01 / The operating case
What changes in a real workflow?
An agent proposes rotating a production signing key.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Verify two distinct authorized approvers, bind both to the same request digest, then recheck current policy before key rotation.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The same person signs twice or the agent alters key target after approval.
Evidence to retain
Distinct approver IDs, canonical request, signatures, expiry and key-management outcome.
04 / Canonical scope
Why this reference stands alone
Delegated approval determines who can review; multi-party approval owns quorum and independence.
Technical artifact
Quorum over one immutable proposal
request hash H: rotate key K7 in production approver U9: H at 14:01 approver U10: H at 14:03 quorum=2 distinct authorized people agent changes key to K8 → H differs → DENY
Run the denial test
Submit two approvals from the same account or bind the second to a changed target. Neither case satisfies an independent two-person quorum.
Primary references