01 / The operating case
What changes in a real workflow?
A planner in one runtime sends a child task to a remote agent service.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Authenticate both runtimes, serialize a narrow signed delegation with audience and expiry, and re-evaluate at the remote executor.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The receiver accepts a plain-language task description as permission or drops the original authority chain.
Evidence to retain
Sender and receiver identities, delegation artifact, validation and final action.
04 / Canonical scope
Why this reference stands alone
Agent handoff security owns a generic transfer; this page owns inter-runtime trust and serialization.
Technical artifact
Remote grant envelope
issuer: runtime A / parent P audience: runtime B / child C task: inspect invoice I42 operations: invoice.read only expiry: 10 minutes; parent grant: G17 receiver verifies signature, audience and ancestor
Run the denial test
Replay the grant to runtime C or change the resource to I43. The remote executor must reject audience or scope mismatch.
Primary references