delego is a deterministic pre-action authorization layer for AI agents: it
sits between an agent that proposes actions and the credential broker that
executes them, and answers, for each action, allow / needs_approval / deny
— with no language model in the decision path, before any credential is used,
bound to the originating human instruction and the exact action, and recorded in
a tamper-evident, signed audit chain. It addresses the agent-authorization gap
catalogued as OWASP ASI03 (Excessive Agency).
This repository is the source of truth for the protocol. The reference implementation is delego.
Credential brokers ensure an agent never holds a raw secret — but they can't tell whether this specific action is the thing the human authorized. So a prompt injection can redirect an in-scope, validly-credentialed action: the confused deputy. delego is the Policy Decision Point (PDP) that authorizes the action against a deterministic policy before any credential is used, binds it to the human instruction, requires human approval for sensitive actions, and writes a signed, hash-chained audit trail; the credential broker is the Policy Enforcement Point (PEP) and the only component that ever touches a credential. ("Firewall" is sometimes used as a loose analogy for this — but delego is an action-authorization layer, not a network firewall; see §11.)
This specification exists so that independent authorizers, brokers, and auditors — written by different people, in different languages — agree byte-for-byte.
📜 spec.md — the normative protocol.
- Canonicalization
- Proposed Action & hashing
- Policy & decisions
- Approval binding — the confused-deputy guard
- Authorization properties (P1–P4)
- Receipt & audit chain
- Authorization Token
| Component | What it is |
|---|---|
| Specification | This document — the protocol. |
| Schemas | JSON Schemas for the policy, the audit receipt, the authorization token, and the 0.4-draft approval-callback and separated-gateway contracts. |
| Conformance Test Kit | Language-agnostic vectors any implementation can check itself against. |
| delego | The reference implementation (Python) — policy engine, CLI, and MCP server. |
Planned (open source): broker adapters that verify authorization tokens, and language SDKs. Contributions welcome.
The Conformance Test Kit ships authoritative vectors generated by the reference implementation — action → hashes, policy + action → decision, and signed chains (valid and tampered). A conformant implementation MUST reproduce them; see §10 Conformance.
v0.4 — draft. The spec/protocol is versioned 0.x (the reference package
is 0.x.y). 0.1–0.3 are reference-backed — the reference implements 0.3
(delego ≥ 0.3.0; the §9 token profile since 0.3.3); each prior protocol version
has a standalone document of record in versions/
(0.1, 0.2). 0.3 added additive
hardening (the §4.2 Broker query obligation, policy-schema validation §5.1, the
authorization properties P1–P4 §7.1, head-anchoring §8.3, the authorization-token
profile §9) plus one breaking change (folding the canonicalized URL query into
the action_fingerprint preimage, §4.2, reference-backed since delego 0.3.0).
0.4 (draft) is adoption-first and entirely additive on the 0.3 preimage
(draft — not yet in the reference): a Broker-interface / separated-gateway
contract (§2.2), approval lifecycle & routing metadata (§7.2), an approval
notification & callback protocol that takes the human decision out of the
local console (§7.3), and an optional unsigned receipt context for
correlation (§8.4). The one breaking item considered for 0.4 — folding request
headers/body into the fingerprint — is deferred to avoid a re-integration
tax. See the §2.1 version matrix. A breaking
change to the receipt fields bumps the version (see
§8.2).
See CONTRIBUTING.md. By participating you agree to the Code of Conduct. Propose changes by opening an issue or a pull request; a change to a NORMATIVE section should come with updated CTK vectors.