Glossary · Attribution

Delegation attribution.

The practice of tracing every downstream AI agent action back to the human principal who authorized the delegation chain that produced it.

Every AI agent action is traceable, with cryptographic certainty, back to the human principal who authorized the delegation chain that produced it.

What it is

Delegation attribution is the property that every action taken by an AI agent, no matter how deep in a chain of sub-agents, tool calls, or spawned processes, can be traced back, with cryptographic certainty, to the human principal who authorized the original delegation.

The multi-hop problem

In a multi-agent system, work rarely stops with the first agent. A planner delegates to a researcher; the researcher delegates to a browser tool; the browser tool spawns an evaluator.

By the time a document is written to a shared drive or a message is sent to a customer, the action is separated from the human who kicked off the request by five or six hops. Delegation attribution keeps the chain intact and makes each hop provable.

What a log looks like with and without it

Without attribution, the log of an autonomous action reads: agent-worker-7 wrote to /finance/exports/.

With attribution, the same log reads: agent-worker-7, authorized by planner-3, authorized by [email protected] under scope finance:export, wrote to /finance/exports/.

Why it matters

Three reasons, each of them the difference between a system that can be run in production and one that cannot.

Accountability

Regulators, boards, and incident responders all ask the same question after an autonomous action goes wrong: who authorized this?

"The agent decided" is not a compliant answer under the EU AI Act, HIPAA, GLBA, or any established governance framework. Delegation attribution gives a legally coherent answer: a named human, under a named scope, at a named time.

Compliance

Article 14 of the EU AI Act requires human oversight of high-risk AI systems. Oversight is not credible without attribution.

If you cannot show which human's authority backed a decision, you cannot show the decision was overseen.

Incident response

When an agent takes a bad action, the first triage step is scoping the blast radius. If every subsequent action carries the same delegation stamp, you can revoke a principal's authority once and stop every in-flight action downstream, atomically.

Without attribution, you are chasing individual agent processes.

How it works

Delegation attribution is implemented as a signed chain. Each delegation event, where principal A grants scope S to agent B, produces a token that captures:

  • The identity of the granter (a human, or an upstream agent that itself holds a delegation)
  • The identity of the grantee (the AI agent receiving authority)
  • The scope being granted (which tools, resources, and operations)
  • Time bounds, and any conditions on use
  • A cryptographic signature over the above, chained to the parent delegation

When an agent invokes a tool, it presents its delegation token. The runtime governance layer walks the chain back to a human principal, verifies every signature, and either allows the action, narrows it, or blocks it.

Because every hop is signed, forging authority is mathematically hard, not merely policy-hard.

How it appears in the KYA paper

Delegation attribution is one of the five architectural primitives introduced in the KYA paper. The paper formalizes the delegation graph, defines the signing scheme, and proves that if every hop uses only-tighten composition, no downstream agent can act with more authority than the human who started the chain.

Two properties follow from this construction:

  • Attribution is local. Any auditor can check any action's chain without contacting the vendor.
  • Attribution is total. There is no path from an autonomous action back to nothing. Every action either has a human at its root or is rejected at the runtime perimeter.

What Veldt does with it

Veldt uses delegation attribution as one input to the five-verdict pipeline. When an agent action arrives at the perimeter, the runtime combines the delegation chain with a continuous trust score over identity, authority, policy, and behavior, and returns one of five outcomes:

Allow Redact Throttle Escalate Block

The verdict, the delegation chain, and the reasoning are all written to a tamper-evident audit trail.

Any auditor can walk that trail offline, verify the signatures, and rebuild the accountability picture without asking Veldt for anything.