Only-tighten composition.
A policy composition rule guaranteeing that every downstream delegation can only narrow the authority granted upstream, never widen it.
What it is
Only-tighten composition is a formal property of a policy language: when policies compose across a delegation chain, the resulting policy is always at least as restrictive as every policy above it.
In plain terms, if a human grants an agent the authority to read from folder /reports, no downstream sub-agent can be delegated more. Only less.
The math
For any composed policy Pₖ, if P₁ grants scope S₁ and P₂ extends P₁, then allowed(P₂) is a subset of allowed(P₁). Extensions can carve away permissions. They cannot add them.
Why it matters
Only-tighten composition is a safety invariant. Systems that lack it can drift: an agent that delegates to another agent that delegates to a tool can, in principle, end up doing something no human ever authorized.
Systems that enforce it cannot drift, by construction. Three consequences follow.
Scope escalation becomes impossible
A common failure mode in multi-agent systems is slow-motion privilege escalation: at each hop, an agent slightly expands what it can do, because the composed policy is the union of what each level granted.
Only-tighten composition closes this off. Union is never possible; intersection is the only path.
Local reasoning becomes global reasoning
If you can prove that a top-level policy only allows action A, you have proven that no downstream agent, at any depth, can do anything outside A.
You do not need to inspect the whole graph. The invariant travels with the delegation.
Incident recovery becomes atomic
Revoke a scope at the top; every downstream instance loses that scope immediately, whether it is currently executing or spawned tomorrow. There is no cache of expanded permissions living somewhere in the chain.
How Veldt implements it
Veldt models every delegation as a signed delegation token that includes the scope granted. When an agent tries to sub-delegate, the runtime does two checks:
- The child scope must be a syntactic subset of the parent scope (glob patterns, resource identifiers, and allowed operations all narrow, not widen).
- The composed policy is re-evaluated at action time against the chain, not against any single delegation in isolation.
If the child token expands scope, even by a single resource path, even by adding an operation the parent did not have, the runtime rejects the sub-delegation before any action can be taken. The invariant is enforced at the perimeter, not trusted to callers.
How it fits with the other primitives
This is one of the five architectural primitives introduced in the KYA paper, part of the Know Your Agent framework, and it interacts directly with the other four: delegation attribution, tamper-evident evidence, portable identity, and the sub-50ms verdict pipeline.
Only-tighten is what makes the attribution chain trustworthy. Without it, "who authorized this" has no meaningful answer, because authority could have grown mid-flight.
Contrast with unconstrained delegation
Traditional IAM systems permit unconstrained delegation. A service account is granted a role; that role includes the ability to grant roles to other service accounts.
The resulting graph can, and often does, contain paths where a downstream identity holds more authority than any single upstream grant. Auditors call this role explosion, and it is one of the most common findings in cloud security reviews.
In an agentic setting, the same problem is worse. Agents can spawn agents rapidly, and each spawn is an implicit delegation. If the composition rule permits widening, the graph of effective authority becomes unbounded within minutes.
Only-tighten composition prevents this by construction. Not by policy discipline, and not by post-hoc audit.