The interoperability protocols carry a delegation perfectly well. What none of them carries is the rule that says whether the delegation was allowed in the first place — who may be admitted, who may invite, who may be removed, who holds which role. Delegatic is two things with one name, and the difference matters: a policy kernel that is deployed and answering, with an empty policy store; and a governance platform that is specified and not built. Every claim below says which one it belongs to.
The claim this page was drifting toward — that the interoperability protocols cannot delegate — is false, and the source we would have cited for it says the opposite in as many words. It is corrected out loud here rather than quietly avoided. The real gap is narrower, and it is stronger for being narrower.
Was this delegation actually permitted?
allow_actions list and an optional agents allowlist. Nothing is implicitly granted: an unset key is denied, not inherited as true.:agent_not_allowed · :not_in_allowlistdeny_actions entry beats the allowlist on conflict. Separately, every issued authorization carries a TTL capped by the policy — max_ttl_seconds, 600 by default — so authority lapses on its own. Expiry is not revocation: a block already issued stays valid until its TTL runs out.:denied_by_policy · :expiredrequire_approval_by, and the MCP get_policy tool reports it. And nothing enforces it. The authorize path checks the denylist, the agent allowlist and the action allowlist, then signs whatever approved_by the caller asserted. The field is stored and published; it is not a check. This is the honest state of the fourth word, and it is written down here because a governance kernel that quietly ignores its own approval field is worse than one that never offered it.approval_field_enforced · pending, and it is the nearest real advance available to this surfaceThis is the only thing on the page you can check without reading a specification. It is printed exactly as it came back.
$ curl -s https://delegatic-mcp.fly.dev/health {"status":"ok","version":"0.1.0","service":"delegatic","policies_registered":0}
Eight modules, three test files, forty-two tests — twenty-five unit, three integration, fourteen across the six MCP tools. FleetPrompt calls delegatic_authorize to authorize an install; the kernel answers with a signed, expiring authorization block, or with one of five typed refusals. Every one of those counts was derived by counting the tree at the commit named in the status block above, not copied out of a planning document.
policies_registered: 0. Nobody has written a policy into the deployed store, which is in-memory ETS and empty on every cold start — a Postgres-backed store is a future additive release, not a thing that exists. It runs on Fly today because that is where it was put, and the standing direction moves compute off Fly, so treat the hostname as this month's address rather than the product.Everything in this section and the two below it is a design. The containment tree, the cascade, the invariants: specified in docs/spec/README.md and written nowhere else. The worked example is an illustration, not a screenshot of a running system, and it is drawn as a table for that reason.
maxAgents: 500 · telespaceAttach: true · externalAPI: true — the owner sets the outer boundary. Everything below can move inward from here and nowhere else.
maxAgents: 200, tightened. telespaceAttach and externalAPI inherited. A child that states nothing states its parent.
maxAgents: 50 and externalAPI: false, both tightened. Two levels down, still strictly inside both ancestors.
maxAgents: 5 · externalAPI: false · telespaceAttach: false. An attempt to set externalAPI: true here is rejected — it would widen a parent restriction, and that is a privilege escalation whichever direction it is written from.
Organisations nest in a strict tree — no cycles, enforced at write time. Each org has at most one parent. The structure is the authorization model rather than an index over it.
Policies cascade down the tree. Children can tighten but never widen a parent restriction. Monotonic inheritance makes privilege escalation impossible by design rather than by audit.
No implicit permissions. Every capability must be granted explicitly at some level of the tree. Unset is denied. No confused-deputy attacks.
Every policy mutation, every delegation decision, every access attempt is logged immutably. The audit trail is the compliance artifact; there is no second document to keep in step with it.
Delegatic stores org IDs, telespace IDs, policy rules and GoalGraph goal_id references. It never copies agent configs, messages, execution logs or goal content — only opaque IDs. Zero data duplication.
Escalation paths for low-confidence decisions, and an override on any agent decision with full audit logging. Humans set the structure; agents operate inside it.
These are properties the specification says hold at every level of the containment tree, verified on every write. Nothing verifies them today, because the containment tree is not implemented — the deployed kernel is flat: one policy, one action type, one agent filter. These are stated as design, and the gate on this page refuses any wording that would let them read as behaviour.
Every org has at most one parent. Cycles are rejected at write time with a traversal check. Maximum depth 50, maximum 10,000 nodes; an attempt to create a cycle returns CONFLICT. spec §4 · ADR-0001
A child's effective policy is always at least as tight as its parent's. Attempting to widen — setting externalAPI: true where the parent says false — is rejected as a privilege escalation. Delegatic governs authorization boundaries; the κ invariant in Graphonomous determines where deliberation is structurally meaningful within those boundaries. spec §3.5 · ADR-0002
No capability is implicitly granted. If a policy key is unset at any level, the effective value is denied. Explicit grants are required at every boundary. This one is real in the deployed kernel — it is the rule behind :not_in_allowlist. spec §3.4
Every mutation — policy change, org creation, delegation grant, override — logged with actor, timestamp, previous value and new value. Logs are immutable. spec §3.6
Delegatic defines the boundary; the rest of the stack works within it. The rungs differ wildly and the list says so — a stack diagram that draws eight products as equal peers is drawing a wish, and this one is a list precisely so it cannot.
Org hierarchy, policy inheritance, authority delegation. The kernel is deployed with an empty store; the platform is specified.
Agent capability contracts and acceptance criteria.
Telespaces, rooms, and agent team communication.
Bidding, debate and quorum over contested work. A specification, and its page says so.
Argumentation-based consensus. A specification, and its page says so.
Agent skill marketplace and component registry. It is the one caller of delegatic_authorize today.
Continual learning engine — the memory the rest of the stack reads from.
Managed infrastructure. Its own page is being rewritten; do not take anything here as a claim about it.
The kernel is live_deployed and there is exactly one thing to do with it. The page above it is spec, and a specification has nothing to run. The publication gate refuses to emit a call to action the rung has not earned, which is why there is no button here inviting you to try a governance platform that does not exist.
spec.“Enterprise governance. Open-source core. Launching 2026.” stood here, above an email box wired to nothing — no form, no handler, no destination. It is August. Both are gone rather than moved to a later year. A footer mailto: went with them in this revision: Cloudflare was rewriting it at the edge for obfuscation, which is the entire reason the served page measured 159 bytes larger than the file in this repository.
The kernel is deployed and the page above it is a specification, so the most useful thing a visitor can send is a containment rule that does not hold, an invariant that is weaker than it reads, or a number on this page you think is wrong.
This box is not that one. The retraction above names what the old one lacked. This is a plain <form action method="POST"> posting to formspree.io when you press Send, so it delivers with scripting switched off entirely; the script that upgrades it to an inline reply prints “sent” only after the endpoint returns a 2xx, and prints what went wrong otherwise. Ruled 2026-08-17: the same endpoint computedriven.com uses. The publication gate still refuses any address link anywhere on this page.