Verify who delegated what to each agent¶
cA2A adds signed delegation credentials, peer appraisal, sealed channels, and linked provenance to agent-to-agent communication. A verifier checks who issued a grant and whether each child stays within its parent's authority.
Verify your first delegation chain See the runtime boundaries
The first example runs locally with Python 3.11+. It verifies a narrowed grant and rejects both an untrusted issuer and signed scope escalation. No hardware or running peer is needed.
The gap it closes¶
An agent identity does not by itself establish delegation authority. When A delegates to B and B delegates to C, the relying party needs to authenticate the root and check each grant. Live calls also need caller authentication, local policy, and any required runtime appraisal.
The four primitives¶
| Mechanism | What to check | Start here |
|---|---|---|
| Delegation credentials | Trusted root, signatures, continuity, bounded scope and depth | Offline quickstart |
| Runtime appraisal | Evidence and measurements required by the relying party | Attestation |
| Sealed peer channel | Payload encryption to the appraised peer key | Sealed channel |
| Linked provenance | Record signatures and parent links | TRACE A2A profile |
Software and hardware modes provide different assurance. Peer appraisal has been demonstrated one-directionally; mutual simultaneous hardware attestation remains outstanding. Read Limitations before relying on a hardware claim.
Where to start¶
-
Run it
Verify a delegation chain offline, then stand up the live peer runtime.
-
Understand it
The architecture, the trust boundaries, and how a hop becomes a provenance record.
-
Read the profile
The normative cA2A profile on A2A, with the delegation chain, sealed channel, and conformance rules.
-
Check the bounds
What has run against real silicon, what is one-directional, and what is not appraised at all.
How it fits the rest of the stack¶
cA2A is the delegation layer of the AgenTrust chain. Agent Manifest declares what an agent is and what it may do, and supplies the attenuated delegation credential. cMCP enforces policy at the agent-to-tool boundary and shares the TEE provider abstraction. TRACE is the evidence format each hop's provenance record is written in.