Delegation without losing the thread.
When agents call agents, the AASG (Agentic AI Security Gateway) identifies each link, authorizes each delegated call, records the chain, and holds what needs a person.
Built · bounded scope Implemented session and delegation controls, subject to configured routes, policy, and provider limits.
- depth 0 planner
- depth 1 researcher
- depth 2 summarizer
- depth 3 archiver
depth ≤ 3child ≤ parent
The graph is an illustrative demo from the Acme Bank demo workspace, not live product telemetry.
Try it: one chain, five scenarios
A planner delegates ledger work down a chain. Pick a scenario to see how scope, taint, and depth decide each hop. The example deliberately uses a 3-hop limit; the shared session code has a hard cap of 5. Scope names are illustrative tool names, not a wildcard permission language.
Scenario
Delegation chain: planner to researcher to summarizer to archiver, plus a writer side branch
Four agents with granted scopes, an offsite-backup hop past the depth limit, and a side branch where a writer requests a wider scope. The scenario buttons highlight each fate; the verdict below states the decision in text.
- depth 0 planner ledger/read + ledger/archive
- depth 1 researcher ledger/read
- depth 2 summarizer ledger/read
- depth 3 archiver ledger/read
- hop 4 · over limit offsite-backup ledger/read
- branch from planner writer asks ledger/admin
- Scope check
- researcher asks
ledger/read, inside parentledger/read + ledger/archive— narrowing only, allowed. - Taint
- no tainted data crosses a boundary on this hop.
- Depth
- hop 1 of 3 — inside the limit.
Allowed. Narrow delegation planner → researcher runs, recorded with the granted scope.
The same chain in text: planner (ledger/read + ledger/archive) → researcher (ledger/read) → summarizer (ledger/read) → archiver (ledger/read); writer requests ledger/admin; offsite-backup would be hop 4.
The mechanics, each labelled honestly
| Mechanic | Rule | Status |
|---|---|---|
| Delegation chains | Each hop is authenticated and recorded with parent, child, and granted scope. | Built |
| Depth limits | Chains are bounded; a hop past the limit is stopped, never silently allowed. | Built |
| Child ≤ parent scope | A child scope narrows only; widening requests are denied. | Built |
| Taint labels | Session labels are inherited and additive; labels inform policy rather than automatically blocking every transfer. | Built |
| Action contracts | Each delegation declares the actions it may take; anything else is denied. | Built |
| Credential broker | GitHub App installation tokens on configured broker paths; other providers are not implemented by this broker. | Built |
| Kill switch | Block later governed checks and request credential revocation; cannot undo an already-running external action. | Built |
These controls are implemented for verified sessions. Tool allowlists and denylists, risk, call limits, approval requirements, and expiry constrain child contracts. Token and cost limits are bounded per child against the parent remainder; aggregate sibling token/cost reservations are not enforced by this helper. Policy must explicitly use taint to restrict a transfer.
Credential broker: reduce agent-held permanent secrets
The implemented broker mints GitHub App installation tokens for configured tenant-owned installations. Local TTL and provider expiry are tracked separately; shortening local validity does not necessarily expire the upstream token immediately. Revocation can fail and require retry. Bootstrap app credentials still require secure storage.
-
extremely common
OWASP's list of non-human identity risks rates long-lived secrets, such as keys and tokens that never expire, as widespread.
Long-Lived Secrets are extremely common in modern environments.
Source: OWASP Non-Human Identities Top 10, retrieved
-
94 days
Verizon's 2025 breach report puts the median time to fix a secret leaked on GitHub at 94 days.
Figure 13 gives us an idea of the exposure window, where the median time to remediate discovered leaked secrets on a GitHub repository is 94 days, courtesy of one of our data contributors.
Source: Verizon, Data Breach Investigations Report, retrieved
Action contracts and taint, in one example
The researcher delegates summarising with a contract: read(ledger) only, no
external calls. The ledger rows carry a contains_customer_data taint label. When the
summarizer tries to forward those rows to an outside endpoint, two rules fire at once: the
call is outside the contract. Taint labels can trigger a deny or approval under matching policy; they do not automatically prohibit every boundary crossing.
The label stays on the data either way — a downstream hop cannot strip it.
Next
- Policy engine — the rules every hop is checked against.
- Evidence and receipts — chains recorded per hop.
- AASG gateway — identity and approvals behind delegation.
- Contact — talk through a multi-agent pilot.
Ghalta is in early development: this page describes a problem and an approach, not a finished product.