PEDIGREE: Verifiable Delegation Identity for Agentic AI Systems#

Karthik Rampalli.

• Why: The sharpest statement of the agentic-authorization failure mode: an orchestrator takes one human consent and spawns sub-agents that all inherit its ambient credentials — so a relying party cannot tell which agent acted, on whose authority, or within what limits. A bad charge can't be attributed.
• What: A delegation-identity layer above workload credentials (WIT/WIC or X.509 SVID, unmodified). The SIT is a signed JWT (typ pedigree+jwt, EdDSA) with a parent chain, scopes, a Cedar-encoded mandate, an operator ceiling reference, consent chain and delegation depth. Its three claimed advances over AAuth and AIP: monotonic scope attenuation enforced at mint and verify (AAuth explicitly rejects attenuation), dual-layer authority enforcement (per-parent mandate AND operator ceiling — a single-layer guard fails when the orchestrator is compromised), and strict cryptographic re-verification of every parent SIT, catching parent-swap attacks that append-only token chains miss.
• How: Relying parties evaluate three inputs — workload credential, SIT chain, local policy + operator ceiling — with Cedar static-analysis proofs of narrowing; revocation is bounded-staleness and fail-closed, explicitly not real-time.
• Where applicable: Any multi-agent orchestration where sub-agents act under delegated human authority. Very early individual draft — the deck is candid that wire details still belong on the mailing list — but the three-tests framing (attribution, attenuation, enforcement) is the right vocabulary for this problem space.