Before Delegus, our founder, Inam Haq, led engineering at RREV, where the team built expedition vehicles, and he built the system that runs them: RREV OS. It's the control panel for the vehicle's suspension, its energy and its switching. He built it end to end, hardware and software: the suspension control module, a Debian compute unit, the sensors, hand-wired in the early days, through to a fleet with over-the-air updates.
Like a lot of engineers, he'd started using AI agents to do real work on that system. Not drafting, doing: carrying out operations on live hardware, from a prompt.
One day he gave an agent a task and told it, explicitly, not to touch the vehicle.
It pulsed the vehicle's suspension and raised the air spring. Real hardware, real motion.
It had the access. Nothing had checked whether it was allowed to use it, right then.
What stayed with him#
It wasn't the agent's mistake that stayed with Inam. Agents misread instructions; people do too. It was what he couldn't say afterwards.
He knew exactly which agent it was. Identity was never the problem. The agent was authenticated. Its credentials were valid. It was doing exactly the kind of work it had been set up to do. Every control in place worked as designed.
And none of them could answer the question that mattered: was it allowed to do that? Nothing had checked, at the moment it acted. Nothing recorded who had allowed what. "Don't" in a prompt is a request, not a control, and nothing between the agent and the vehicle knew the request existed.
The missing piece#
The obvious fixes point the wrong way. A smarter agent would misread instructions less often, but not never. A stronger identity check would confirm, more firmly, who had done the thing that shouldn't have happened.
What was missing sat on the other side: at the thing receiving the action. Before the suspension moved, something needed to ask "does whoever is responsible for this agent allow this action, right now?" and get a yes or a no it could act on. And afterwards there needed to be a record of that answer, one that didn't depend on trusting the agent, the vendor, or the person who ran it.
Now scale it up. Put the agent in a company. Point it at businesses that have never met it: a GPU cloud, a data provider, a supplier. The receiving side has the same problem Inam had, with less information. It can't see the company's rules at all.
What we built#
So that's what Delegus is. A company signs a permission for its agent: what it may do, up to how much, until when, revocable at any time. The agent proves it on each request. The business receiving the action makes one check before acting and gets a signed yes or no. Every decision leaves a signed receipt that anyone holding it can confirm is genuine, and that the company and the business it names can check against what it relied on.
At that moment, that check would have looked at a permission that said nothing about actuating the vehicle, and said no, before anything moved.
And afterwards there would have been something Inam didn't have: a receipt. Which agent, under which permission, asking for what, and the check that refused it. Not a line in his own logs, which only he could vouch for, but a signed record that someone else could check for themselves. When the agent is acting for a company and the business on the other side has never met either of you, that difference is the whole point. Your logs are your word. A receipt is evidence.
It started with an air spring. It's about every agent that acts for someone else.