How can agents verify delegated authority across organizational boundaries?

A local policy decision does not by itself establish authority to a different organization.

Scoped signed grants with explicit issuer trust and fresh proof of possession can make delegation independently checkable.

• Ed25519-signed, scoped and expiring grants
• Issuer-key resolution and optional revocation checks
• Fresh holder possession proof at verification

Implementation and threat-model review are documented in the repository. No cross-organization deployment benchmark is claimed here.

• A grant alone is a bearer credential without fresh possession proof
• Issuer trust and revocation policy remain explicit deployment responsibilities

An implemented delegation component in Agent Rails; production adoption is not established here.

• Evaluate delegation and revocation failure cases across trust boundaries

• How should availability and revocation freshness trade off?