03 · Actions: was each delegation checked inside attested hardware?
Verify who delegated what to each agent¶
cA2A is a profile on A2A that adds signed attenuated delegation, peer appraisal, a sealed peer channel and a TRACE provenance record per hop, checkable offline against a root you trust.
Verify your first delegation chain What this proves, and what it does not
TL;DR
ca2a-runtime 0.2.0 (MIT developer preview; the PyPI name ca2a belongs to an unrelated project) rejects scope escalation offline with no hardware or running peer. SEV-SNP and TDX appraisal ran on real Azure and GCP evidence, including an Azure SEV-SNP peer calling a GCP TDX peer on 2026-07-27, but peer appraisal is one-directional so far and binding the seal to a verified measurement on a live call is on the roadmap.
-
Run it
Verify a narrowed grant and reject both an untrusted issuer and signed scope escalation, then stand up the live peer runtime.
-
What it proves, and what it does not
What has run against real silicon, what is one-directional, and what is not appraised at all.
-
Hardware evidence
SEV-SNP on Azure and Intel TDX on GCP C3, validated 2026-07-27, with the collectors run on real silicon on 2026-08-24.
-
The chain
Before it: Agent Manifest issues the attenuated delegation credential. Alongside: cMCP covers tool calls. Each hop's record is written in TRACE. Check a real TDX quote at agentrust-io.com/verify.
The gap it closes¶
An agent identity does not by itself establish delegation authority. When A delegates to B and B delegates to C, the relying party needs to authenticate the root and check each grant. Live calls also need caller authentication, local policy, and any required runtime appraisal.
The four primitives¶
| Mechanism | What to check | Start here |
|---|---|---|
| Delegation credentials | Trusted root, signatures, continuity, bounded scope and depth | Offline quickstart |
| Runtime appraisal | Evidence and measurements required by the relying party | Attestation |
| Sealed peer channel | Payload encryption to the appraised peer key | Sealed channel |
| Linked provenance | Record signatures and parent links | TRACE A2A profile |
Software and hardware modes provide different assurance. Peer appraisal has been demonstrated one-directionally; mutual simultaneous hardware attestation remains outstanding. Read Limitations before relying on a hardware claim.
For the architecture and trust boundaries, read How It Works. The normative profile, with the delegation chain, sealed channel, and conformance rules, is in Profile.
Status: ca2a-runtime 0.2.0 developer preview · MIT · hosting at the Agentic AI Foundation proposed, not accepted · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.