Broker
A2A Gateway
When one agent calls another, the caller's identity, scope, and approval context travel with the request and can only narrow. A sub-agent cannot acquire authority its caller never had.
The problem
Multi-agent systems delegate, and delegation is where authority quietly accumulates. A planner with read-only access calls a worker that runs as the platform service account, and the constraint is gone.
Capabilities
How A2A Gateway works
- 01
Monotonic scope reduction
Delegated scope is a subset of the caller's, enforced at the gateway. Privilege cannot be regained by going one hop deeper.
- 02
The chain is the principal
Policy evaluates the full delegation chain, so a rule can require that nothing in the path ever touched restricted data.
- 03
Cross-boundary delegation
Agents belonging to different teams — or different organisations — interoperate with a mutually verifiable identity and an explicit, revocable grant.
- 04
Loop and depth control
Delegation depth, fan-out, and cycles are bounded, so a recursive planner degrades into a refusal instead of an outage.
In practice
What it looks like
orchestrator can read the repo, can read the database └─ hands work to code-reviewer can read the repo ✓ narrower └─ hands work to test-runner wants to WRITE to the database ✗ denied Nothing in the chain ever held database write access, so noagent further down it can acquire that access — however manyhops deep the request goes. Denied · dec_01JQ8FA2M4 · recorded against the full chainLimits
What this does not do
- Both ends must speak through the gateway. An agent that shells out to another agent's process directly is a runtime-security concern, not a delegation one.
- Cross-organisation delegation requires both parties to run a control plane and to have exchanged trust material. It is a deliberate federation step, not something that happens implicitly.
Get started
Let the agents do real work.
Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.
Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.