Software is starting to receive actions from AI agents it has never met, acting for companies it has. Today Delegus is serving in production: one API call that answers whether an agent was authorized to take an action, for a named company, right now — and signs the answer. The protocol specification is public, pricing is published, and we are onboarding ten design partners.
The problem, in one paragraph#
Payment networks can tell a seller whether money can move. Identity systems can tell a seller which agent platform signed the request. Neither answers the question that comes first: was this specific agent authorized by this specific company to enter this transaction, at this moment, within these limits? And none of them hands the seller a signed record of that answer it can re-check years later without asking anyone.
And the protocols are now explicit that the agent will act with no human present — AP2's latest release is built around exactly that — which is the moment the seller most needs a signed answer and has nobody to ask.
What Delegus does#
A company proves it controls its domain and signs a Grant: a scoped, time-boxed, revocable statement of what its agent may do — "our purchasing agent may buy up to $500 until October 1." The agent signs a Proof for each request, bound to that grant, the recipient, the exact action and the moment. The receiving service forwards both, plus what it actually received, to Delegus in one call, and gets back:
- ALLOW or DENY, with the first failing check as a stable reason code —
AMOUNT_,EXCEEDS_ AUTHORITY AUTHORITY_,REVOKED PROOF_REPLAYED— that the integrating engineer can switch on without understanding DIDs, credentials or status lists; - a signed Decision Receipt that pins hashes of the grant, the request, the company's key document and revocation list as they stood, the rules applied and the evaluation time.
The receipt is re-verifiable offline. Anyone holding it and the evidence it names can reproduce the decision against the open protocol without calling Delegus, using the receipt's own signed clock. Delegus keeps every referenced artifact retrievable by hash for seven years, as v0.2 specifies.
The integration on the receiving side is a few lines:
// The relying party's entire integration
import { Delegus } from "@delegus/sdk";
const delegus = new Delegus({ apiKey: process.env.DELEGUS_API_KEY });
app.post("/orders", async (req, res) => {
const d = await delegus.verify({
grant: req.header("Delegus-Grant"),
proof: req.header("Delegus-Proof"),
action: { type: "commerce:purchase", resource: req.body.orderId,
amount: req.body.amountMinor, currency: req.body.currency },
});
if (d.decision !== "ALLOW") return res.status(403).json({ reason: d.reason });
// proceed, and keep d.receipt with the order
});What we are committing to#
Three properties are written into the specification, not the marketing:
- Fail closed. Unknown, missing, ambiguous or unavailable inputs produce DENY.
- Deterministic. The same inputs, snapshots and trust configuration produce the same result anywhere; the reference engine is a pure function with no I/O and no runtime dependencies.
- Open format, closed service. The grant, proof, receipt and rules are published, versioned and hashed; anyone can verify a Delegus artifact. Issuer trust, live revocation and replay, evidence preservation and signing are run by Delegus, and only Delegus can produce a fresh one.
Where it sits#
Delegus is not a payment rail and not an identity provider. It is the verifier on the receiving side, and it is designed to sit on top of the protocols already emerging — Google's AP2 mandates, Stripe's Agentic Commerce Protocol, Cloudflare Web Bot Auth and Visa's Trusted Agent Protocol, Mastercard Agent Pay, Auth0 and Entra agent identities — rather than compete with them. Each answers its own question well. Delegus answers the one they leave to the seller.
We are starting where agents already spend money on behalf of companies: business procurement. Company A's agent buys GPU hours, dataset access or software seats from Company B's API. The money can move. What was missing was a way for B to know A's agent was authorized to spend it.
What is true today, plainly#
- The v0.2 specification is frozen and public, with a published errata process. The profile document whose hash appears in every receipt is served byte for byte.
- The reference engine and SDK are Apache-2.0, published on npm as
@delegus/coreand@delegus/sdk(npm install @delegus/). The conformance vectors are public too, assdk @delegus/;conformance npx @delegus/runs all thirty-six.conformance - The production API is serving at api.delegus.ai, and
did:web:delegus.resolves. Production has produced and re-verified its first receipt: a single self-test receipt, signed byai did:web:delegus.and re-verified offline against the published DID document with every hash matching. It is our own. The interactive demo and its take-home receipts run on the development environment, with receipts signed by keys held in AWS KMS.ai#receipt- 1 - Pricing is public: per verification, a DENY billed like an ALLOW, companies that issue grants never charged.
Design partners#
We are onboarding ten: five companies running procurement agents, five selling machine-provisionable resources through an API. Apply to be a design partner.