Documentation
¶
Overview ¶
Command splice demonstrates MONOTONIC ATTENUATION across a multi-hop agent delegation chain — the property that "a sub-agent can only ever do LESS than its parent" — and how Legant enforces it where the standards punt. A "planner" agent delegates a sub-task to a "worker" sub-agent (another host). The Feb-2026 IETF "delegation chain splicing" concern is that a compromised intermediary can WIDEN the child's authority (add a tool, raise a cap, pivot to another audience) because RFC 8693 treats prior actors as informational and A2A leaves sub-agent scope to implementers.
Legant's delegation.Delegate() applies Tighten() — intersect the allow-lists, take the min cap — and REFUSES to mint a child that exceeds its parent at all; the worker resource server then enforces what's left, offline. A "naive" system that just signs whatever a caller requests would hand the worker exactly the over-broad token the splicing attack wants.
No database, no Docker:
go run ./examples/splice # or make demo-splice
Source Files