Securing Agent-to-Agent Delegation in .NET: A Practical Design

using System.Security.Cryptography; using System.Text.Json; public sealed record Scope( string[] Actions, // e.g. "payments.send" string[] Recipients, // allowed payees or email addresses decimal MaxAmount, int MaxDepth, // how many more delegations are allowed DateTimeOffset Expires) { public const string Any = "*"; // only for an agent's own standing policy, never a user ticket static string[] Meet(string[] a, string[] b) => a.Contains(Any) ? b : b.Contains(Any) ? a : a.Intersect(b).ToArray(); static bool Covers(string[] parent, string[] child) => parent.Contains(Any) || child.All(parent.Contains); public Scope Intersect(Scope other) => new( Meet(Actions, other.Actions), Meet(Recipients, other.Recipients), Math.Min(MaxAmount, other.MaxAmount), Math.Min(MaxDepth, other.MaxDepth), Expires < other.Expires ? Expires : other.Expires); // A child scope must be inside its parent and use up one level of depth. public bool IsWithin(Scope parent) => Covers(parent.Actions, Actions) && Covers(parent.Recipients, Recipients) && MaxAmount <= parent.MaxAmount && MaxDepth < parent.MaxDepth && Expires <= parent.Expires; } 

public static class Crypto { static readonly JsonSerializerOptions Json = new() { PropertyNamingPolicy = JsonNamingPolicy.CamelCase }; public static byte[] Canonical<T>(T value) => JsonSerializer.SerializeToUtf8Bytes(value, Json); public static string Hash<T>(T value) => Convert.ToHexString(SHA256.HashData(Canonical(value))); public static string PublicKey(ECDsa key) => Convert.ToBase64String(key.ExportSubjectPublicKeyInfo()); public static string Sign<T>(ECDsa key, T value) => Convert.ToBase64String(key.SignData(Canonical(value), HashAlgorithmName.SHA256)); public static bool Verify<T>(string publicKey, T value, string signature) { using var key = ECDsa.Create(); key.ImportSubjectPublicKeyInfo(Convert.FromBase64String(publicKey), out _); return key.VerifyData(Canonical(value), Convert.FromBase64String(signature), HashAlgorithmName.SHA256); } } 

public sealed record Block(Scope Scope, string Task, string HolderKey, string PrevHash); public sealed record SignedBlock(Block Block, string Signature); public sealed record DelegationChain(IReadOnlyList<SignedBlock> Blocks) { public string RootId => Crypto.Hash(Blocks[0].Block); // The user signs the root and names the first agent as holder. public static DelegationChain Issue(ECDsa userKey, Scope scope, string intent, string firstAgentKey) { var root = new Block(scope, intent, firstAgentKey, PrevHash: ""); return new([new SignedBlock(root, Crypto.Sign(userKey, root))]); } // The current holder narrows and hands off. Rule 2: parent ∩ requested ∩ delegatee's own. public DelegationChain Delegate(ECDsa holderKey, Scope requested, Scope delegateeOwn, string subtask, string delegateeKey) { var parent = Blocks[^1].Block; if (parent.Scope.MaxDepth <= 0) throw new InvalidOperationException("Delegation depth exhausted."); var scope = parent.Scope.Intersect(requested).Intersect(delegateeOwn) with { MaxDepth = Math.Min(Math.Min(requested.MaxDepth, delegateeOwn.MaxDepth), parent.Scope.MaxDepth - 1) }; var block = new Block(scope, subtask, delegateeKey, Crypto.Hash(parent)); return new([.. Blocks, new SignedBlock(block, Crypto.Sign(holderKey, block))]); } } 

public sealed record VerifyResult(bool Ok, string Reason, Scope? Scope = null, string? HolderKey = null); public static class ChainVerifier { public static VerifyResult Verify(DelegationChain chain, string userPublicKey, DateTimeOffset now) { if (chain.Blocks.Count == 0) return new(false, "empty chain"); for (var i = 0; i < chain.Blocks.Count; i++) { var (block, sig) = (chain.Blocks[i].Block, chain.Blocks[i].Signature); var signer = i == 0 ? userPublicKey : chain.Blocks[i - 1].Block.HolderKey; if (!Crypto.Verify(signer, block, sig)) return new(false, $"bad signature at hop {i}"); if (block.Scope.Expires <= now) return new(false, $"expired at hop {i}"); if (i > 0) { var parent = chain.Blocks[i - 1].Block; if (block.PrevHash != Crypto.Hash(parent)) return new(false, $"broken link at hop {i}"); if (!block.Scope.IsWithin(parent.Scope)) return new(false, $"scope widened at hop {i}"); } } var last = chain.Blocks[^1].Block; return new(true, "ok", last.Scope, last.HolderKey); } } 

