The handshake for agents acting on the open internet. Six layers say the authorization is legal. The seventh asks the only question that matters once it is: is the agent still you?
The name is the structure: delegated (the authorization chain — assembled from existing standards) + fidelity (the open seventh layer — whether the agent stays faithful to the principal once authorized).
The old web handshake asks are you you? (account + password + captcha + device fingerprint). That can't tell a malicious bot from an authorized agent. As agents start booking flights, filing tickets, and touching CRMs on our behalf, the internet needs a handshake that answers a harder question:
Who are you, who do you represent, what may you do, what is your intent, can it be audited, and can it be revoked — and are you still faithful to the person who authorized you?
That last clause is the one nobody else is building. See § The seventh layer.
Six of these are assembly of existing standards — this project's job there is to stitch the scattered pieces into one coherent, runnable handshake. The seventh is the open question.
| # | Layer | Question | Built on (existing standards) |
|---|---|---|---|
| 1 | Identity | Who is this request from? | DID (W3C), agent identity |
| 2 | Delegation | Who does it act for? | OAuth Token Exchange (RFC 8693), AAP (IETF draft), MCP-I (DIF) |
| 3 | Permission | What is it allowed to do? | OAuth scopes, capability tokens |
| 4 | Intent | What is this action for? | structured intent claims (AAP task-context) |
| 5 | Audit | What did it do; can it be replayed? | W3C PROV, signed action logs |
| 6 | Revocation | Can authority be withdrawn? | token expiry / revocation, CAEP |
| 7 | ★ Fidelity | Authorization all valid — is the agent still faithful to the principal? | (open — see below) |
Layers 1–6 are deliberately thin adapters over standards that already exist and are converging. We don't reinvent them; we compose them so an agent can present one handshake instead of six disconnected proofs. For a plain-language map of each standard — what it is, what it looks like, and how mature it is — see docs/standards.md.
In a real multi-agent system the handshake runs at every hop — principal → orchestrator → sub-agents → tools — because every hop is a trust boundary and delegation is recursive. See docs/architecture.md for the calling logic, the three rules that keep a recursive chain trustworthy, and how the repo structure mirrors it.
Every standard above verifies that the authorization chain is legal — who authorized whom, with what scope, auditable and revocable. None of them verify that, given a fully legal chain, the agent's behavior is still what the principal would own.
An agent can have every credential green and still have drifted: prompt-injected, swapped for a different model mid-session, collapsed toward an agreeable average, or quietly diverged from the principal's actual judgment. Legal ≠ faithful.
Fidelity is the layer that asks: is this still you? This project declares the interface for that layer (so other handshakes can compose it) but ships only a no-op reference verifier. A real fidelity verifier — challenge/response that a drifted or swapped agent can't pass, with the secret living on the other side of an air gap the agent can't reach — is principal-specific infrastructure, not a public default. See delegated_fidelity/fidelity.py.
What a real verifier checks an agent against is the principal's own authored, provenance-tracked memory. The public, CC0 reference structure for such a sovereign memory layer is personal-memory-vault-starter — that shape is open; the challenge/secret that turns it into a fidelity check is not.
Design principle: layers 1–6 are a gift (public, composable); layer 7's interface is public, its implementation is yours. This is the same shape as composing a memory layer on top of a host without taking the host's authority — open the shell, keep the core.
Skeleton. Layers 1–6 are modeled as composable adapters; layer 7 is an interface with a no-op reference impl. Runnable end-to-end on the worked example in examples/.
python -m delegated_fidelity.demo # one boundary, seven layers
python -m examples.multi_agent # three hops: attenuation + anchor + per-hop fidelity(naze to choose — MIT for max adoption of the shell, or per-file. Existing standards referenced keep their own.)
By naze · github.com/hegu-1 · delegated-fidelity · the seven-layer handshake for the delegation-based internet