more authority than the task needs.
The Problem
Hand-offs leak authority.
Each agent in a chain is a place where authority can grow unnoticed.
01
Sub-agents inherit too much
A sub-agent created for one small task often receives the full credentials of its parent, because narrowing them takes work.
02
Chains hide where authority came from
By the third hop, nobody can say which human request authorised the action.
03
One steered link reaches everything
If any agent in the chain follows an attacker’s instruction, it can use everything it inherited.
The Method
Checked at every hop.
Authority travels with the agent, and the gateway checks it every time.
01
Capability tokens
Each agent carries a signed token listing its capabilities and the chain it came from.
02
Verified offline
The gateway verifies the whole chain without calling back to an issuer, and refuses any token whose capabilities exceed its parent’s.
03
Tied to a human request
The token carries a commitment to the task a person originally asked for, so any action can be traced back to the request that authorised it.
04
No replays
A copied token is refused within its lifetime.
Example chain
planner ledger.*, mail.send.internal └─ reconciler ledger.invoices.read, ledger.payments.read ✓ narrower └─ reporter ledger.invoices.read, mail.send.external ✗ widens: mail.send.external
Questions
Delegation, explained.
Every agent in a chain can hold only a subset of the authority of the agent that delegated to it. Authority can shrink down the chain, never grow.
A single agent needs only a base-URL change. Multi-agent chains also pass a signed token from parent to child; we set this up with you during the pilot.
The call is denied. A broken chain is never treated as a missing one.
Find out what your agents
are actually allowed to do.
Early access starts with a two-week shadow-mode pilot. Nothing is blocked. You get the gap between the access each agent holds and the access it uses, and every combination that could move data out.