Architecture and threat model
Trust boundaries for AI agents doing real work.
Delega coordinates agents across sessions, tools, and machines while assuming that task text can be hostile, models can be prompt-injected, ownership can be abandoned, and a human decision must remain distinguishable from an agent assertion.
The model
The asset is not “memory.” The system’s job is to preserve accountable coordination: who is allowed to act, where a fact came from, whether an agent owns the work now, when a human actually made a decision, and how automation is prevented from widening an untrusted input’s authority.
Protect
Routing and ownership, high-trust provenance, credentials, task history, and outward-facing effects.
Assume
External payloads are untrusted data; an agent may follow malicious text; sessions can vanish mid-task.
Constrain
Who can mutate shared work, what automation can express, how far cascades run, and where secrets appear.
Preserve
Source provenance, delegation lineage, decision history, current lease ownership, and reviewable evidence.
Untrusted
External event
Text is data, even when it sounds like an instruction.
Authenticated
Signed ingress
HMAC and replay limits identify the source, not the truth of its content.
Tainted
Sticky provenance
Ingress identity survives automation-created descendants.
Bounded
Leased work
One live holder acts; claims expire or hand off.
High trust
Human decision
A single-use answer path mints human provenance.
Reviewable
Evidence and history
Completion claims remain inspectable, not magically verified.
Implemented controls
These controls exist because ordinary application authorization is not enough when the caller is a model reading attacker-controlled prose. Each one protects a specific invariant instead of relying on the agent to “be careful.”
01
Untrusted input stays untrusted
A signed inbound event becomes a task with ingress provenance and an ingress label. If an automation creates a child from it, that provenance is copied forward. Automation rules ignore ingress work unless their conditions explicitly opt in to source = ingress.
InvariantTransport authenticity does not make payload text authoritative.
02
Human statements have a narrow mint path
Agents cannot write human_stated or imported provenance with ordinary keys. A decision escalation creates a hashed, expiring, single-use answer token; the read page is side-effect free, and provenance is written only after the human submits an answer.
InvariantAn agent cannot upgrade its own assertion into a human decision.
03
Secrets are withheld from model output
MCP secret-reveal switches default off. Agent-key and webhook-secret reveal each require an explicit environment flag because a prompt-injected agent can copy anything returned in tool output.
InvariantBeing authorized to create a credential does not imply permission to show it to the model.
04
Coordination is capability-scoped
Worker, coordinator, and admin roles form a deliberate ladder. Coordinators can see account-wide work and comment across lanes, but they do not inherit unrestricted mutation or administrative credential powers.
InvariantVisibility for coordination is separate from authority to rewrite ownership.
05
Work ownership expires
Claims are atomic leases, not permanent locks. A heartbeat extends a live lease, a release carries a bounded handoff note, and an expired claim can return to the queue. Automated mutations skip work that is actively claimed.
InvariantOnly one live holder acts, and abandoned ownership is recoverable.
06
Automation is bounded
Rules use closed condition and action vocabularies, per-event idempotency, a self-reaction guard, a maximum cascade depth, and a total action budget. Repeated failures disable a rule instead of retrying forever.
InvariantAn event cannot produce an unbounded chain of agent-visible work.
Inspectable evidence
The hosted server is private, so this page publishes behavioral contracts rather than asking readers to trust an inaccessible codebase. The client packages and hosted claiming suite remain public and MIT licensed.
| Boundary | Contract assertion | Evidence surface |
|---|---|---|
| Claiming | A live lease cannot be claimed twice; heartbeat, release, expiry, and completion have distinct lifecycle behavior. | Public hosted suite |
| Automation | One matching source event produces one action; self-created work does not recursively trigger the same rule. | Sanitized production contract |
| Ingress | Automation-created children retain ingress provenance, and rules must explicitly opt in before matching ingress work. | Sanitized production contract |
| Human decisions | Tokens are hashed, expire after 72 hours, work once, and cannot write human provenance on a read request. | Sanitized production contract |
| Authorization | A non-admin write using human_stated or imported provenance is rejected. | Sanitized production contract |
| Failure containment | Ten consecutive automation failures disable the rule; cascades stop at the configured depth and action budget. | Sanitized production contract |
Known gaps and failures
The useful version of a threat model names what the system does not yet enforce. These are the current boundaries of the design, not a hidden backlog presented as finished work.
Context freshness is procedural
Delega records provenance and superseded history, but it does not automatically flag a context fact because it is old, thinly supported, or contradicted. Agents are told to re-verify recalled facts older than 30 days; automatic stale and disputed rendering is intentionally unbuilt until real use demonstrates repeated failures.
Ordinary writes rely on caller discipline
High-trust provenance is protected, but an authorized agent can still write an ordinary context value that is wrong. The append-only history makes the change reviewable; it does not make the content true.
Evidence is a claim
Completion can require a commit, CI run, deploy reference, URL, or command output. Delega stores those references for spot-checking; it does not independently adjudicate that an artifact proves the task was done.
What this demonstrates
Governance-shaped infrastructure, operated in production.
Delega has been used by three agent platforms across two machines. The commercial thesis did not survive contact with its own production data, but the engineering thesis did: coordinating semi-autonomous tools requires provenance, bounded authority, recoverable ownership, and explicit human control.
The server remains private. Publishing this design, its contracts, and its failures makes the work evaluable without pretending that source visibility is the same as operational judgment.
Delega is an independently operated personal project maintained on a best-effort basis. It has no availability SLA.
Last updated August 17, 2026
- No claim of immunity to prompt injection
- No security certification or external audit
- No enterprise availability commitment
- No multi-human organization model
- No automatic truth verification for evidence