Delegation registries
A registry an agency can query at the moment an agent acts, so a delegation can be checked without contacting the user, who is usually not there.
The impact of agents
The agency receiving an agent's request cannot see the delegation behind it directly, and must confirm it before acting on the request. The difficulty is reaching that confirmation at the moment of the request without contacting the user, who will often not be present when their agent acts.
What must be verified
A relying agency needs confidence that an agent's authority is current, scoped to the action at hand, and not revoked, and it must reach that confidence without contacting the user in real time. The agency running the delegation registry, on the RAM model, must keep that record current.
Protecting access
The registry itself is back-end. Its exclusion risk shows up at the front door. When creating or revoking a delegation requires a digital identity gated on biometric verification, it excludes users without reliable connectivity, users whose disability prevents biometric verification, and users who distrust the system enough to avoid it. That denial does the most harm here: a person left unable to stop their own agent.
Keeping the path open
- Offer more than one way to manage a delegation: web dashboard, phone service, in person.
- Notify by SMS or email whenever a delegation is used, created, or modified.
- Hold revocation to the lowest assurance bar the system can defend: it must always be easier to stop an agent than to start one.
Response surface
Tiered delegation roles are presented as a ranked authorization list, with per-agent revocation and a notification to the user each time a delegation is used.
TaxBot (AccountingCo Pty Ltd) is authorized to submit the 2025 tax return for M. Thongsuk. Authority expires 30 Jun 2026.
Channels: in-app + email by default, SMS on request
Routine checks batch into a digest; a first use or a scope-relevant check notifies the user at once. Every check still reaches them, without paging them each time.
Maturity
- Established
For verifying delegation through deployed registries.
- Emerging
As registries built on verifiable credentials.
- Frontier Headline
For confirming an agent's live, scoped, unrevoked authority.
Precedents
Australia's Relationship Authorisation Manager (RAM). RAM is a delegation registry operated by the ATO that links a person's digital identity, myID, to an Australian Business Number and records who may act for that business. It supports hierarchical roles of principal authority, administrator, and standard user, and serves the ATO, DEWR, and AusCheck. Authority is tied to a verified digital identity, and not to a shared username and password.
Credential Engine on trust registries for verifiable credentials. A trust framework built on W3C Verifiable Credentials issues tamper-evident proofs of authority, with issuer identity registries publishing DIDs for recognized issuers. Delegation happens through credential issuance, revocation through credential status lists, and verification without contacting the issuer in real time. The registry holds who may issue, and the credential carries what was delegated.
Agent Identity Protocol (AIP). The proposal introduces Invocation-Bound Capability Tokens that fuse identity, attenuated authorization, and provenance binding into a single append-only chain. It defines two wire formats, a signed JWT for a single hop and a Biscuit token with Datalog policies for multi-hop delegation, with transport bindings across MCP, A2A, and HTTP. The registry role is played by the token chain itself.
What carries over to agent use
RAM is the closest existing government precedent for a delegation registry, though it handles business-to-individual delegation rather than user-to-agent delegation. A government agent delegation registry would need to register agent operators (companies providing AI agent services), on the model of tax agent registration, then bind delegations to verified user identities, support real-time revocation checking, and provide delegation verification as a service to relying agencies.
AIP's token-chaining model is particularly relevant for multi-hop delegation: a user delegates to Agent A, which delegates a subset of authority to Agent B for a specific sub-task. The Datalog policy language allows attenuation, so each hop can only narrow the authority, never expand it.
The gap: no existing registry handles the "agent identity" problem. Is the delegate a company (the agent operator), a specific model version, a running instance? RAM identifies natural persons. AIP proposes cryptographic identity binding but has no production deployments.
Where things go wrong
The failure mode is an agent that keeps acting on authority the user has already withdrawn. Real-time revocation checking against a registry means a cancelled delegation stops working immediately, so stale authority cannot persist across many users. If a relying party falls back to a cached authorization when the registry is slow or unreachable, a revoked agent keeps acting for as long as that outage lasts. The check only holds when an outage is treated as a refusal, never as a pass.
Sources
6 references
The instrument, the operating deployment, or the official record itself.
Writing about the subject rather than the framework itself, including vendor commentary.