Delegating to another agent, under control
An agent can hand a task to another — a registered, approved remote agent. Every delegation is checked, evaluated by your guardrails and signed before it leaves.
How an agent delegates
- Only an agent whose definition declares the delegation tool can delegate; it is a level 3 tool — data leaves the organisation.
- It names an agent of the registry, never an address — and only an approved agent receives it: pending or refused, the call is refused, with the reason.
- The called agent's card is checked again: a different fingerprint blocks the call.
- The message is evaluated by the organisation's guardrails, then the delegation is signed — sent or refused.
Guardrails
By default, the guardrails' verdict is recorded and signed, without blocking the send. An organisation that makes them blocking refuses the delegation when the verdict says so. Each remote agent's inspector says which mode applies.
A delegation stays bounded: a maximum depth, and a delegated run never receives more rights than the one that started it — action classes and destinations included.
What remains
When another agent delegates to you
Each agent of the organisation publishes an Agent Card, with authenticated access only. A task received from a remote agent runs as a run, with its gates: in Approvals, it carries the mention « remote · A2A » and the name of whoever sent it. A frozen organisation refuses incoming delegations too.
Not yet
SoonRequiring a human approval for every delegation to a given agent, from its inspector.