Delegations
A delegation answers the third question: who allowed this? It is a scoped grant of authority from one Passport to another — a human authorizing an agent, an org authorizing a member, an agent sub-delegating a narrow slice of what it was given.
The model
| Property | What it means |
|---|---|
| Grantor / grantee | Both are Passports. Authority flows between identities, never to anonymous processes |
| Scopes | What the grantee may do — resource and action, specific rather than blanket (workflows:execute, not admin) |
| Constraints | Conditions on the grant: spend ceilings, environment restrictions, approval requirements |
| Expiry | Delegations carry an expiry (expires_at) and tokens are minted with one — authority is designed to end, not to stand forever |
| Revocation | The grantor can revoke at any time; enforcement picks it up at the next call |
Checked at call time, not at login
The delegation model differs from session-based auth in one load-bearing way: authority is evaluated when the call happens, not when a session started. An agent holding a delegation token does not get a blanket pass — HumanOS checks the scope of each call against the grant, every time. Revoke the delegation and the very next call fails, mid-session or not.
This is also what makes agent authority legible after the fact: the Ledger records not just that an agent acted, but under whose delegation and within which scope. "The agent did it" is never the end of the audit trail — there is always a human or org grant at the root.
Minimal necessary authority
The intended pattern is narrow grants that expire soon, renewed when genuinely needed — not wide grants renewed by default. The SDK and Console both push in that direction: scope pickers over admin toggles, expiry defaults over forever, sub-delegation that can only narrow, never widen.
Work with delegations
- Design guide: Delegation scope design — choosing scopes that survive contact with production
- Patterns: HumanOS patterns — delegation checks in the call path
- Product view: Governance shows delegation approval and revocation flows in the Console
Next in the ladder: HumanOS →