1What This Kit Builds
A hierarchical multi-agent system where a primary Claude agent delegates tasks to verified subagents, each carrying their own ECZ-ID credentials. The delegation chain maintains provenance and accountability across every handoff, producing a commercially legible multi-agent architecture.
2Who It Is For
Development teams building complex AI workflows requiring multiple specialised agents. Ideal for enterprises deploying multi-agent systems where each agent in the chain must be independently verifiable and the complete delegation chain must be auditable.
3Why ECZ-ID Matters Here
In a multi-agent system, trust breaks down at delegation points. ECZ-ID ensures every subagent carries verified credentials, every delegation is attested, and the complete provenance chain is resolver-verifiable. Without this, multi-agent systems are black boxes.
4Architecture
Primary Agent Controller
The orchestrating Claude agent that manages task delegation, response aggregation, and decision synthesis.
Subagent Registry
Manages subagent identities, capabilities, and delegation permissions through ECZ-ID credential propagation.
Delegation Chain Tracker
Maintains cryptographic delegation chains linking every subagent action back to the primary agent.
Credential Propagation
Automatically propagates scoped credentials to subagents with time-bounded, capability-limited delegation.
Provenance Aggregator
Collects and aggregates provenance records from all subagents into a unified, verifiable audit trail.
Trust Context Bridge
Passes verified identity context across agent boundaries while maintaining isolation between subagent scopes.
5Build Steps Overview
Trust Map
Required Passports
Recommended Passports
Relevant Packages
What Each Enables
6TrustOps Credentialing Checkpoint
TrustOps Credentialing Checkpoint
Pause here to acquire your required ECZ-ID trust objects
This is a designed pause point in your build process. Before continuing, you need to acquire the required ECZ-ID passports and credentials from TrustOps. This midpoint credentialing approach ensures your agent is built with verified identity from the start—not bolted on after the fact.
Required Passports
- ECZ-ID Business Passport
- Agent Credential
Recommended Passports
- API Passport
- AI Model Passport
- Software Supply Chain Passport
Relevant Packages
What You Must Acquire in TrustOps
What You Bring Back from TrustOps
9Return and Complete Integration
With your TrustOps credentials in hand, return here to complete the final build steps.
10Verify Through Resolver
Verify primary agent
Query the primary agent’s ECZ-ID through Resolver to confirm identity and capabilities.
Verify subagent chain
Trace any subagent action through the delegation chain back to the primary agent.
Audit delegation boundaries
Verify that subagents operate within their attested capability boundaries.
Check aggregate trust
Review the trust scores for the complete agent hierarchy.
11Deploy Anywhere
ECZ-ID-backed agents are portable. Your verified identity travels with your agent regardless of deployment target. No vendor lock-in.
12Limits & Non-Claims
- This kit does not provision ECZ-ID credentials. Each agent identity must be acquired through TrustOps.
- This kit does not simulate delegation. Real delegation chains require real credentials.
- This kit does not guarantee subagent behaviour. Identity verification is separate from functional correctness.
- Delegation chains have configurable depth limits set during TrustOps provisioning.
- Trust scores for subagents are independent from the primary agent’s trust score.
Ready to Build This Agent?
Start with the build steps above, credential through TrustOps, and deploy your resolver-verifiable agent anywhere.