Concepts
Delegation
Delegation hands part of an authorised Intent to another actor. In ECZ-ID a delegated Intent may only narrow its parent, depth is bounded, budgets are never multiplied, and revocation cascades.
Delegation between Intents is live and operated in TrustOps, with ECZ-ID Intent. Partner (managed service provider) delegation is not yet released.
Accountability Chain:Delegation
Delegation may only narrow
A delegated Intent names its parent and carries an authorisation of kind DELEGATION_CHAIN. Core refuses, at creation, any delegation that would widen the parent’s scope. At decision time, each ancestor’s own rate and spend bounds are charged too, so a chain of delegations can never spend more than its root allows.
| Rule | How Core holds it |
|---|---|
| Whether delegation is allowed | delegation.may_delegate on the parent Intent |
| How deep | delegation.max_depth, from 0 to 4 |
| The chain | authorisation.chain, up to four {intent_id, version} ancestors |
| Budgets | Every ancestor’s rate and financial bounds are charged on each permitted action |
| Revocation | Revoking an Intent cascades to the Intents delegated from it |
Why this matters for agents
Agents hand work to other agents and tools. Without a narrowing rule, every hop can quietly widen what is permitted. With it, the deepest actor in a chain is always bounded by the narrowest authorisation above it, and the record shows the chain.
Related
This page is explanation, not authority. Current state is only ever the live Resolver record. Live facts on this page were measured read-only on 2026-10-10.