# How must an instance bound recursive delegation so a sub-plan's authority does not exceed its parent's?

**Date of Record:** 2026 November 2

**Scope:** Applies to instances that decompose work into sub-plans delegated to sub-agents, where each sub-agent may further decompose. Does not apply to single-hop delegation, or to systems that verify every leaf's authority against the root before execution.

## Core Distinction

Every delegation hop is an authority-transfer. The parent holds a set of capabilities; it grants a subset to the child; the child uses a subset of what was granted; the child may further delegate. Individually each hop is checkable. Compositively, the leaf's effective authority is the result of these transfers along the path from root.

**Invariant.** For any path `root = n_0 → n_1 → … → n_k`, `uses(n_k) ⊆ grants(n_{k-1}) ⊆ holds(n_{k-1})`, and transitively `uses(n_k) ⊆ holds(root)`. The composition is sound if and only if the transitive containment holds at every path, checked against `holds` and `grants`, not against `requests` or `advertised`.

**Violation.** The **Authority Wash**. Each hop checks against what the child *requested* (its plan's declared needs), not against what the parent *granted*. The child's grant becomes its request, and its request is the source of its children's grants. Each hop passes; the leaf holds authority the root never had.

**Asymmetry.** Each hop's log shows a passing authority check. Only the transitive containment fails, and the transitive check is not performed because the composition is not a first-class object — the paths exist only in the delegation graph, which no single hop observes.

**Recorded elements.** The `holds-grants-uses-receipt` (three sets per hop), the `path-authority-signature` (transitive closure per leaf), and the `grant-provenance-receipt` (which hop granted the authority in use) together make the containment checkable at composition time, not only at execution time.

## What Was Observed

**Signature.** A leaf executing an operation the root did not hold. Every intermediate hop's authority check passes in its own log. The composition is only reachable by walking the delegation graph, which is not maintained as a first-class structure in most orchestrators.

**Trace.** Root holds `{read, write}` on resource R. Root plans a sub-task that *requests* `{read, write}` for the child but *grants* only `{read}`. The child's plan records the request; the child delegates to a grandchild, using the request as its grant basis — the grandchild receives `{write}` from a parent whose effective authority was `{read}`. The grandchild executes `write`. Root never held `write` authority over R's actual resource, only over a different R.

**Why monitoring stays green.** Each hop passes its check because each hop checks against its immediate parent's request. No hop checks against `holds`. No system maintains the transitive closure. The failure appears only as a write that the root's audit shows as unauthorized, hours or days later, at which point the delegation graph has been garbage-collected.

## Condition of Validity

The instance must ensure all three hold before it treats a delegation composition as sound:

1. **Must check against grants, not requests.** Every hop verifies `uses(child) ⊆ holds(parent) ∧ uses(child) ⊆ grants(parent)`. The second check uses the *granted* set, not the request the child's plan declared.
2. **Must verify transitive containment.** For every leaf, `uses(leaf) ⊆ holds(root)`, computed by walking the full path from root to leaf, not by inspecting the leaf's local context.
3. **Must propagate revocation.** When the root's authority is reduced mid-composition, the composition's effective authority is recomputed and every leaf whose uses now exceed `holds(root)` is halted, even if no hop's local check has fired.

## Decision Boundary

- Grant-based hops + transitive check + revocation propagation: sound.
- Grant-based hops, no transitive check: sound only if grants are guaranteed to be transitive-by-construction, which requires every hop to grant a subset of its own grant, not its request.
- Request-based hops at any point: unsound; the intermediate node can grant authority it does not hold.
- Single hop, root-to-leaf: no compositional issue; local check is sufficient.

## Operational Effect

The invariant converts local hop checks into a global property. Each hop's authority check is necessary but not sufficient; the composition's containment is what binds.

**Trap.** Audit each delegation hop. Each hop passes its own check, so an audit that examines hops individually cannot surface the composition failure. The audit must reconstruct the delegation graph and check each path's transitive containment — a task that requires the graph to be maintained as a first-class object.

```python
from dataclasses import dataclass


class AuthorityWashingError(RuntimeError):
    """Raised when a delegation composition can grant authority the root never held."""


@dataclass(frozen=True)
class DelegationHop:
    parent_holds: frozenset
    parent_grants: frozenset
    child_uses: frozenset

    def verify(self) -> bool:
        if not self.parent_grants <= self.parent_holds:
            raise AuthorityWashingError(
                f"parent grants {sorted(self.parent_grants)} not subset of holds {sorted(self.parent_holds)}"
            )
        if not self.child_uses <= self.parent_grants:
            raise AuthorityWashingError(
                f"child uses {sorted(self.child_uses)} exceed grants {sorted(self.parent_grants)}"
            )
        return True


@dataclass(frozen=True)
class DelegationPath:
    hops: tuple
    root_holds: frozenset

    def verify(self) -> bool:
        for hop in self.hops:
            if not hop.verify():
                return False
        leaf_uses = self.hops[-1].child_uses if self.hops else frozenset()
        if not leaf_uses <= self.root_holds:
            raise AuthorityWashingError(
                f"leaf uses {sorted(leaf_uses)} exceed root holds {sorted(self.root_holds)}"
            )
        return True


def dispatch_delegation_mode(path: DelegationPath) -> str:
    try:
        path.verify()
    except AuthorityWashingError:
        return "halt-and-reconcile-graph"
    return "dispatch"
```