AI Agent Delegation: Trusted Verification, Expiry, and Scope Limits

What 1-SEC checks

Delegation records require a nonempty agent/principal, a trusted verified-attestation flag, a nonempty attestation, valid future RFC3339 expiry, acceptable chain depth, and no matched escalation keywords before being marked verified. A later high-value action checks the stored record and expiry again.

Read the implementation: ValidateDelegation

Required telemetry and context

Relevant input events: agent_identity_delegation, agent_action, tool_call, function_call. Use a trusted producer at the real application boundary.

• agent_id
• delegated_by
• scopes
• expires_at
• delegation_chain
• attestation
• attestation_verified (boolean)

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Have the identity integration verify the attestation and bind it to the real principal, agent, intended operation, and expiry before producing an event. Never copy attestation_verified from untrusted model output. Keep the executor's authorization and revocation checks independent of telemetry.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestDelegationTracker_RejectsUnverifiedRecords|TestContainment_ForgedDelegationDoesNotSuppressSensitiveActionAlert)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestDelegationTracker_RejectsUnverifiedRecords(t *testing.T) {
	future := time.Now().Add(time.Hour).Format(time.RFC3339)
	for _, tt := range []struct {
		name, principal, expiry, attestation, scopes, chain string
		verified                                            bool
	}{
		{name: "missing attestation", principal: "owner", expiry: future, verified: true},
		{name: "forged attestation", principal: "owner", expiry: future, attestation: "fake-signature"},
		{name: "missing principal", expiry: future, attestation: "signature", verified: true},
		{name: "missing expiry", principal: "owner", attestation: "signature", verified: true},
		{name: "malformed expiry", principal: "owner", expiry: "never", attestation: "signature", verified: true},
		{name: "expired", principal: "owner", expiry: time.Now().Add(-time.Hour).Format(time.RFC3339), attestation: "signature", verified: true},
		{name: "broad scopes", principal: "owner", expiry: future, attestation: "signature", verified: true, scopes: "admin:*"},
		{name: "deep chain", principal: "owner", expiry: future, attestation: "signature", verified: true, chain: "owner->a->b->c"},
	} {
		t.Run(tt.name, func(t *testing.T) {
			dt := NewDelegationChainTracker()
			dt.ValidateDelegation("agent", tt.principal, tt.scopes, tt.expiry, tt.chain, tt.attestation, tt.verified)
			if valid, _ := dt.HasValidDelegation("agent"); valid {
				t.Fatal("unverified or invalid record authorized an agent")
			}
		})
	}
}

func TestContainment_ForgedDelegationDoesNotSuppressSensitiveActionAlert(t *testing.T) {
	cp := makeCapturingPipeline()
	c := startedModuleWithPipeline(t, cp)
	defer c.Stop()
	delegation := core.NewSecurityEvent("test", "agent_identity_delegation", core.SeverityInfo, "delegation")
	delegation.Details["agent_id"] = "agent"
	delegation.Details["delegated_by"] = "owner"
	delegation.Details["expires_at"] = time.Now().Add(time.Hour).Format(time.RFC3339)
	delegation.Details["attestation"] = "attacker-supplied-text"
	c.HandleEvent(delegation)
	action := core.NewSecurityEvent("test", "agent_action", core.SeverityInfo, "delete")
	action.Details["agent_id"] = "agent"
	action.Details["action"] = "delete_database"
	c.HandleEvent(action)
	if !cp.hasAlertType("delegation_verification_failed") {
		t.Fatal("forged delegation suppressed the high-value action alert")
	}
}

Tuning, evaluation, and coverage limits

The module consumes verification context; it does not independently validate an arbitrary issuer's signature or authorization graph. Scope checking is a keyword heuristic rather than a full scope-set intersection. An attacker who controls the trusted event producer can falsify the claimed context.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.