Agent Delegation Control Plane — revocable authority for agents
Alex Yang
The hard part is authority, not capability
An agent that can act raises a different question from an agent that can answer. How do you let it run, bound what it may touch, and revoke it cleanly while it is still mid-flight?
How delegation works
One agent delegates work to another under an exact, one-shot, revocable activation scoped to a single task. Work orders are schema-validated. Route preview is separated from execution, so you can see what would happen before anything runs, and new routes go out as bounded canaries rather than fleet-wide changes.
The full lifecycle. Authority is granted for one task, in an exact form, and it cannot be granted twice.
Guards that run before any work does
Version attestation: the routing decision must declare exactly the harness version installed. A mismatch holds the route instead of guessing.
Fail-closed routing: with no current, valid decision, work falls back to a known-good lane rather than an unverified one.
Double path-ownership: a mutating work order must own its paths, checked lexically and then again physically after resolving filesystem links, so two aliases for the same directory can never hold overlapping write grants.
Value-blind credentials: an alias reaches the child process; the secret itself never appears in the control plane.
No half-published state
Results become review-eligible only once a digest-matching commit marker is published, so a failed run leaves nothing partially committed. Revocation mid-flight is a normal operation rather than an incident.
Each guard exists because of a specific way an autonomous system can quietly exceed what it was given.
Like this project
Posted Sep 10, 2026
One agent delegates to another under an exact, one-shot, revocable activation. Preview is separated from execution, and revocation is clean mid-flight.
Likes
0
Views
0
