Follow a scoped grant from a principal to an agent, then to a delegate. Withdraw the parent grant and inspect why the next local action stops.
Current local handoff authorization. This walkthrough uses the public Python SDK, synthetic participants, and a local counter. No model is called and no external action occurs. Every run creates a fresh relationship.
Eight moments to inspect
Valid scoped grant and local handoff.
Valid bounded delegation and local handoff.
Delegation rejected because the delegator lacks the capability.
Parent revocation blocks a descendant.
A peer says GO; permission is still missing.
Agents agree; consensus still grants no authority.
Unresolved authority requires review or abstention.
A prepared ALLOW becomes stale before local handoff.
Run with the local SDK
This static page explains the scenarios. It does not simulate SDK results. From the current repository checkout:
Open http://127.0.0.1:8765/agentic.html. Command-line equivalent: python playground/agentic_experience.py.
Checking for the local SDK adapter…
Step
SDK decision
Local executor entries
Governance trace
Run versions, provenance and checks
Inspect permission, not persuasion.
The principal, subject, resource, purpose, validity window and parent grants explain each decision. An active child record alone is insufficient: its ancestry must remain valid.
BLOCK is the SDK decision. Clarification, reauthorization or abstention are suggested next steps, not actions automatically performed by this page.
A bounded demonstration
The check occurs at the synchronous local handoff. Remote queues, independent stores and real-world identity require their own participating deployment boundaries. The ten-minute fixture window is illustrative.
Passing these scenarios does not demonstrate reduced real-world misalignment.