01 / The operating case
What changes in a real workflow?
Agent A delegates to B, which attempts to delegate the same task back to A.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Check ancestor IDs and task lineage at each handoff; reject any edge that revisits an ancestor.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
Circular validation never terminates or treats the cycle as a fresh authority origin.
Evidence to retain
Cycle path, rejected edge, original grant and attempted action.
04 / Canonical scope
Why this reference stands alone
Depth limits bound long chains; this page owns graph acyclicity.
Technical artifact
Cycle check on a proposed edge
existing graph: O → A → B proposed edge: B → A A appears in B ancestor set result: REJECT cycle before issuing grant
Run the denial test
Hide the cycle behind a remote runtime alias for A. Resolve stable principal and grant IDs rather than comparing display names.
Primary references