Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

KrishnaSaiReddy Patil

Abstract

When Agent A delegates to Agent B, which invokes Tool C on behalf of User X, no existing framework can answer: whose authorization chain led to this action, and where did it violate policy? This paper introduces SentinelAgent, a formal framework for verifiable delegation chains in federal multi-agent AI systems. The Delegation Chain Calculus (DCC) defines seven properties - six deterministic (authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, output schema conformance) and one probabilistic (intent preservation) - with four meta-theorems and one proposition establishing the practical infeasibility of deterministic intent verification. The Intent-Preserving Delegation Protocol (IPDP) enforces all seven properties at runtime through a non-LLM Delegation Authority Service. A three-point verification lifecycle achieves 100% combined TPR at 0% FPR on DelegationBench v4 (516 scenarios, 10 attack categories, 13 federal domains). Under black-box adversarial conditions, the DAS blocks 30/30 attacks with 0 false positives. Deterministic properties are unbreakable under adversarial stress testing; intent verification degrades to 13% against sophisticated paraphrasing. Fine-tuning the NLI model on 190 government delegation examples improves P2 from 1.7% to 88.3% TPR (5-fold cross-validated, F1=82.1%). Properties P1, P3-P7 are mechanically verified via TLA+ model checking across 2.7 million states with zero violations. Even when intent verification is evaded, the remaining six properties constrain the adversary to permitted API calls, conformant outputs, traceable actions, bounded cascades, and compliant behavior.

SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

Abstract

When Agent A delegates to Agent B, which invokes Tool C on behalf of User X, no existing framework can answer: whose authorization chain led to this action, and where did it violate policy? This paper introduces SentinelAgent, a formal framework for verifiable delegation chains in federal multi-agent AI systems. The Delegation Chain Calculus (DCC) defines seven properties - six deterministic (authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, output schema conformance) and one probabilistic (intent preservation) - with four meta-theorems and one proposition establishing the practical infeasibility of deterministic intent verification. The Intent-Preserving Delegation Protocol (IPDP) enforces all seven properties at runtime through a non-LLM Delegation Authority Service. A three-point verification lifecycle achieves 100% combined TPR at 0% FPR on DelegationBench v4 (516 scenarios, 10 attack categories, 13 federal domains). Under black-box adversarial conditions, the DAS blocks 30/30 attacks with 0 false positives. Deterministic properties are unbreakable under adversarial stress testing; intent verification degrades to 13% against sophisticated paraphrasing. Fine-tuning the NLI model on 190 government delegation examples improves P2 from 1.7% to 88.3% TPR (5-fold cross-validated, F1=82.1%). Properties P1, P3-P7 are mechanically verified via TLA+ model checking across 2.7 million states with zero violations. Even when intent verification is evaded, the remaining six properties constrain the adversary to permitted API calls, conformant outputs, traceable actions, bounded cascades, and compliant behavior.

Paper Structure

This paper contains 25 sections, 5 theorems, 2 figures, 9 tables.

Table of Contents

  1. Introduction
  2. Background and Threat Model
  3. Multi-Agent Delegation in Federal Operations
  4. Adversary Model
  5. Delegation Chain Calculus
  6. Delegation Token
  7. Formal Properties
  8. Scope-Action and Output Conformance
  9. Meta-Theorems of the Delegation Chain Calculus
  10. Intent-Preserving Delegation Protocol
  11. Delegation Authority Service Architecture
  12. Protocol Steps
  13. Three-Layer Intent Verification
  14. Federal Compliance Mapping Engine
  15. Evaluation
  16. ...and 10 more sections

Key Result

Theorem 1

The property set $\{P1, \ldots, P7\}$ is minimal. For each $P_i$, there exists a concrete attack $A_i$ that succeeds if and only if $P_i$ is removed while all other properties hold. $\blacktriangleleft$$\blacktriangleleft$

Figures (2)

  • Figure 1: DAS architecture and three-point verification lifecycle. P2 checks intent before delegation, P6 enforces the API manifest at execution, P7 validates output after execution. All checks route through the DAS.
  • Figure 2: Delegation chain walkthrough. Scope narrows at each step (P1). P6 blocks unauthorized API calls; P7 blocks malicious output types from permitted calls. P4 hash linking enables forensic reconstruction.

Theorems & Definitions (15)

  • Definition 1: Delegation Token
  • Definition 2: Delegation Chain
  • proof
  • Definition 3: Tool Manifest
  • Definition 4: Output Schema
  • Theorem 1: Property Minimality
  • proof
  • Proposition 1: Practical Infeasibility of Deterministic Intent Verification
  • proof
  • Theorem 2: Graceful Degradation
  • ...and 5 more