The Delegation Economy Nobody Planned For
Everything useful an AI agent does, it does on somebody’s authority. An agent that books travel spends your money. An
Cooperation has a price. We build what lowers it.
Open infrastructure for working together without a middleman. We steward Endo, support the Agoric ecosystem, and are building an open standard for delegating authority to AI agents.
What cooperation is worth
Most of the value in an economy comes out of arrangements between parties who have no particular reason to trust each other. A supplier extends credit. A firm lets a contractor into its systems. Two companies share data that neither would publish.
Every one of these has a price, and the price is exposure: what you stand to lose if the other side misbehaves.
Containerized shipping lowered that price. So did letters of credit, escrow, and public key cryptography. Most of the gain went to people who had nothing to do with building them, which is why mechanisms like these get built so rarely. The benefit spreads across everyone who cooperates. The cost lands on whoever does the work.
Most agents hold far more authority than they need
Everything useful an AI agent does, it does on somebody's authority. An agent economy is a delegation economy, and the number of delegations is climbing by orders of magnitude. Most happen with no person in the loop. Many happen between parties who have never met.
Here is a case from our own work. A coding agent needs to read design documents in Google Workspace, so it gets Google Workspace. All of it. Later the same account starts an agent to analyze transaction history, and that agent arrives able to issue transactions, because one grant was all there was to hand it.
The analysis needs to read. Nothing in that stack lets anyone say so.
When a stack can't limit what an agent holds, all anyone can do is watch what it does. That is where the guardrail industry came from.
What an answer has to do
Four requirements come straight out of those failures. Any candidate has to meet them, ours included.
-
Authority that narrows.
A holder can cut down what it holds and pass the smaller version on without going back to the issuer. Read the design docs, not the whole Workspace.
-
Delegation that survives a trust boundary.
A grant keeps working when it crosses into an organization that shares no administrator, no directory, and no legal jurisdiction with the granter.
-
Revocation that fits how organizations work.
Cutting a grant sometimes has to cascade through everything delegated beneath it. Sometimes it has to leave long-lived arrangements standing. Which one applies is decided when the grant is made.
-
Accountability without an identity lookup.
What an agent was permitted to do should be readable from the structure of its authority, with no registry to consult.
OAuth, cloud IAM, sandboxes, Macaroons, UCAN and AP2 each cover part of this. None of them handles revocation the way organizations work. Neither do object capabilities, the approach we know best. That gap is what our research program exists to close.
Why a foundation has to build it
Infrastructure for cooperation among independent parties can't be owned by one of them. A cooperation layer run by a single platform is one more intermediary everyone is obliged to trust, and the obligation deepens as adoption grows. The parties who would gain most each capture a sliver of a benefit that only exists once everyone can use the thing. So nobody builds it.
The builder has to be disinterested, and the output has to be open. The work also has an end: a specification, a reference implementation, a conformance suite, and enough adoption to carry on without us. A foundation fits the first part. A Focused Research Organization fits the second.
The record is the argument
When the internet arrived, the question was how machines under no common owner could cooperate. Mark Miller's research on object-capability security and the E language is what most current work in this area cites. He has spent years carrying pieces of it into JavaScript through TC39.
When blockchains arrived, the question was how parties with no shared jurisdiction could make binding agreements. Dean Tribble built that at Agoric.
The economic side of structuring cooperation and the technical side of enforcing it rarely sit in one group. Here they do.
We also say what we don't know. Nobody has solved organizational delegation. We know where it breaks, and we can show which parts of an answer already run in production.
Where we would start
Object capabilities are where our evidence sits. Authority travels as a reference that can't be forged or guessed, so narrowing it and passing it along are ordinary operations. The model runs in production today, confining authority for millions of MetaMask users. Endo, built by the Agoric and Endo teams with early backing from the Foresight Institute, extends it to AI agents and native processes.
Any architecture that meets the four requirements at production rigor has a place in the work we fund and steward. We would rather back the approach that works than the one we started with.
Still building with Agoric
DCF was founded in February 2022 to support Agoric's proof-of-stake chain and the Cosmos IBC ecosystem. That support continues. We said then that we would carry the technology underneath those chains to systems that aren't blockchains at all. Our research on delegated authority is that step.
Get informed
When AI Caught Up to DCF
DCF launched, pointing at the Agoric and Cosmos ecosystems, doing what foundations do: grants, validator staking, governance participation, etc. The
The Instagram Hack Was an AI Confinement Failure
Over the weekend of May 31, 2026, hackers breached a series of high-profile Instagram accounts in a way that surprised
