Module delegation 

Agent Delegation Protocol 1.0 types and validation helpers.

Delegation events are ordinary Agent Identity envelopes whose actor is a controller key for an HTTPS principal document.

Structs

Controller

Same type for active and retired bindings. Missing delegation means signing-only.

DelegationCredential

DelegationGrantPayload

DelegationPolicy

DelegationQueryRequest

DelegationRevokePayload

DelegationServiceDiscovery

DelegationServiceEndpoints

DelegationVerdict

Result of verify_delegation_credential.

PrincipalDescriptor

Display descriptor of a principal, used by Agent Profile delegation hints. The descriptor is open: other members are display metadata, kept in extra so a signed hint re-serializes to the bytes that were signed.

PrincipalDocument

PrincipalLink

Enums

DelegationAuthority

DelegationPayload

DelegationStatus

Constants

DELEGATION_ERROR_CODES

Delegation-specific error codes (Agent Delegation Section 9.7).

DELEGATION_GRANT

DELEGATION_REVOKE

PROTOCOL

Functions

audit_delegation_history

Auditor check (Section 8): replays every accepted record of a credential against the authoritative principal document — signatures, controller intervals, and ceilings — and confirms that the replay matches the credential. Relying parties use verify_delegation_credential instead.

controller_covers_credential

The Section 5 management rule: a restricted controller may replace, revoke, or enumerate a credential only when every scope and audience of its latest grant is within the controller’s ceiling; an unrestricted controller covers every credential of the principal.

delegation_grant_event

delegation_revoke_event

is_principal_alias

Reports whether url is an alias the principal itself acknowledges. Any origin can redirect to any principal, so an alias must not be shown as a name for the principal unless it is listed here.

materialize_delegation_credential

Materializes an already accepted event with trusted previous state and the service’s actual acceptance time. This helper does not authorize the event.

validate_audience

A relying-party audience (Section 5): an origin for a relying application, or an Agent ID for a relying agent.

validate_controller

validate_controller_enumeration

Per-result check; caller authenticates the actor and resolves the document.

validate_delegation_acceptance

Caller also enforces fresh HTTPS, live Identity replay rules, and atomic persistence.

validate_delegation_envelope

validate_delegation_event_authority

Pre-signing policy check over trusted document/state. No signature, HTTP, cache-age, live timestamp-window, or nonce verification is performed.

validate_delegation_grant_payload

validate_delegation_id

Delegation IDs are unreserved URL characters ([A-Za-z0-9._~-]{1,128}) and never a dot segment: no percent-encoding, no look-alikes.

validate_delegation_query_request

A public delegation query is an existence check and must include both subject and principal_id. Omitting either side makes it an enumeration query, which services must authorize before answering; pass allow_enumeration when building such an authorized request. limit defaults to 20; services SHOULD cap it at 100.

validate_delegation_revoke_payload

validate_delegation_use

Audience/status/time only, after signature/history checks. Caller still authenticates the subject and enforces scopes and constraints.

validate_historical_delegation

Caller authenticates the accepted record and previous state. This checks historical policy, not current status or application constraints.

validate_principal_document

validate_principal_resolution

Checks the authoritative-read rule of Agent Delegation Section 3: a principal document binds controller keys only when it is read at its own id. A document served anywhere else is a copy; its controllers must be discarded and document.id resolved instead.

verify_delegation_credential

Verifies a credential under Agent Delegation Section 8 with the online service-trusting evidence policy: checks the accepted record of its latest grant — signature, Controller binding, ceiling, and authority interval — confirms that the grant matches the credential, and then checks use for audience at now. The Section 5 management rule governs management, which the service enforced at acceptance; auditors replay it with audit_delegation_history. Relying parties still enforce scopes and constraints and authenticate the subject.

Type Aliases

DelegationEventsResponse

Agent Identity list of accepted records in service acceptance order.

DelegationQueryResponse

Agent Identity list of full credentials.

DelegationRecord