Authority control for agent-to-agent work

Handoff
Workbench

Define work. Bound authority. Approve transfer. Verify outcome.

Delegation becomes unsafe when a receiving agent can silently gain access, spend money, or substitute itself into work. Workbench turns each transfer into a bounded, signed, human-approved lifecycle with evidence at the end.

Build a custom handoff

Synthetic dependency-security review · no credential fields · no external service · money set to NONE

Authoritative workspace

A controlled path from proposal to proof

Saved sessions

Preparing your local workspace

The signed application state will appear here.

Version: 0
Events: 0
Responsible now: Loading

Authority comparison

Who can do what?

Evaluating

Included Reduced Excluded Attempted expansion

Human decision and next action

No authority moves without an exact decision.

Review the recipient, limits, expiration, digest, and protocol before approving.

Payload digest Loading Protocol 1.0 · State version 1

These controls invoke the real signed application service. The interface cannot skip cryptographic or policy checks.

Advanced signed handoff JSON

Loading

Custom handoff builder

Start with strict boundaries, not a blank prompt.

Every field maps to the signed schema. Monetary authority defaults to NONE. No credential, password, client secret, or signing-key field exists.

Work and actors

Project or task Human principal Issuing agent Receiving agent

Goal

Authority boundaries

Enter one exact value per line. Duplicate or overlapping values are rejected.

Granted capabilities Prohibited capabilities Resource boundaries Data access boundaries

Time, evidence, and completion

Monetary authority Expiration in minutes

Required evidence Completion definition

Creating a proposal does not approve or transfer authority.

Adversarial safety lab

Prove the boundary by attacking it safely.

Six isolated synthetic requests test expansion, spending, recipient binding, versions, replay conflict, and signature integrity through the real policy engine.

No attacks run for this workspace yet.

Evidence panel

Verified proof only.

Current values come from the persisted aggregate, ordered events, receipt verifier, and unchanged-state attack checks. No live rate-exhaustion claim is made.

Signed JSON Ordered events Receipt Verification OpenAPI cURL MCP TypeScript

Ordered event history JSON

Loading

Completion receipt JSON

Not available until completion.