Software is starting to receive actions from AI agents it has never met, acting for companies it may know. A GPU cloud gets a reservation at 2am. A data provider gets a request for records. A tool server gets a call to change something. In each case, the business on the receiving end has to decide whether to act, and it has no way to see whether the agent's company actually allowed it.
Delegus answers that question in one call: was this agent allowed to do this, for this company, right now? You get allow or deny, with the reason, and a signed receipt you can keep and re-check later.
It's live. Here's what that means today.
Production is serving#
The API is live at api.delegus.ai. Every decision it makes is signed with a key Delegus publishes at delegus.ai/.well-known/did.json, so a receipt can be checked against a key anyone can fetch. Signing keys live in AWS KMS, hardware-backed and non-exportable. The evidence each receipt relies on is stored under a seven-year compliance-mode lock.
This checks the signature over the receipt’s signed fields, which are shown above. Re-checking the whole decision also needs the grant, proof and action the business kept; npx -y @delegus/sdk receipt verify does that.
You can start in the sandbox, today, without a card#
Sign up at app.delegus.ai with a work email. You get a key straight away, and a built-in sample permission lets you run a first check before you've written any code. Signup to first signed receipt: under a minute.
When you're ready for real traffic, adding a card starts a 14-day trial. After that it's Starter, $99 a month with 50,000 checks, and larger plans above it.
The check is one call#
Put one call in front of the action. Send the company's permission and the agent's proof for this request, act only on allow, and keep the receipt. Behind that call, 24 checks run in a fixed order, and a deny names the first one that failed, as a stable code your software can act on: AMOUNT_EXCEEDS_AUTHORITY, AUTHORITY_REVOKED, and so on.
If you run an MCP tool server, it's one line:
app.use("/mcp", delegus.mcp()); // every tools/call is now verifiedcurl -s https://api.delegus.ai/verify \
-H "authorization: Bearer $DELEGUS_API_KEY" \
-H "content-type: application/json" \
-d '{"grant":"<JWS>","proof":"<JWS>","action":{"type":"commerce:purchase","resource":"sandbox/quickstart","amount":1000,"currency":"USD"}}'{
"decision": "ALLOW",
"reason": null,
"receipt_id": "drc_...",
"receipt": "eyJ... (a signed compact JWS)"
}The format is public, and you can test against it#
- The specification (v0.2) is frozen and public, under CC BY 4.0.
- The engine, SDK and conformance suite are published on npm under the Apache-2.0 license:
@delegus/core,@delegus/sdkand@delegus/conformance. - 36 conformance cases anyone can run. The reference engine passes all 36:
npx @delegus/conformance. - A hosted runner sends every one of those cases to your own verifier over HTTPS, in any language, and reports case by case.
Anyone can check the format. Delegus runs the service: the registry of companies that have proven their domains, revocation that every later check sees, the signing, and the evidence store.
Watch it run#
The homepage replays a recorded run in Stripe test mode, with example companies. One company's agent holds one permission and buys from two sellers: one takes a card through Stripe, the other bills an invoice. A $5,000 order against a $500 limit is refused before Stripe is ever called. After one revoke, both sellers refuse the next orders.
Recorded in Stripe test mode with example companies; no real money moved.
Where it came from#
Delegus started when an AI agent working for our founder, told not to touch a live vehicle, pulsed its suspension and raised the air spring anyway. He knew exactly which agent it was. What was missing was any check that it was allowed to.