Bound authority at every handoff.
The method requires least privilege, explicit delegation and reviewable evidence. Runtime integrations are responsible for enforcing those requirements.
Design controls.
- Keep identity distinct from the underlying model.
- Limit child authority to the approved delegation.
- Bound depth, parallelism, time, cost and tool access.
- Require policy approval for production actions and authority changes.
- Validate outputs and preserve evidence before integration.
Implementation boundary.
The reference policy demonstrates a subset of these checks. Production adoption needs sandboxing, filesystem scope enforcement, runtime metering, durable audit storage, timeout handling and review of denied actions.
Evaluate these controls in your deployment environment; the source package is not a security certification.
Threat model and trust boundaries.
Protected assets include repository integrity, credentials, external systems, budgets and evidence. Trust boundaries separate user intent, model output, repository content, delegated agents, the host authorizer, tools and durable audit storage. The following are design controls to implement and test in the host; the demo does not enforce the complete model.
| Threat | Failure mode | Control to validate |
|---|---|---|
| Prompt injection | Tool output or repository text tries to redirect an agent. | Treat external content as data; authorize actions independently of model text. |
| Context poisoning | A handoff supplies false goals, approvals or results. | Validate provenance, scope and evidence before resuming. |
| Impersonation | An agent claims a trusted role or parent identity. | Bind identities to host authentication and verified delegation records. |
| Privilege escalation | A child requests tools or paths beyond its contract. | Intersect delegated permissions with host policy; reject self-escalation. |
| Scope confusion | A task crosses another feature owner’s boundary. | Enforce path and resource boundaries; require cross-feature review. |
| Recursive delegation | Repeated spawning exhausts time, cost or workers. | Meter depth, concurrency and runtime; enforce termination. |
| Audit manipulation | Actions or outcomes are omitted or rewritten. | Use durable append-only audit storage with access controls. |
| Tool abuse | An authorized tool performs unintended external effects. | Mediate side effects; require approval for consequential operations. |
| Stale state | Old ownership or policy records drive new decisions. | Version state and verify freshness before authorization. |
| Root or Feature compromise | A coordinator misuses its authority across its governed scope. | Constrain coordinator privileges and use independent approval and revocation. |