HDP

The Problem HDP Solves

Modern AI agents act autonomously: they call APIs, execute code, spawn sub-agents, and move data across systems. A single human instruction at the start of a session can trigger dozens of downstream actions. By the time any individual action executes, nothing in the execution context carries a verifiable record of what the original human authorized.

This is the delegation gap. Security systems cannot distinguish authorized agent behavior from compromised agent behavior. Audit trails are incomplete. Accountability is impossible.

How HDP Compares

Every existing approach addresses part of the delegation problem. None address all of it. HDP is designed to fill the gap, not replace the surrounding stack.

Protocol Design

HDP is infrastructure, not a policy engine. It deliberately stops at capture, structure, and verification. What systems do with delegation context — enforcement, scoring, threat detection — is explicitly out of scope.

Token Schema

An HDP Token is a JSON object with four top-level sections plus a signature. The root is immutable once signed. The chain is appendable: each delegation hop adds a record without modifying what came before.

Example Token

{
  "hdp": "0.1",
  "header": {
    "token_id": "tok_01HXYZ...",
    "session_id": "sess_01HABC...",
    "issued_at": 1743000000000,
    "expires_at": 1743086400000,
    "version": "0.1"
  },
  "principal": {
    "id": "user-uuid-xxxx",
    "id_type": "uuid"
  },
  "scope": {
    "intent": "Research recent MCP vulnerabilities and summarize findings.",
    "authorized_tools": ["web_search", "read_file"],
    "authorized_resources": ["https://cve.mitre.org/*"],
    "data_classification": "internal",
    "network_egress": true,
    "persistence": false,
    "max_hops": 3,
    "constraints": [
      { "type": "action_count", "params": { "tool": "web_search", "max_count": 20 } }
    ]
  },
  "chain": [
    {
      "seq": 1,
      "agent_id": "orchestrator-01",
      "agent_type": "orchestrator",
      "timestamp": 1743000001000,
      "action_summary": "Searching CVE database for MCP server vulnerabilities.",
      "parent_hop": 0,
      "hop_signature": "..."
    }
  ],
  "signature": {
    "alg": "Ed25519",
    "kid": "key-1",
    "value": "base64url-encoded-signature"
  }
}

How Signing Propagates

Each delegation hop extends the chain by appending a new hop record signed over all prior state. Any verifier can independently reconstruct and check the entire chain without contacting any external service.

Verification Steps

A verifier must perform these steps in order. Passing all steps is required to return VALID.

Transport and Integration

HDP tokens travel alongside agent invocations. The transport mechanism is framework-specific, but HDP recommends standard field names for common agent frameworks.

X-HDP-Token: <base64url-encoded token>

# Token-by-reference (large tokens):
X-HDP-Token-Ref: <token_id>

Scope Boundaries

These are permanent design decisions, not temporary gaps. Understanding what HDP does not do is as important as understanding what it does.

Implementation Guidance

Recommendations for implementers. These are non-normative guidance, not requirements.

Design Decisions

Key design questions from v0.1. Resolved items are closed. Open items are active areas for community discussion and implementation feedback via the GitHub repository.

Resolved

Open for community input