EcoCitizenZ
← All Starter Kits
Intermediate1 hourAnthropic Claude · Python

Claude Subagent Starter

Fast Start

What you will have in minutes

A locally running, ECZ-ID-backed agent scaffold with resolver-verifiable identity hooks, a credential manifest, and Resolver verification ready to run.

What you do first — in order

1Get starter scaffold2Install dependencies3Go to TrustOps /start4Paste credentials5Run locally6Verify via Resolver7Deploy into your environment

What comes back from TrustOps

  • Agent ECZ-ID(s)
  • Credential manifest (JSON, discovery only)
  • API keys issued in TrustOps

Success looks like

Resolver returns a resolver-verifiable state for your Agent ECZ-ID. You can share it with any party without an account.

1What This Kit Builds

A hierarchical multi-agent system where a primary Claude agent delegates tasks to verified subagents, each carrying their own ECZ-ID credentials. The delegation chain maintains provenance and accountability across every handoff, producing a commercially legible multi-agent architecture.

2Who It Is For

Development teams building complex AI workflows requiring multiple specialised agents. Ideal for enterprises deploying multi-agent systems where each agent in the chain must be independently verifiable and the complete delegation chain must be auditable.

3Why ECZ-ID Matters Here

In a multi-agent system, trust breaks down at delegation points. ECZ-ID ensures every subagent carries resolver-verifiable credentials, every delegation is evidence-linked, and the complete provenance chain is resolver-verifiable. Without this, multi-agent systems are black boxes.

4Architecture

Primary Agent Controller

The orchestrating Claude agent that manages task delegation, response aggregation, and decision synthesis.

Subagent Registry

Manages subagent identities, capabilities, and delegation permissions through ECZ-ID credential propagation.

Delegation Chain Tracker

Maintains cryptographic delegation chains linking every subagent action back to the primary agent.

Credential Propagation

Automatically propagates scoped credentials to subagents with time-bounded, capability-limited delegation.

Provenance Aggregator

Collects and aggregates provenance records from all subagents into a unified, verifiable audit trail.

Trust Context Bridge

Passes resolver-verifiable identity context across agent boundaries while maintaining isolation between subagent scopes.

5Build Steps Overview

1
Clone the subagent starter repository
Pull the Claude Subagent Starter template with hierarchical agent scaffolding.
2
Install dependencies
Install the Anthropic SDK, ECZ-ID SDK, and delegation chain management libraries.
3
Configure primary agent
Set up the primary orchestrator agent with Claude API access and delegation policies.
4
Define subagent roles
Specify subagent specialisations, capability boundaries, and delegation permissions.
5
Review delegation patterns
Understand the credential propagation model before acquiring credentials.

Trust Map

Required Passports
ECZ-ID Business PassportAgent Credential
Recommended Passports
API PassportAI Model PassportSoftware Supply Chain Passport
Relevant Packages
KYA Ready Pack™AI Provenance Pack
What Each Enables
ECZ-ID Business Passport: Organisational root identity for the entire agent hierarchy
Agent Credential (Primary): Verified orchestrator identity with delegation authority
Agent Credential (Subagents): Independent resolver-verifiable identities for each specialised subagent
AI Model Passport: Verification of underlying model provenance and capabilities

6TrustOps Credentialing Checkpoint

TrustOps Credentialing Checkpoint

Pause here to acquire your required ECZ-ID trust objects

This is a designed pause point in your build process. Before continuing, you need to acquire the required ECZ-ID passports and credentials from TrustOps. This midpoint credentialing approach ensures your agent is built with resolver-verifiable identity from the start—not bolted on after the fact.

Required Passports

  • ECZ-ID Business Passport
  • Agent Credential

Recommended Passports

  • API Passport
  • AI Model Passport
  • Software Supply Chain Passport

Relevant Packages

KYA Ready Pack™AI Provenance Pack

What You Must Acquire in TrustOps

ECZ-ID Business Passport
Enables: Parent identity anchoring all agent credentials in your organisation
Agent Credential (Primary)
Enables: Resolver-verifiable identity for the primary orchestrator agent
Agent Credential (Subagents)
Enables: Individual resolver-verifiable identities for each subagent in the hierarchy
AI Model Passport (recommended)
Enables: Verification of the underlying model provenance and capabilities

What You Bring Back from TrustOps

Primary Agent ECZ-ID
The orchestrator agent’s resolver-verifiable identity string
Subagent ECZ-IDs
Individual identity strings for each subagent
Delegation Policy Manifest
JSON configuration defining delegation boundaries and permissions
API Keys
Production ECZ-ID API keys for the agent hierarchy
Continue in TrustOpsView Required ECZ-ID Package

9Return and Complete Integration

With your TrustOps credentials in hand, return here to complete the final build steps.

1
Configure primary agent credentials
Inject the primary agent ECZ-ID and API keys into the orchestrator configuration.
2
Register subagent identities
Configure each subagent with its individual ECZ-ID and delegation permissions.
3
Wire delegation chain tracking
Enable cryptographic delegation chain logging across all agent handoffs.
4
Test delegation flows
Validate that delegation chains are correctly formed and verifiable in sandbox.
5
Verify provenance aggregation
Confirm the complete delegation chain resolves correctly through Resolver.

10Verify Through Resolver

Verify primary agent

Query the primary agent’s ECZ-ID through Resolver to confirm identity and capabilities.

Verify subagent chain

Trace any subagent action through the delegation chain back to the primary agent.

Audit delegation boundaries

Verify that subagents operate within their attested capability boundaries.

Check aggregate state

Review resolver state signals for the complete agent hierarchy.

Verify with Resolver

11Deploy Into Your Environment

ECZ-ID-backed agents are portable. Your resolver-verifiable identity travels with your agent regardless of deployment target after TrustOps and Resolver checks. No vendor lock-in.

AWS ECS / Fargate
Google Cloud Run / GKE
Azure Container Apps / AKS
Self-hosted Docker Compose
Kubernetes with service mesh
Hybrid cloud deployments

12Limits & Non-Claims

  • This kit does not provision ECZ-ID credentials. Each agent identity must be acquired through TrustOps.
  • This kit does not simulate delegation. Real delegation chains require real credentials.
  • This kit does not guarantee subagent behaviour. Identity verification is separate from functional correctness.
  • Delegation chains have configurable depth limits set during TrustOps provisioning.
  • Resolver state signals for subagents are independent from the primary agent’s resolver state.

Ready to Build This Agent?

Start with the build steps above, credential through TrustOps, and deploy your resolver-verifiable agent anywhere.

Continue in TrustOpsView All Starter Kits