Skip to main content

Flow: Agent Delegation and Tool Execution

Status: the end-to-end path exists for local integration but is Partially implemented and not production deployable.

agent_execution · register, delegate, approve, revoke01 / 11
The user registers an agent, creates a narrow policy grant, opens a runtime session, and token exchange names the user as subject and agent as actor. Runtime proposes a tool to MCP Gateway. Composite authorization and semantic controls run. High-risk actions wait for human approval. Approved calls traverse the normal gateway and service, emit audit, and can be stopped by revocation or kill switch.registernarrow grantprojectcreate sessionexchangepropose toolauthorizeHITL exact actionapproved calloutcome eventrevoke / suspendOwner / userdelegate · approve · revokeAgent Registrytemplate · identity · lifecycleIN DEVELOPMENTPolicy Servicedelegation authorityIMPLEMENTED LOCALLYAuthorizationuser ∩ agent ∩ contextPARTIALAgent Runtimesession · plan · SSEIN DEVELOPMENTKeycloaksub=user · act=agentPARTIALMCP Gatewayschema · scope · riskapproval · sole egressIN DEVELOPMENTPDP + Gatewaydecision · workloadkill switch · routePARTIALPlatform serviceenforce · side effectVARIESAuditsubject + actor + outcome
owner / approverAgentic Planeidentity & authorizationevents & audittool execution

Recovery rules​

  • A session does not start if registry, grant, token exchange, authorization, or vault setup fails.
  • A crash after a side effect is reconciled by idempotency key before retry; absence of a response is not proof of failure.
  • Two replicas may not execute one turn without a durable owner lease; this gate is not yet complete.
  • Lost approval state defaults to not executed. No recovery path auto-approves.
  • Tool output is data, not instruction; full provenance/content-policy enforcement remains in development.

See Agentic Plane for the threat model and status.