HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
This paper introduces the Human Delegation Provenance (HDP) protocol, a lightweight, offline-verifiable cryptographic scheme that ensures accountability in agentic AI systems by cryptographically binding human authorization to multi-hop delegation chains through signed tokens, addressing a critical gap left by existing standards like OAuth 2.0 and JWTs.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you hire a master chef (the Human Principal) to cook a complex meal for a dinner party. The chef doesn't cook everything themselves; they delegate tasks to a sous-chef, who delegates to a line cook, who finally asks a dishwasher to grab a specific spice.
In the world of Agentic AI, this is exactly what happens. A human gives an AI a big goal, and that AI breaks it down, handing off tasks to other AIs, which hand them off to tools that actually do the work (like sending an email, moving money, or deleting a file).
The Problem: The "Telephone Game" of Trust
The paper argues that in this modern AI world, there is a massive accountability gap. If the dishwasher accidentally burns the house down, who is responsible?
- Did the human actually want the dishwasher to touch the stove?
- Did the sous-chef give a fake order?
- Did a hacker sneak in and whisper a command to the dishwasher (a "prompt injection")?
Currently, there is no standard way to trace the order back to the human. It's like a game of "Telephone" where the message gets distorted, and by the time the action happens, no one knows who really said "Go."
The Solution: HDP (The "Digital Passport" for AI Tasks)
The authors propose a new protocol called Human Delegation Provenance (HDP). Think of HDP as a tamper-proof, digital passport that travels with every single task the AI performs.
Here is how it works, using simple analogies:
1. The "Sealed Envelope" (The Token)
When the human gives the first instruction, they don't just say "Do this." They sign a digital document (a token) that says:
- Who: "I, Alice, am authorizing this."
- What: "I allow you to send emails, but only to my team."
- When: "This is valid for the next 24 hours."
- Session ID: "This is for today's meeting, not yesterday's."
This document is sealed with a unique cryptographic wax stamp (an Ed25519 signature) that only Alice has the key to make.
2. The "Chain of Custody" (The Hop Record)
Now, the AI passes this task to a sub-agent. The sub-agent can't just say "I'm doing it." They must:
- Check the passport to make sure it's real.
- Add their own "stamp" to the bottom of the document, saying, "I received this from the previous agent and I am now passing it to the tool."
- Pass the entire document (with all previous stamps) to the next agent.
This creates an append-only chain. It's like a receipt book where you can't tear out pages or erase ink. If a hacker tries to sneak in and change the order from "Send email" to "Transfer money," the cryptographic seals break, and the next agent sees the document is forged.
3. The "Offline Detective" (Verification)
The coolest part of HDP is that the final agent (the one actually doing the work) doesn't need to call a central server, check a database, or ask a boss for permission.
- They just look at the passport.
- They check the math on the seals.
- They check if the "Session ID" matches the current meeting.
- Result: If the math works, they know for a fact a human authorized this. If the math fails, they stop immediately.
This works even if the internet is down (air-gapped environments), because the proof is right there in the document.
Why This Matters (The "Why Should I Care?")
- Stopping AI Hallucinations & Hacks: If a hacker tries to trick an AI into doing something bad (Prompt Injection), the AI won't have a valid HDP token for that action. The system will see the missing "stamp" and say, "No human authorized this. Stop."
- Legal Safety: If an AI accidentally deletes a company database, regulators can look at the HDP chain and say, "Ah, we can see exactly which human authorized this, what they said they were doing, and where the chain broke."
- No Bureaucracy: Unlike older systems that require constant phone calls to a central authority to check if a token is valid, HDP is self-contained. It's like a driver's license: you don't need to call the DMV every time you drive; the police just check the license itself.
The Bottom Line
The paper introduces HDP as a lightweight, secure way to ensure that when AI agents do things in the real world, we can always trace those actions back to a real human who said "Yes, I want this to happen." It turns the chaotic, invisible chain of AI commands into a clear, unbreakable paper trail.
In short: HDP is the "receipt" that proves the AI didn't just make things up, and that a human actually signed off on the job.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.