Expiring AI agent delegation policy

The control gap

Delegated authority should end with the task window instead of surviving as a reusable agent permission.

Set delegation expiry from the operational window, then make request approval shorter when infrastructure state changes quickly. Identity exchange should reject an expired delegation even if the principal secret remains valid. A previously minted identity token must also carry its own short expiration and cannot extend the delegation.

Expiration does not revoke downstream actions already completed. Preserve the action receipt and outcome after the identity token and delegation expire. For early termination, disable the principal or add an emergency deny rule; revocation workflows should be tested separately from normal time-based closure.

A delegation record should identify the delegating human or workload, the receiving agent, the task, allowed tools and resources, and the maximum chain depth. Every child delegation must be narrower than its parent. Endram rejects a child that adds a repository, environment, action, or lifetime the parent never possessed.

Clock handling is part of the security boundary. Validate issuer time, not-before time, absolute expiry, and a small documented skew allowance. Store timestamps in UTC and test both sides of every boundary. Long-running work should request a new delegation instead of silently refreshing authority after the original task window.

Operationally, expose expiring delegations beside active identities so owners can see what will terminate next. Alert before expiry only when unfinished work exists; automatic renewal would defeat the control. The audit trail should distinguish natural expiry, manual revocation, parent revocation, and policy rejection.

What good looks like

A narrow policy that can be tested in shadow mode, reviewed with owners, and promoted to enforcement with measurable impact.

• Match the concrete action "deploy" rather than every operation exposed by the tool.
• Scope the target to the release task represented by the signed delegation and the production environment.
• Require a request-bound approval that expires and cannot be reused.
• Record denied attempts as well as approved executions.

A production workflow

1. Copy the template and replace example identities and resource selectors.
2. Run it in shadow mode against representative requests.
3. Review false positives, missing resource attributes, and approver routing.
4. Enable enforcement for one agent and expand only after reviewing the decision log.

A policy you can test

Expiring AI agent delegation policy is a concrete starting point, not a claim that one generic rule fits every environment. Replace example identities and selectors, validate the request shape, and begin in shadow mode.

name: expiring-agent-delegation
match:
  identity_verified: true
  task: release-428
  tool: deploy.production
decision: require_approval
approval:
  reviewers: ["release-managers"]
  expires_in: 10m

Endram keeps the policy version with every decision. A later change creates new evidence instead of rewriting why an earlier request was permitted.

Evidence to require

• Every attempted deploy, including denied requests.
• The exact the release task represented by the signed delegation selector evaluated by policy.
• The requesting agent, delegated user, reviewer, and timestamps.
• Policy version, matched rule, decision reason, and execution result.

Buyer checklist

• Does the selector cover only the intended production resources?
• Who owns the approval queue outside business hours?
• What is the acceptable approval expiry?
• Which emergency identity may bypass the rule, and how is that use audited?