Cross-Tenant Delegation

Enable AI agents to operate across organizational boundaries with cryptographic delegation chains.

Cross-Tenant Delegation

Cross-tenant delegation allows an agent owned by one organization to perform actions within another organization’s Truthlocks tenant — with full audit trails and revocable authorization.

Use Cases

• Managed service providers operating agents on behalf of clients
• Supply chain partners sharing verification data across organizations
• Platform integrators running agents that span multiple customer tenants
• Consulting firms performing compliance checks across client environments

Delegation endpoints have an interactive API playground. Open the Guardrails & Delegation API reference and click Send to try it against the Sandbox.

How it works

┌──────────────┐         ┌──────────────┐
│  Tenant A    │         │  Tenant B    │
│  (Delegator) │         │  (Delegate)  │
│              │  offer  │              │
│  Agent X ────┼────────►│  Agent Y     │
│              │         │  (accepts)   │
│              │ accept  │              │
│              │◄────────┼──            │
└──────────────┘         └──────────────┘
         │                       │
         ▼                       ▼
  delegation_id            scoped_token
  audit_trail              limited_ttl

Delegation Flow

Step 1: Offer Delegation

curl -X POST https://api.truthlocks.com/v1/delegations/cross-tenant/offer \
  -H "X-API-Key: $TENANT_A_API_KEY" \
  -d '{
    "from_agent_id": "maip-agent:01JAAAA",
    "to_tenant_id": "tenant_B",
    "scopes": ["receipts:write", "attestations:read"],
    "constraints": {
      "max_actions_per_hour": 100,
      "ip_allowlist": ["10.0.0.0/8"],
      "expires_at": "2026-05-01T00:00:00Z"
    },
    "require_trust_score_above": 70,
    "metadata": {
      "purpose": "Quarterly compliance audit",
      "approved_by": "[e-mail]"
    }
  }'

Response:

{
  "id": "maip-delegation:01JDDDD",
  "status": "pending",
  "from_agent_id": "maip-agent:01JAAAA",
  "to_tenant_id": "tenant_B",
  "scopes": ["receipts:write", "attestations:read"],
  "offer_expires_at": "2026-04-13T00:00:00Z"
}

Step 2: Accept Delegation

curl -X POST https://api.truthlocks.com/v1/delegations/cross-tenant/accept \
  -H "X-API-Key: $TENANT_B_API_KEY" \
  -d '{
    "accepting_agent_id": "maip-agent:01JBBBB",
    "acknowledge_constraints": true
  }'

Response:

{
  "id": "maip-delegation:01JDDDD",
  "status": "active",
  "delegated_token": "mdt_live_...",
  "effective_scopes": ["receipts:write", "attestations:read"],
  "expires_at": "2026-05-01T00:00:00Z"
}

Step 3: Execute Cross-Tenant Actions

curl -X POST https://api.truthlocks.com/v1/receipts \
  -H "Authorization: Bearer mdt_live_..." \
  -d '{
    "type": "compliance.check.completed",
    "subject_id": "vendor_456",
    "payload": { "result": "pass", "checks_run": 12 }
  }'

Security Model

Constraints

Constraint	Description
max_actions_per_hour	Rate limit for delegated actions
ip_allowlist	Network restrictions
expires_at	Hard expiration date
require_trust_score_above	Minimum trust score to maintain delegation
scopes	Subset of the delegating agent’s scopes

Audit Trail

All cross-tenant actions generate dual audit entries — one in each tenant’s audit log:

{
  "event": "delegation.action",
  "delegation_id": "maip-delegation:01JDDDD",
  "acting_agent": "maip-agent:01JBBBB",
  "acting_tenant": "tenant_B",
  "target_tenant": "tenant_A",
  "action": "receipts:write",
  "timestamp": "2026-04-06T14:30:00Z"
}

Revocation

Either party can revoke a delegation at any time:

curl -X DELETE https://api.truthlocks.com/v1/delegations/maip-delegation:01JDDDD \
  -H "X-API-Key: $API_KEY" \
  -d '{ "reason": "Engagement concluded" }'

Revocation is immediate — all in-flight requests using the delegated token are rejected.

Best Practices

1. Time-bound all delegations — Never create open-ended delegations
2. Minimum viable scopes — Only delegate the scopes actually needed
3. Trust score requirements — Set require_trust_score_above to at least 70
4. IP restrictions — Always use ip_allowlist for production delegations
5. Monitor delegation activity — Set up webhooks for delegation.* events
6. Regular review — Audit active delegations quarterly

Next steps

Agent Authorization

Scope-based authorization and session management.

AI Orchestration

Multi-agent workflow execution with delegation support.