00/Use case · Multi-agent systems
A root agent spawns a planner. The planner spawns three tool agents. Each hop reduces scope. Each hop carries a parent. Each hop is logged. KavachOS gives you the delegation primitive so your orchestration does not become an auth rebuild.
01/TL;DR
Parent agent signs over a scope subset to a child. Child cannot exceed parent scope. Provable at the tool server.
Who delegated to whom, which scope, which resource, what outcome. Query it as a tree or a flat log.
Revocation cascades along the delegation graph. Offboarding a user stops every descendent agent at the next verify.
02/The problem
LangGraph, CrewAI, AutoGen, and every bespoke orchestrator give you the graph model. None of them gives you a way to prove that the research agent was allowed to invoke the file-write agent. The scopes live in a prompt. The audit lives in a console.log. The revocation does not exist.
Scopes enforced by prompt
The only thing stopping the summarizer from calling the email-send tool is a line in its system prompt. Prompt injection defeats this in one turn.
No parent subject on child agents
When a child agent calls a tool, the server cannot answer 'who is running this'. Debugging a misbehaving chain becomes archaeology.
Credentials wider than needed
The orchestrator holds a wide token and passes it to every child. Any leaked child context exposes the wide token.
Revocation is not a real concept
There is no way to 'kill the research agent but keep the planner'. The only kill switch is tearing down the whole graph.
03/How kavachOS fits
KavachOS gives you a delegate() call. Pass in the parent, the scope subset, the audience, and the TTL. Get back a token the child can use. The child can delegate further. The chain is cryptographically verifiable end to end.
Chains
Audience
Short TTL
Audit tree
Revocation
04/In code
Full examples with framework adapters live in the docs. This is the shape of what you wire into your app.
planner-agent.ts
A planner agent delegates to a specialist agent with a tighter scope. The specialist's token carries the planner as its parent and cannot exceed the planner's scope.
import { kavachos } from "kavachos";
// Planner was delegated scopes by the human user earlier.
const specialist = await kavachos.delegate({
parent: planner.token,
audience: "https://tools.example.com",
scopes: ["files:read"], // subset of planner's scopes
ttlSeconds: 120,
reason: "extract_revenue_from_q3_report"
});
// The specialist calls the tool with its scoped token.
const result = await fetch("https://tools.example.com/files/read", {
headers: { Authorization: `Bearer ${specialist.token}` }
});
// The audit log now shows: user -> planner -> specialist -> tool.
// Every hop is verifiable.Subset
Proven at every hop
aud
Claim bound per token
Cascade
Revocation model
Tree
Audit view native
05/Before / after
Without scoped identity
With kavachOS
We had nine agents in our orchestration graph and no real answer to 'which one touched that file'. KavachOS delegation gave us the tree view on day one. Our security review got two weeks shorter.
06/FAQ
Short answers. Link out to the docs if you want the long version.
07/Related reading
On kavachos.com
The six signals a healthy agent token carries, including parent subject and scope subset.
On kavachos.com
Walkthrough of a six-hop delegation chain with audit log output.
On kavachos.com
If you are at the single-agent stage today but expect to grow into multi-agent orchestration.
Every hop carries a parent, a scope subset, and an audience. The audit log answers who did what. Free up to 1,000 MAU.