public sealed record ToolAction(string Action, string Recipient, decimal Amount); public sealed record Receipt(string RootId, string ChainHash, ToolAction Action, string Decision, string Reason, DateTimeOffset At); // Starts each root at the root ticket's MaxAmount; implement with an atomic decrement in Redis or SQL. public interface IBudgetStore { Task<bool> TryConsumeAsync(string rootId, decimal amount); } public interface IReceiptLedger // append-only; e.g. a SQL ledger table { Task AppendAsync(Receipt receipt); } 

var builder = WebApplication.CreateBuilder(args); builder.Services.AddReverseProxy().LoadFromConfig(builder.Configuration.GetSection("ReverseProxy")); builder.Services.AddSingleton<IBudgetStore, RedisBudgetStore>(); builder.Services.AddSingleton<IReceiptLedger, SqlReceiptLedger>(); var app = builder.Build(); var userKeys = app.Configuration.GetSection("TrustedUserKeys"); // user id -> public key app.Use(async (ctx, next) => { var budgets = ctx.RequestServices.GetRequiredService<IBudgetStore>(); var ledger = ctx.RequestServices.GetRequiredService<IReceiptLedger>(); // 1. Read the chain, the proof and the body. var chain = JsonSerializer.Deserialize<DelegationChain>( Convert.FromBase64String(ctx.Request.Headers["X-Delegation"].ToString()))!; var userKey = userKeys[ctx.Request.Headers["X-User"].ToString()]!; ctx.Request.EnableBuffering(); var body = await new StreamReader(ctx.Request.Body).ReadToEndAsync(); ctx.Request.Body.Position = 0; var action = JsonSerializer.Deserialize<ToolAction>(body, new JsonSerializerOptions(JsonSerializerDefaults.Web))!; async Task Deny(string reason) { await ledger.AppendAsync(new(chain.RootId, Crypto.Hash(chain), action, "deny", reason, DateTimeOffset.UtcNow)); ctx.Response.StatusCode = StatusCodes.Status403Forbidden; await ctx.Response.WriteAsync(reason); } // 2. Verify the chain back to the user's signature. var result = ChainVerifier.Verify(chain, userKey, DateTimeOffset.UtcNow); if (!result.Ok) { await Deny(result.Reason); return; } // 3. Proof of possession: the final holder signed this exact body. if (!Crypto.Verify(result.HolderKey!, body, ctx.Request.Headers["X-Agent-Proof"].ToString())) { await Deny("caller is not the chain holder"); return; } // 4. The action must fit the final scope. var scope = result.Scope!; if (!scope.Actions.Contains(action.Action)) { await Deny("action not allowed"); return; } if (!scope.Recipients.Contains(action.Recipient)) { await Deny("recipient not allowed"); return; } if (action.Amount > scope.MaxAmount) { await Deny("amount over limit"); return; } // 5. Shared budget across the whole delegation tree. if (!await budgets.TryConsumeAsync(chain.RootId, action.Amount)) { await Deny("tree budget exhausted"); return; } await ledger.AppendAsync(new(chain.RootId, Crypto.Hash(chain), action, "allow", "ok", DateTimeOffset.UtcNow)); await next(); }); app.MapReverseProxy(); app.Run(); 

public sealed class DelegationHandler(ECDsa agentKey, string userId) : DelegatingHandler { public static readonly HttpRequestOptionsKey<DelegationChain> ChainKey = new("chain"); protected override async Task<HttpResponseMessage> SendAsync( HttpRequestMessage request, CancellationToken ct) { if (!request.Options.TryGetValue(ChainKey, out var chain)) throw new InvalidOperationException("No delegation chain attached to this request."); var body = request.Content is null ? "" : await request.Content.ReadAsStringAsync(ct); request.Headers.Add("X-User", userId); request.Headers.Add("X-Delegation", Convert.ToBase64String(JsonSerializer.SerializeToUtf8Bytes(chain)));Source：https://dev.to/kamal1910/securing-agent-to-agent-delegation-in-net-a-practical-design-44no
My favorites