Ideas · Builder Notes
Delegated authority and the dual check
In Kognita alpha 0.5 every agent call needs a live delegation from a human who is entitled to the action, checked on both sides.
Context
An agent acting for a person should never be able to do more than that person could.
Decision
- kognita.authority adds delegations, revocation, task completion and capability grants.
- A call needs both the human's entitlement and a live delegation.
- Above an approval threshold it becomes a human approval.
Why
Revocation is effective at the next decision. There is no cache that lets a revoked delegation keep working.
Outcome
Every agent call now needs a live delegation, failing closed.
Open
Mapping tool arguments to the client a delegation covers needed several follow-up fixes.
Check both the delegator and the delegation. Either alone can be stale.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #56 in the Kognita repository.