feat(ca2a-delegation): add agent-to-agent delegation example#56
Merged
Conversation
Add a new example demonstrating the cA2A agent-to-agent boundary, the layer above the cMCP agent-to-tool boundary the other examples show. - A three-hop credit delegation chain (credit-platform -> lead-credit-agent -> screening-sub-agent -> bureau-connector) built with ca2a-runtime. The authority to write the risk report is granted to the lead agent but withheld from every delegated scope, so attenuation alone guarantees no sub-agent can regain it (separation of duties by credential). - The demo verifies the valid chain, then shows a sub-agent trying to widen its scope and being rejected with SCOPE_ESCALATION. Both chains are also verifiable via `ca2a verify-chain`. - README maps the same pattern onto healthcare, multi-tenant-saas and industrial-embodied-ai, and is explicit that only attenuated delegation and offline verification run today; the live peer path and sealed channel are cA2A roadmap. - Pure delegation_scenario module + unit tests and a CI job. Cross-linked from the startup-tpm next-steps table and the root README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a new
ca2a-delegation/example demonstrating the agent-to-agent boundary with cA2A. The other examples govern the agent-to-tool boundary (cMCP decides what one agent may call); this one governs what one agent may hand to another, with each delegation hop's scope a provable subset of its parent.The scenario
The credit-risk workflow decomposed across three agents:
credit-platform → lead-credit-agent → screening-sub-agent → bureau-connector. The authority to write the risk report is granted to the lead agent but deliberately never delegated onward, so attenuation alone guarantees no sub-agent can regain it. That's separation of duties enforced by the credential, not by convention.The demo verifies the valid chain, then shows the bureau connector trying to grant itself
write:risk-reportand being rejected withSCOPE_ESCALATION. Both chains are also verifiable viaca2a verify-chain.Honesty about scope
cA2A is alpha. This example exercises only what runs today — attenuated delegation credentials and offline chain verification (
ca2a_runtime.delegation). The live peer path (attesting an inbound peer, sealing the payload to its measurement) and the per-hop TRACE provenance record are cA2A roadmap, and the README says so.Also in this PR
pip install --pre ca2a-runtime, run tests + demo). Not added tosmoke.yml(no server/gateway).Verification
python -m unittest discover -s tests -v→ 6 passpython delegation_agent.pyruns clean and exits 0ca2a verify-chainreturnsverified: truefor the chain andSCOPE_ESCALATIONfor the tampered one🤖 Generated with Claude Code