Sub-Agent Delegation
Shard Token
Restricted Scope Inheritance
When a primary agent spawns a sub-agent, a shard token is issued from the parent certificate. The shard inherits a restricted subset of the parent scope. A sub-agent cannot receive equal or elevated rights through delegation — the parent cannot grant what it wasn’t itself authorized to do.
Every delegation event is logged to an audit chain, illustrated here as WitnessBound. “Audit-ready” describes the pattern’s design intent — it isn’t a claim of formal regulatory certification.
Delegation Tree
| Level | Scope |
|---|---|
| 👤 Human Principal — Root Authority | Pay declared vendors up to $500; spawn up to 3 sub-agents |
| ▲ Primary Agent — Shard-0 | Restricted to $200 (from $500); spawn up to 2 sub-agents |
| ▶ Sub-Agent A — Query Only | No payment scope; cannot spawn further agents |
| ▶ Sub-Agent B — Limited Pay | Restricted to $50 (from $200); cannot spawn further agents |
Live Scenarios
0Actions
0Blocked
Root cert loaded. Shard config active: max 3 sub-agents, depth 2.
| NCCoE filings | 8, AI Agent Identity & Authorization |