Safe delegation between AI agents

Let one agent hand authority to another with a guarantee the model can't break: a delegated warrant can only narrow, never escalate.

The multi-agent authority problem

In a multi-agent system, agent A asks agent B to do something, which asks agent C. Each hop is a chance for authority to grow beyond intent. Prompt-based "you may only…" instructions don't bind — the model can be talked out of them. You need a mechanism where escalation is impossible, not merely discouraged.

Attenuation: authority only shrinks

A warrant is a chain of signed blocks; attenuating it adds caveats that further restrict it and signs the result. Because each block signs the next, you can only add restrictions — removing or loosening one breaks the signature. So B can hand C a strictly narrower warrant, and C can never do more than B was allowed.

import { issue, attenuate } from 'liceat';

// Issue a scoped root warrant for an agent…
const { warrant, attenuationKey } = issue(issuerSecret, 'kid-1', {
  principal: 'org:acme', agent: 'agent:assistant',
  caveats: [
    { type: 'resource', patterns: ['mcp:github/*'] },
    { type: 'action', actions: ['read'] },
    { type: 'spend_limit', currency: 'USD', max: 5000 },
    { type: 'expires', at: Math.floor(Date.now()/1e3) + 3600 },
  ],
});
// …then hand a NARROWER one to a sub-agent — authority can only shrink:
const sub = attenuate(warrant, attenuationKey, [{ type: 'action', actions: [] }]);

Frequently asked