Global AI Assurance · System assurance
Agent Delegation Graph
Human identity, then machine identity, and now agent identity: an autonomous actor that can be given a mandate. The moment two of them can instruct each other, the institution has a new failure mode that no single permission set describes.
The delegation graph evaluates the chain, not the actors, and refuses combinations that assemble an authority nobody was granted.
Published as reference architecture. Control weights, grading rubrics and the full control set are set per engagement.
Principle
Authority is not transitive. An agent may only delegate what it holds, only to an accepted originator, and never in a combination that assembles an authority no single actor was granted.
One chain, evaluated
A research agent asks a treasury agent to execute. Neither agent is misbehaving. The chain is the problem.
Who authorised this agent, and for what purpose?
Authorised for market and counterparty research. Read-only data classes. No financial authority.
Does it hold delegation authority at all?
Delegation permitted to analysis tools only. Delegation to actioning agents is not in the envelope.
May it accept an instruction from this originator?
Treasury agent accepts instructions from the payments workflow and from two named human roles. A research agent is not an accepted originator.
Does the combined chain create privilege escalation?
Yes. Neither agent holds the authority alone; the chain would have assembled read access plus payment execution without a human in either envelope.
What is written down?
The refusal is the evidence: originator, target, requested action, envelope consulted, decision, latency, and the human notified.
The refusal is the evidence
An institution cannot prove an agent behaved by showing that nothing happened. It proves it by showing the request, the envelope consulted, the decision, the latency and the person notified. Refusals are recorded on the same terms as permitted actions.
Authority answers what the agent may do. Jurisdiction answers whether the activity may happen at all.
Resolve which rules apply