Mandatum keys sequence state to the human at the root of a delegation chain

Per-call authorization stops at the sub-agent line. Each constraint compiles to one bit, has the trigger fired, plus a counter, and the state a chain accumulates stays that size however long it runs ^[9]. The state is keyed by the chain root ^[8]. So a sub-agent spawned by an agent that has read a fork's diff inherits the fired trigger, and its push is denied too; the example test prints the same denial twice ^[7]. The same keying makes `max_invocations` on the sponsor's grant cap the whole chain, so ten sub-agents spend one budget between them ^[25].

What the rule keys on is tags. The policy is a short JSON object that forbids resources tagged `mutating` after any resource tagged `external-content` ^[10]. For the coding agent case, the author says to tag the reads `external-content` and the push `mutating` ^[11]. Someone has to decide that a dependency README is attacker-writable and that a push mutates. Both clauses match on tags, so the constraint applies to a tool only once someone has tagged it ^[27].

The cryptography here is stronger than the deployment assumption. Links commit to their parents by hash, capabilities only narrow going down, and revoking one link kills its subtree and leaves the rest of the chain standing ^[2][4]. The sequence store, though, is in-process only, which the author says means one enforcement point, and two PEPs with separate memories give an agent two histories to spend ^[23].

Attribution is the pitch: in the support-agent example the sponsor is the engineer who approved the session, so the record carries that engineer's name where `svc-support-bot` would have stood ^[24]. There is no audit log yet, the post says ^[22].

The two survey numbers come with their author's own caveats attached. Cloud Security Alliance and Strata Identity, in February 2026, found 28 percent of 285 organizations could reliably trace agent actions to a human or system across all environments ^[15]. Cloud Security Alliance and Aembit, a month later, found 68 percent of 228 could not clearly distinguish agent activity from human activity ^[16]. Both are vendor-commissioned and self-reported, and the first asks whether actions trace to a human or a system, lumping the two together ^[17]. Read the other way, 72 percent of those 285 respondents cannot trace reliably ^[18], and that figure covers actions that trace to no system as much as to no person.

The specification gap the library aims at is as described. MCP's authorization specification covers the transport, how a client gets a token for a server, and does not address which tool that token may call, which agent holds it, or who delegated to whom ^[19]. The Enterprise-Managed Authorization extension has been stable since June 2026 and produces a token scoped to a server, not to a call ^[21]. MCP's authorization interest group has open work on per-tool scopes and on consent across chains of agents ^[20].

For a single-process agent runner with one enforcement point and an AuthZEN engine you already operate, I think the sequence constraint is worth the wiring; the library hands the decision itself to OPA, Cedar or OpenFGA ^[5]. The binding side is less settled. The request mapping covers `tools/call` only, skips the binding's declared mappings and CEL, and carries additions that the conformance document lists as divergences ^[6].