Delegation chain

A delegation chain is the auditable path from an acting agent back to the human who authorized it, through every intermediate delegation. It is the accountability structure agentic systems need: any action can be traced to a verified principal, and compromise of that principal's identity gives a precise blast radius, everything downstream of them in the chain.

The chain is what makes revocation computable. Without it, disabling a compromised human account leaves the agents acting on that account's behalf running, because nothing records the relationship; with it, the set to invalidate is everything downstream of the compromised node.

It is also the structure an auditor asks for, since a chain answers who authorized this in one traversal rather than by correlating logs across systems.

The chain is what makes revocation computable rather than approximate. Without it, disabling a compromised human account leaves every agent acting on that account's behalf running, because no record connects them; with it, the set to invalidate is a traversal, and the blast radius of a compromise is a query rather than an estimate.

Depth is where the design gets interesting, because an agent that delegates to a sub-agent extends the chain and must not be able to extend the authority. Scope has to narrow or stay equal at each hop, never widen, and that invariant has to be enforced at minting time rather than checked afterwards, since an audit that finds a widened grant finds it after it has been used.

The chain is also what an auditor asks for, and supplying it as a structure rather than as correlated logs is the difference between answering the question and reconstructing an answer. Each link needs the principal, the scope, the time it was granted and the condition that ends it, which is the same record a just-in-time capability token produces by construction.

It is also the structure a revocation cascade traverses to find everything a compromised principal reached.