# Delegus

> Agent authority: what an AI agent is allowed to do. Delegus verifies an AI agent's delegated authority to act. A service that receives an action from an unfamiliar agent makes one API call and gets back a decision, ALLOW or DENY with a reason, and a signed receipt. Protocol specification v0.2 (frozen).

Delegus is designed to answer one question for software that receives an action from an AI agent it has never met: is this agent authorized to do this, for this company, right now?

## How it works (as v0.2 specifies)

- A company (the principal) proves control of its domain and signs a grant: a scoped, time-boxed, revocable statement of what its agent may do.
- The agent signs a proof for each request, bound to the grant, the recipient, the exact action and the moment.
- The receiving service (the relying party) forwards the grant, the proof and the action it received to Delegus in one call.
- Delegus checks signatures, the validity window, revocation, audience binding, freshness and replay, and scope, in a fixed order. It fails closed, returns ALLOW or DENY with the first failing check as the reason, and signs a receipt.
- The receipt pins hashes of the grant, the request, the issuer's key document and revocation list as they stood, the rules applied, and the evaluation time, so the decision can be re-checked later against preserved snapshots.

## Design principles

- Fail closed: unknown, missing, ambiguous or unavailable inputs produce DENY.
- Deterministic: the same inputs, snapshots and trust configuration produce the same result anywhere.
- Open format: anyone can verify a Delegus artifact without calling Delegus. Only Delegus produces fresh ones.
- Denials carry a reason code, for example AMOUNT_EXCEEDS_AUTHORITY, AUTHORITY_REVOKED or PROOF_REPLAYED.

## Status

- Protocol: v0.2, frozen with errata 1 and 2 applied.
- Service: the production API is serving at https://api.delegus.ai (did:web:delegus.ai); its first production receipt (a self-test) has been produced and re-verified offline against the published DID document. SDK: @delegus/sdk on npm. Nothing on this site is a measured performance figure or a guarantee.
- Founding pilot program: open. Contact hello@delegus.ai.

## Pricing and partners

- [The Authority Principles](https://delegus.ai/principles): six rules for letting AI agents act for a company (write the permission down, permit the act not the actor, the business that takes the risk checks before it acts, one step stops it, anyone can prove it later, when in doubt no), CC BY 4.0, with where Delegus meets them and where it does not yet.
- [Why Delegus](https://delegus.ai/why): why authority needs its own check — card limits control money, bot checks control identity; the five whys, the buyer and seller objections, illustrative situations, and when you don't need it.
- [Pricing](https://delegus.ai/pricing): per-verification tiers; a free sandbox, then a 14-day free trial in production. Markdown at https://delegus.ai/pricing.md
- [Quickstart](https://delegus.ai/docs/quickstart): sign up at app.delegus.ai, copy a verify key, get a first signed decision.
- [Founding pilot program](https://delegus.ai/partners): apply for a paid pilot. Markdown at https://delegus.ai/partners.md

## Documents

- [Specification v0.2, Markdown](https://delegus.ai/docs/delegus-spec-v0.2.md): the normative text. Rendered at https://delegus.ai/docs/spec.
- [Profile delegus-base-v1](https://delegus.ai/profiles/delegus-base-v1): the check table P1-P20 in evaluation order; its SHA-256 is `protocol.profile_hash` in every receipt. Served byte for byte.
- [Receipts & offline verification](https://delegus.ai/docs/receipts): what is in a Decision Receipt and how to re-verify one offline; raw at https://delegus.ai/docs/receipts.md.
- [Open format, closed service](https://delegus.ai/docs/open-format): why anyone can verify a Delegus artifact and only Delegus can make one; raw at https://delegus.ai/docs/open-format.md.
- [Same word, two objects](https://delegus.ai/docs/two-receipts): the IETF draft's user-signed delegation receipt made before the agent acts versus the Delegus Decision Receipt signed after verification, and how they could relate; raw at https://delegus.ai/docs/two-receipts.md.
- [MCP servers: one-line middleware](https://delegus.ai/docs/mcp): how an MCP server verifies a delegated tool call with the @delegus/sdk middleware and receives a signed Decision Receipt; what v0.2 binds; the measured example; raw at https://delegus.ai/docs/mcp.md.
- [Conformance](https://delegus.ai/docs/conformance): how a Delegus verifier is checked — the 36 vectors, three normalization sets, byte-for-byte reproducibility; raw at https://delegus.ai/docs/conformance.md.
- [Integrate](https://delegus.ai/docs/integrate): the relying-party integration as v0.2 specifies it.
- [API reference](https://delegus.ai/docs/api): every route with request and response shapes; raw document at https://delegus.ai/docs/api/openapi.json.
- [SDK and CLI reference](https://delegus.ai/docs/sdk): every export of @delegus/sdk and the delegus command, generated from the code.
- [Threat model mapping](https://delegus.ai/docs/threat-model-mapping): each threat in spec §13 mapped to the check, the code and the test that addresses it; raw at https://delegus.ai/docs/threat-model-mapping.md.
- [Infrastructure security](https://delegus.ai/docs/infra-security): accounts, keys, evidence storage, network, deployment and monitoring.
- [Security](https://delegus.ai/docs/security): how the service is built and run, and what's coming soon.
- [Evidence layout](https://delegus.ai/docs/evidence-layout): the frozen receipt schema, evidence bucket layout, status-list shape, log and audit shapes; raw at https://delegus.ai/docs/evidence-layout.md.
- [Errata](https://delegus.ai/docs/errata): the record of corrections to the specification.
- [DENY reason codes](https://delegus.ai/docs/reasons): every reason a verify call can return, in evaluation order, generated from the frozen tables.
- [Live demo](https://delegus.ai/demo): the handshake executed against the development sandbox, with real receipts.
- [Cross-rail demo](https://delegus.ai/demo/mpp): a recorded live run in Stripe test mode — one grant, two sellers on two payment rails (card and invoice), refusals before payment, one revoke refused everywhere.
- [Documentation index](https://delegus.ai/docs).

## Permanent links

Every documentation page and document is also served under https://delegus.ai/docs/v0.2/ and stays there after later versions exist.

## Pages

- [Announcement](https://delegus.ai/announcement): Delegus is serving in production — one call to verify what an AI agent was authorized to do. Markdown at https://delegus.ai/announcement.md
- [Home](https://delegus.ai/): overview, integration example, and an interactive walkthrough of a decision receipt.
- [Home, Markdown](https://delegus.ai/index.md): the same page for machines. Also returned for GET / when the request carries `Accept: text/markdown`.

## Status

- Public status page: https://delegus.betteruptime.com (development environment).

<!-- blog -->
## Receipts (blog)

- [Receipts](https://delegus.ai/blog): Notes on authority for AI agents, from the team building Delegus.
- [Delegus is live](https://delegus.ai/blog/delegus-is-live): One call to check whether an AI agent was allowed to act, and a receipt to prove it
- [Identity is not authority](https://delegus.ai/blog/identity-is-not-authority): Identity tells you who. Authority tells you what’s allowed. Security was built for doors. AI agents act inside them.
- [Under a minute](https://delegus.ai/blog/under-a-minute): From the homepage to a first signed receipt, step by step
<!-- /blog -->

## Contact

- Email: hello@delegus.ai