01 / The operating case
What changes in a real workflow?
A support agent passes a customer ticket to a specialist agent that can issue refunds.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Send task, target and narrow grant separately from untrusted conversation content; receiver validates origin and scope.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The receiver follows a text instruction with its own stronger refund credential.
Evidence to retain
Handoff edge, task, receiver identity, grant validation, refund attempt and result.
04 / Canonical scope
Why this reference stands alone
Cross-runtime delegation adds system-boundary mechanics; this page owns handoff semantics.
Technical artifact
Separate task text from grant
message text: “please refund customer” (untrusted request content) grant: ticket.read(customer-42), issuer P, child C receiver C has own refund credential refund attempt → DENY because grant lacks refund
Run the denial test
Put an urgent refund instruction in a retrieved ticket. The receiving agent may summarize it but cannot treat the text as a permission edge.
Primary references