Intent-bound action authorization for AI agents

Your agent has a valid credential.
delego makes sure it’s doing the right thing.

Deterministic, per-action authorization bound to the human’s instruction. Approvals a prompt injection can’t re-point. No LLM in the path. Rides your broker; doesn’t replace it.

Get started See it in codeStar
$pip install delego
Apache-2.0 · Python 3.10+ · implements the open spec (protocol 0.3)
No LLM in the decision path
Fail-closed by default
Ed25519-signed audit chain
Intent- & action-bound approvals
Head-anchored, rollback-evident ledger
Apache-2.0, open spec
Why now

Auth was built for humans and static apps.
Agents broke the model.

Agents act on your behalf and autonomously. Login-and-scopes was never built for software that takes actions — and a credential can’t catch a redirected one.

the confused deputya valid credential, pointed at the wrong action
Prompt injection
redirects the agent mid-task
Credential is valid
scope covers the action
delego checks the action
fingerprint ≠ what was approved → deny
// OAuth tokens carry no commitment to the original instruction.
order {amount:2400, destination:internal} → fpr c70d4ee5… approved
order {…, recipient:"attacker"} → fpr dabddc8f… deny
How it works

One decision point. Every action accounted for.

The agent proposes; delego decides — deterministically, no model in the path. Sensitive actions park for a human. Every decision gets a signed receipt.

principal
human or agent
propose
action + instruction
delego
policy · approval · audit
broker
injects credential
service
the upstream API
needs_approvala human approves out-of-band — one fingerprint, used once
Code-forward

Add authorization and a signed audit in a few lines.

One small, deterministic, Apache-2.0 library. No LLM in the path, no credential custody — it rides your broker instead of replacing it.

# first match wins · fail-closed
rules:
  - name: place-order
    decision: needs_approval
    match: { method: POST, path: /orders }
    constraints:
      amount:     { field: amount, max: 5000, currency: USD }
      allow_list: { field: destination, in: [internal] }
default: deny   # anything not allowed is refused
Observability & audit

A signed receipt for every access and every action.

Who did what, when, and under whose authority — a hash-chained ledger you verify and export as compliance evidence. Anchor the chain head externally and verification also proves nothing was rolled back.

Audit ledgerchain verified
0042
POST /ordersexecution · agent:checkout
allow
0041
POST /ordersdecision · agent:checkout
needs_approval
0040
GET /accounts/meexecution · user:alice
allow
0039
POST /permissionsdecision · agent:research
deny
receipt · seq 0042
phaseexecutionoutcomeallowfingerprintc70d4ee5…d4ed394intent_hashec949034…04af46prev_hasha1f0…9c2bsignatureEd25519 ✓
Products

One deterministic core. A toolkit around it.

The core ships today: a library, a CLI, and an MCP server — plus Claude Code agents and skills to operate it. Brokering and identity are next.

available
delego CLI

Initialize delego, draft and inspect policy, work the approval queue, and verify the signed audit chain — from your terminal.

pip install delego
available
MCP server

A FastMCP server exposing propose · resolve · audit tools, so any agent — Claude or any MCP client — routes its actions through delego.

View on GitHub
available
Review agents

Claude Code subagents that adversarially review your policy and broker adapter, and hunt the ledger for anomalies.

View on GitHub
available
Skills

Claude Code skills to set up delego, draft policy, triage approvals, and read the audit trail in plain language.

View on GitHub
coming soon
Vault

A first-party credential broker: the secret is injected only after authorization, never entering the agent’s context.

coming soon
Auth SDK

Identity for humans and agents — sessions, OAuth/SSO, passkeys, and first-class agent principals with scoped, revocable credentials.

Get started

Put delego in front of your agent.

Authorize every action your agent takes — one command with the Claude Code plugin, or a Python library and MCP server in your app.

Using Claude Code
# one command in Claude Code — skills, review agents & the MCP server
/plugin marketplace add Delego-Dev/plugin
/plugin install delego@delego

# initialize the delego home (signing keys + example policy) and verify
/delego:init
Python · pip + MCP
# install the library (+ the optional MCP server extra)
pip install "delego[mcp]"

# initialize the home (signing keys + example policy)
delego --home .claude/.delego init

# see it work — allow, deny, over-cap, approval, the confused-deputy refusal
python examples/demo.py

Building UI too? The @delego shadcn registry ships the decision pill, signed receipt, and theme.

Pricing

Open source today. Hosted control plane next.

The core, CLI, MCP server, and spec are open source forever. A hosted authorizer, approval queue, and dashboard are coming.

Available
Open source
Self-host the core, CLI, MCP & spec
Free
pip install delego
  • Deterministic policy engine
  • Signed, hash-chained audit
  • CLI + MCP server
  • Apache-2.0
Coming soon
Team
Hosted authorizer & approvals
Soon
Coming soon
  • Hosted PDP & approval queue
  • Web approvals & dashboard
  • Exports & retention
  • SSO for your team
Coming soon
Enterprise
Regulated & high-assurance
Soon
Coming soon
  • HSM / KMS signing keys
  • External head anchoring
  • Compliance evidence exports
  • SLA & support