# Delegated Credentials Must Attenuate Rather Than Escalate ## Claim Every step in a chain of delegated authority should hold equal or lesser permission than the step before it, never more — a credential can shrink as it's passed down, but it must never grow. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds anywhere one actor (human or agent) grants derived credentials to another to perform a sub-task — multi-agent handoffs, OAuth token exchange, sub-process spawning, service-to-service calls. - Breaks when a system needs a legitimate elevation step (a supervisor approving an agent's request for temporarily higher access) — attenuation describes the default direction of automatic delegation, not a ban on all elevation, which should instead require an explicit, auditable grant outside the normal chain. - Standard OAuth handles single-transaction token exchange but doesn't by itself track this rule across a multi-step agent workflow — the source's IETF Transaction Token discussion is a proposed fix for that gap. ## Evidence > [!quote] > The idea is like a credential can only be passed down in equal or lesser form. The concrete failure this prevents: an agent with `write` access to one resource requesting or being granted `admin` on another resource mid-task, with no single point where that escalation would be caught, because standard authentication only re-confirms identity at each step, not the shrinking-permission invariant. ## Links - [[3. Resources/Literature Notes/Closed That Tab - Agentic Identity, AI Security Incidents, and Loop Engineering]] — source literature note, §H1 - [[3. Resources/Permanent Notes/Capability and Intent Are Separate Axes of Risk]] — because extends: attenuation is a concrete control for the capability axis specifically — it bounds what a delegated agent *can* do regardless of what it *intends* - [[3. Resources/MOCs/AI Agent Safety MOC]] — applies-in: multi-agent and sub-agent credential design - [[3. Resources/Permanent Notes/An Agent Finishing a Task Will Clean Up Whatever Its Credential Can Reach]] — extended by: scope an agent's credential to a tagged set that excludes its own environment (Crawshaw). - [[3. Resources/Permanent Notes/A Role-Limited CMS Account Does Not Limit an Agent That Also Has Shell Access]] — constrained by: Limiting an agent's CMS role limits what it can do through authenticated API calls. ## Tests / falsifiers - An audit of a multi-agent system's actual token grants across several delegation hops that finds a downstream agent holding broader permission than its upstream grantor — would show the principle is violated in practice even where claimed in policy. - A production incident where strict attenuation was enforced end-to-end and still failed to prevent unauthorized access — would show attenuation alone is necessary but not sufficient, and some other control (auditability, revocation speed) was the actual gap. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Closed That Tab Agentic Identity, AI Security Incidents, and Loop Engineering]] — states the attenuation principle and IETF Transaction Token proposal for agentic delegation.