Multi-agent security
Delegation multiplies authority.Decide every hop on its own credential.
When agents delegate to agents, the question is no longer what one identity may do but what a chain of identities may do together. Trustivan does not evaluate chains: no provider reports an agent-to-agent relationship, and inventing one would be fabricated evidence. What it does is decide every action on the credential the acting agent presents, so no agent can claim another's identity and every hop answers for its action with its own entitlements.
Not builtAgent-to-agent chain evaluation, by design · per-action runtime authorization is available
- planner-agenttickets · read
- coding-agentrepos · write
- deploy-agentprod · deploy
prod deploy on behalf of a read-only planner: NOTHING DECIDES
- planner-agenttickets · read
- coding-agentrepos · write
- deploy-agentprod · deploy
prod deploy on a high-impact resource, no live grant: CHALLENGE
The problem
Four ways a chain of agents fails
Each failure has the same shape: authority that was appropriate for one agent becomes available to a request that should never have had it.
Confused Deputy
A high-authority agent does work for a low-authority requester and spends its own permissions on their behalf
Delegation Abuse
An agent cannot do something, so it asks an agent that can, and the chain launders the request
Recursive Tool Abuse
Agents calling agents calling tools, with no depth limit, until a loop exhausts budget or reaches production
Cascading Failures
One poisoned input propagates through every downstream agent that trusts the upstream output
The model
What each hop carries, and what it cannot
A delegated request is not a fresh request. Trustivan decides each hop on what it can prove about that hop, and records no chain it cannot observe.
See how agent identity worksNot builtChain evaluation, by design · per-hop authorization is available
Acting Identity
The principal is resolved from the credential presented at every call, never from the request body, so no hop can claim to be another agent
Purpose
The stated intent is recorded with every decision for the investigator. No rule decides on it, because it is exactly what an attacker writes
Authority Ceiling
Each hop is bounded by its own entitlements, grants and autonomy. Intersecting authority across a chain is not built, by design: no chain is recorded to intersect
Delegation Findings
Where a provider reports an agent acting on behalf of another agent, that is a finding. No connector reports one today
How it works today
Resolve. Entitle. Decide. Record.
The same authorization question asked at every hop, on the facts of that hop alone.
Resolve
Each agent runtime presents its own credential, and the gate resolves the acting principal from it rather than from anything in the request.
Entitle
Each hop is judged against its own declared tool entitlements, the tool's effect, the resource's impact and the agent's declared autonomy.
Decide
A high-impact, administrative or unsupervised mutating action returns CHALLENGE unless a live grant covers it; a quarantined agent is denied every action.
Record
Every decision is written immutably with the acting identity, the rules that fired and the stated intent, so each hop is explainable even though no chain is reconstructed.
What you get today
What multi-agent security looks like today
The per-hop guarantees the built gate provides, and the chain guarantees it deliberately does not claim.
No Invented Trust Map
The graph has no agent-to-agent edge, by design: a trust map drawn from guesses would be fabricated evidence
No Identity By Proxy
An agent cannot act as another agent: the principal comes from the credential presented, never from the request
Invocation Ceilings
An operator-set ceiling on how often an agent invokes in a window, raised as a finding when ingested activity exceeds it
Challenged Downstream Actions
A poisoned upstream output can make a downstream agent request anything; a mutating call on a high-impact resource still returns CHALLENGE
Per-Hop Evidence
Every hop's decision recorded immutably, with the rules that fired and the intent it stated
Delegation Findings
An agent a provider reports acting on behalf of another agent is a finding, stated from what was reported and never inferred