What constraints must be enforced when a subagent's delegation depth exceeds the trust boundary?

**Date of Record:** 2026 October 27 **Scope:** Applies when an orchestrating agent delegates to a subagent, which itself delegates to a sub-subagent, and so on, and the delegation chain depth exceeds the depth at which the original orchestrator's trust assumptions still hold. Does not apply to strictly flat delegation (single hop) or delegation chains where every hop preserves full trust.

Core Distinction

The separation between **delegation depth** (the number of hops in the delegation chain) and **trust attenuation** (the effective trust at each hop, which decreases as the chain grows because each intermediary may have different security posture). Relying on depth alone creates the **Trust Leakage Cascade**: deep delegations traverse agents with weaker security, and the original orchestrator's trust assumptions no longer hold at depth 4 or 5, but the orchestrator has no visibility or control.

What Was Observed

In deep delegation architectures, failing to enforce depth constraints produces three primary failure modes:

  1. **Trust Boundary Erosion:** The orchestrator delegates to Agent A (trusted), A delegates to B (semi-trusted), B delegates to C (untrusted). C produces results that flow back through A to the orchestrator, which treats them as if they came from trusted A.
  2. **Intent Dilution:** Each hop paraphrases the original intent, and by depth 4, the executed task is substantially different from what the orchestrator requested.
  3. **Attribution Loss:** The orchestrator cannot determine which hop actually produced the final result, breaking audit and accountability.

Recorded Elements

  1. **`delegation_depth_counter`:** Every delegated task carries a monotonically increasing counter that increments at each hop, allowing the orchestrator to detect excessive depth.
  2. **`trust_attenuation_factor`:** For each hop, a cryptographic proof of the hop's trust posture (security certifications, attestation, or risk classification), multiplied into an effective trust score at the terminal agent.
  3. **`intent_lineage_hash`:** The cryptographic hash of the original intent, propagated unchanged through every hop, so the terminal agent can prove its work traces back to the original orchestrator's request.
  4. **`depth_boundary_violation_receipt`:** When the depth exceeds the configured maximum, a cryptographic proof that the violation occurred, allowing the orchestrator to reject the result.

Condition of Validity

* **Applies when:** Delegation can recurse beyond one hop, the trust posture of intermediaries may differ, and the orchestrator's decisions depend on the terminal agent's trustworthiness. * **Does not apply when:** Delegation is strictly one hop (no recursive subagents), or every hop is guaranteed to preserve full trust (single security domain).

Decision Boundary

  1. **Is the delegation depth within the configured maximum?** If yes, standard delegation applies. If no, the orchestrator must reject or re-route.
  2. **Is the `trust_attenuation_factor` above the minimum acceptable threshold?** If no, the terminal agent is effectively untrusted. Reject or escalate.
  3. **Does the `intent_lineage_hash` match the original intent?** If no, the intent has been paraphrased beyond recognition. Reject or re-delegate.
  4. **Conversely, when can an orchestrator accept a deep delegation?** Only when the depth is within the maximum AND the cumulative trust attenuation is above threshold AND the intent lineage is preserved verbatim.

Operational Effect

  1. **Trust Boundary Enforcement:** Prevents orchestrators from implicitly trusting results that traversed agents they would not have delegated to directly.
  2. **Intent Preservation:** Ensures the terminal task matches the original orchestrator's request, not a paraphrased version.
  3. **Attribution Clarity:** Preserves the chain of provenance, so the orchestrator knows exactly which hop produced the result.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DepthVerdict(Enum):
    DEPTH_ACCEPTABLE = auto()
    DEPTH_EXCEEDED = auto()
    TRUST_ATTENUATED = auto()
    INTENT_DILUTED = auto()

@dataclass(frozen=True)
class DelegationHop:
    agent_id: str
    trust_attenuation_factor: float
    intent_lineage_hash: str

@dataclass(frozen=True)
class DelegationChain:
    original_intent_hash: str
    hops: tuple[DelegationHop, ...]

@dataclass(frozen=True)
class DepthPolicy:
    max_depth: int
    min_cumulative_trust: float

@dataclass(frozen=True)
class DepthManifest:
    verdict: DepthVerdict
    cumulative_trust: float
    directive: str
    manifest_digest: str

class DelegationDepthGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_chain(
        cls, chain: DelegationChain, policy: DepthPolicy
    ) -> DepthManifest:
        
        # Gate 1: Depth check
        if len(chain.hops) > policy.max_depth:
            return DepthManifest(
                verdict=DepthVerdict.DEPTH_EXCEEDED,
                cumulative_trust=0.0,
                directive=f"HALT: Depth {len(chain.hops)} > max {policy.max_depth}.",
                manifest_digest=cls._hash(f"DEPTH:{len(chain.hops)}")
            )

        # Gate 2: Intent lineage check
        for hop in chain.hops:
            if hop.intent_lineage_hash != chain.original_intent_hash:
                return DepthManifest(
                    verdict=DepthVerdict.INTENT_DILUTED,
                    cumulative_trust=0.0,
                    directive=f"HALT: Hop {hop.agent_id} diluted intent lineage.",
                    manifest_digest=cls._hash(f"DILUTED:{hop.agent_id}")
                )

        # Gate 3: Cumulative trust
        cumulative_trust = 1.0
        for hop in chain.hops:
            cumulative_trust *= hop.trust_attenuation_factor

        if cumulative_trust < policy.min_cumulative_trust:
            return DepthManifest(
                verdict=DepthVerdict.TRUST_ATTENUATED,
                cumulative_trust=cumulative_trust,
                directive=f"HALT: Cumulative trust {cumulative_trust:.3f} < {policy.min_cumulative_trust:.3f}.",
                manifest_digest=cls._hash(f"TRUST:{cumulative_trust:.3f}")
            )

        # Gate 4: Acceptable
        digest = cls._hash(json.dumps({
            "depth": str(len(chain.hops)),
            "trust": f"{cumulative_trust:.4f}",
            "intent": chain.original_intent_hash,
            "agents": tuple(h.agent_id for h in chain.hops)
        }, sort_keys=True))
        
        return DepthManifest(
            verdict=DepthVerdict.DEPTH_ACCEPTABLE,
            cumulative_trust=cumulative_trust,
            directive=f"PROCEED: Depth {len(chain.hops)} with cumulative trust {cumulative_trust:.3f}.",
            manifest_digest=digest
        )