Skip to content

Delegation Chain

A delegation chain is a root-to-leaf list of signed credentials. It is the primitive that lets Agent A hand a bounded slice of its authority to B, and B a still-smaller slice to C, with each grant provably within the one above it.

Credential

A DelegationCredential has the following signed body plus a detached signature:

Field Type Meaning
credential_id string Unique id of this hop
issuer hex Ed25519 public key of the delegator
subject hex Ed25519 public key of the delegate
scope set of strings Capabilities granted at this hop
depth int 0 at the root, +1 per hop
parent_id string or null credential_id of the parent hop; null at the root
signature hex Ed25519 over the canonical body, by the issuer

Canonicalization

The signed bytes are the RFC 8785 (JSON Canonicalization Scheme) encoding of the body: keys sorted by UTF-16 code units, JCS minimal string escaping, non-ASCII emitted literally as UTF-8, integers in shortest decimal form, scope as a sorted array. This is the byte string signed and verified. Using JCS makes cA2A signatures cross-verifiable with agent-manifest and any other conforming implementation. See ca2a_runtime.canonical.

Verification invariants

verify_chain raises the specific error for the first invariant that fails:

Invariant Error on violation
Every hop's signature verifies against its issuer INVALID_CREDENTIAL
Root has no parent and depth 0 BROKEN_DELEGATION_LINK
Each hop's parent_id equals the previous credential_id BROKEN_DELEGATION_LINK
Each hop's issuer equals the previous hop's subject BROKEN_DELEGATION_LINK
Each hop's depth is previous + 1, and at most max_depth BROKEN_DELEGATION_LINK / DELEGATION_DEPTH_EXCEEDED
Each hop's scope is a subset of its parent's scope SCOPE_ESCALATION
No credential_id repeats CREDENTIAL_REPLAY

Attenuation is the whole point

Attenuation, the guarantee that a child grant cannot exceed its parent, is the confused-deputy defense. Without it, B could accept a narrow task from A and then act with authority A never granted. The subset check on scope at every hop is what forecloses that.

Relationship to agent-manifest

These semantics mirror the signed A2A delegation chain implemented and tested in agent-manifest, including cross-manifest replay protection and HITL approval signing. cA2A's runtime calls that verifier on inbound peer requests; this module is the runtime-side model.