Attenuating Delegation Chain

Problem

A bearer credential states what its holder may do, not what its holder was delegated. Once it is handed down, every hop holds the authority the first hop held, so an agent that has been prompt-injected somewhere in the middle of the call tree can spend the whole grant; in one measurement a compromised sub-agent under bearer delegation could reach all 8,100 actions available in the environment. Narrowing the credential at each hop through the authorization server helps, but it puts a round trip on the critical path of every delegation and still leaves the resource server trusting a scope claim it has no way to check. Nothing in the credential ties a child to its parent, so no enforcement point can answer whether the authority in front of it is narrower than what the person signed.

Solution

Represent the grant as a credential chain rooted in a link the principal signed. The root states the authority actually delegated across a fixed facet set: which tools may be invoked, which argument values are legal, how much may be spent, how many further hops remain, and how long the grant stays valid. When a holder delegates, it derives a child link offline by restricting one or more facets and signing the result. It cannot add a tool the parent did not carry, raise a spend ceiling, or extend a validity window, and the depth facet forces the child to record at least one hop fewer than its parent. An enforcement point that holds the root trust anchor walks the chain from root to leaf, checks each signature, and checks each facet for monotone narrowing; the first widened link fails the entire chain. Because the check is local it needs no call to the authorization server, and because the chain is append-only it doubles as the provenance record for the action it authorised. Revocation, key rotation, and short root lifetimes remain the issuer's responsibility, since a link already handed out cannot be withdrawn by the chain itself.

When to use

• Work is delegated across more than one hop, so a sub-agent or a tool goes on to call a further sub-agent or tool.
• The enforcement point is operated by someone other than the issuer and cannot be expected to call back to an authorization server on every action.
• Some hops touch money, irreversible actions, or data the principal would not grant in bulk, so authority has to be demonstrably bounded rather than merely intended to be.
• The threat model assumes any agent in the tree may be prompt-injected and must still be unable to exceed what was delegated.