agent-delegation-verifier

Offline verification of cross-org agent delegation chains. When an AI agent acting for a human in Org A calls a system owned by Org B, the receiving side currently gets a service account and a shrug. This library makes the full chain — user → agent → sub-agent → tool — cryptographically checkable by the resource server, with monotonic scope attenuation enforced at every hop.

Status: v0.1 in progress. The verifier targets the attenuating-token format from draft-niyikiza-oauth-attenuating-agent-tokens. Structural/scope validation works today; signature verification is next.

Read WHY.md for the full teardown of why this layer is missing, or ROADMAP.md for what ships when.

Install

From source (the package isn't on PyPI yet):

git clone https://github.com/saenz-blip/agent-delegation-verifier.git
cd agent-delegation-verifier
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"

Requires Python 3.10+. Zero runtime dependencies.

Quickstart

from delegation_verifier import verify_chain

chain = {
    "root": {
        "subject": "user@provider-health.example",
        "scope": ["claims.read", "claims.write", "priorauth.submit"],
    },
    "hops": [
        {"actor": "agent://prior-auth-triage", "scope": ["claims.read", "priorauth.submit"]},
        {"actor": "agent://prior-auth-adjudicate", "scope": ["claims.read"]},
    ],
}

result = verify_chain(chain)

print(result.ok)      # True
print(result.errors)  # []

# Scope expansion anywhere in the chain is rejected:
bad = {
    "root": {"subject": "user@provider-health.example", "scope": ["claims.read"]},
    "hops": [
        {"actor": "agent://rogue", "scope": ["claims.read", "claims.write"]},
    ],
}
verify_chain(bad).ok  # False
verify_chain(bad).errors
# ["hop 1 (agent://rogue) expands scope beyond parent: added ['claims.write']"]

verify_chain enforces:

• the chain has a root subject and a non-empty scope,
• every hop's scope is a subset of its parent's scope (monotonic attenuation),
• no hop carries an empty scope.

Any violation returns ok=False with an error naming the offending hop and exactly which permissions were added.

Development

pip install -e ".[dev]"
pytest -v

CI runs the test suite on Python 3.10–3.12 via GitHub Actions (.github/workflows/ci.yml).

License

TBD.