Introducing ID-JAG & HDP: How to Safely Let Your AI Agent Delegate to Others

What happens if an AI agent you tasked with planning your vacation freely interacts with hotel and flight booking agents, handing over your credit card information? As multi-agent workflows—where AI delegates tasks to other AI—accelerate, cryptographic authentication standards are emerging as a crucial way to prevent privilege abuse during these complex handoffs. Here is a breakdown of the new security safeguards that make it possible to let your AI assistant delegate tasks with confidence.

Why Traditional Logins Fail in the Age of Agents

The "social login" or authentication methods we use daily are designed under the premise that a real human is always sitting in front of a screen. They require dynamic human intervention, such as clicking a login button in a browser or entering a 2FA code via smartphone.

However, in multi-agent environments where AI agents act and decide on their own, this workflow completely breaks down. If a main agent had to prompt the user to "Approve this?" every time it called a sub-agent for a reservation, the autonomy—the primary benefit of using an agent—would disappear entirely.

That said, letting agents blindly trust each other without any verification is dangerous. If a sub-agent in the middle of a chain falls victim to a clever prompt injection attack, it could lead to a serious security breach where the powerful master permissions granted by the user are fully compromised.

ID-JAG and AAT: Safeguards for Granular Access

The latest security standards emerging to address this are ID-JAG and Attenuated Authorization Tokens (AAT).

To use a simple analogy, it’s like creating a "single-use gift card that can only be spent at a specific department store food hall for exactly $50 today" instead of handing someone your entire credit card. It’s a structure that safely hands over only the necessary permissions to a sub-agent.

AAT, in particular, is a smart technology that allows sub-agents to further narrow down delegated permissions even when the network connection is lost. Thanks to Tenuo, an open-source Rust-based engine that simplifies this process, developers can now safely manage token permissions even in complex multi-agent services.

Recently, Anthropic also actively adopted these standards to further strengthen the security of its Model Context Protocol (MCP). By introducing the ID-JAG standard to an Enterprise Managed Authentication (EMA) environment, they've ensured that when Claude accesses business tools like Jira or Slack, users can pass on the necessary permissions smoothly and securely without having to deal with cumbersome manual login prompts.

HDP Protocol — "Did a human really authorize this?"

How can we prove that a payment or sensitive data modification performed by a sub-agent was truly authorized by the original user? In complex chains where AI calls other AI, there is always a risk of malicious commands being injected along the way.

The HDP (Human Delegation Provenance, draft-helixar-hdp-agentic-delegation-00) protocol, proposed by Helixar Labs and others, is a smart tracking system that solves this problem. It works by accumulating cryptographic signatures, much like a shipping label getting confirmation stamps as it moves from one handler to the next.

This protocol utilizes Ed25519 key pairs to generate a lightweight yet robust signature chain. This allows for verification that these actions originated from the initial user’s approval—even when offline—ensuring the legitimacy of the final action.

AgentBound: Constraining the Bounds of Thought

Beyond cryptographic permission management, there is a need for technology that physically binds an agent's behavioral radius. Announced in June 2026, AgentBound is a real-time behavioral governance technology that constrains how agents actually operate.

This technology embeds specific behavioral rules when issuing one-time tokens to agents. This ensures that even if a malicious prompt is injected and the agent tries to deviate, it is physically impossible for the agent to exceed its pre-designed reasoning paths or tool execution scope.

For example, using the open-source permission engine Tenuo, you can easily restrict the scope of a database tool's permissions for a specific agent within a Model Context Protocol configuration file.

{
  "mcpServers": {
    "secure-database": {
      "command": "npx",
      "args": ["-y", "@tenuo-ai/db-connector"],
      "env": {
        "TENUO_ALLOWED_SCOPES": "read:profile"
      }
    }
  }
}

Open-source developer communities like AutoGen are also actively discussing combining cryptographic signatures with these behavioral constraint layers. This is because we can only fully trust our assistants once we go beyond checking "whose command is this?" to actually constraining the agent's "scope of action."

The Last Puzzle for the True 'Top-Tier Assistant'

To experience AI agents that go beyond writing emails to handling important business decisions and payments on our behalf, "secure delegation" is essential. Security technologies like ID-JAG and HDP may not be visible, but they act as the underlying strength that allows agents to collaborate safely. Just as we confidently use credit cards on payment networks, I look forward to seeing the secure multi-agent future that these technologies will build.