delegation

Overview ¶

Command delegation shows non-repudiable authority and the delegation chain across sub-agents. A root principal signs a grant to a desk; the desk attenuates it (a strictly narrower limit) to an execution agent; the execution agent attenuates it again to a sub-agent. Each hop is signed by its own issuer's key (not the log's), hash-linked to its parent, and anchored in the audit log. The sub-agent is then governed to the limit its grant seeded, and its action's leaf links to that grant, whose chain proves, unbroken and never widened, back to the root.

Offline, no LLM or network. The keyring stands in for a PKI/IdP.