Core engineering and protocols for Verifiable Delegation Chains.
When a human user instructs an autonomous executive assistant to 'book a flight and hotel for under $2,000,' the user delegates real-world financial authority. If the agent is tricked by a prompt injection attack on a hotel website, it might be instructed to transfer the entire corporate treasury. Capability delegation must be cryptographically bounded.
A2AShield utilizes modern capability tokens (similar to Macaroons and Biscuits) signed with ML-DSA. The human signs the initial root token, embedding strict constraints: (Max_Spend = $2,000, Purpose = Travel, Expires = 24h). The primary agent can delegate sub-tasks to specialized travel search agents, adding further restrictions, but can never expand the original permission envelope.