Offer Delegation
Guardrails & Delegation
Offer Cross-Tenant Delegation
Offer a scoped trust delegation to an agent in another tenant.
POST
Offer Delegation
Creates a cross-tenant trust delegation offer. Trust delegations allow agents in one tenant to grant specific, scoped permissions to agents in another tenant — enabling secure multi-organization AI workflows without sharing credentials.
Delegation offers are time-limited and scope-restricted. The target tenant must explicitly accept the offer before the delegation becomes active. All delegation lifecycle events are recorded in the transparency log.
Delegation Constraints
Authentication
string
required
API key with
delegations:offer scope. Alternatively, pass a Bearer JWT token
in the Authorization header.string
required
Tenant identifier of the offering party.
Request
string
required
MAIP agent identifier of the agent offering the delegation.
string
required
Tenant identifier of the target organization that will receive the delegation
offer.
string[]
required
Array of permission scopes being delegated (e.g.
datasets:read,
models:read, orchestrations:execute). The accepting agent will only have
access to these specific scopes.integer
Maximum re-delegation depth. Range:
1 to 3. Defaults to 1 (no
re-delegation). A value of 2 allows the accepting agent to re-delegate to
one additional party.integer
Time-to-live in hours. Range:
1 to 24. The delegation expires
automatically after this period. Defaults to 1.string
Human-readable description of why this delegation is being offered. Recorded
in the audit trail.
Response
string
Unique delegation offer identifier.
string
Delegation status. Always
offered on creation.string
The agent that created the offer.
string
Tenant of the offering agent.
string
Target tenant that may accept the offer.
string[]
Delegated permission scopes.
integer
Maximum re-delegation depth.
string
ISO 8601 timestamp when the offer expires if not accepted.
string
ISO 8601 timestamp of creation.
Authorizations
API key for machine-to-machine authentication
Body
application/json
Delegating agent
Receiving agent
Scopes to delegate (must be subset of delegating agent scopes)
Delegation time-to-live in seconds (max 7 days)
Required range:
60 <= x <= 604800Conditional constraints on the delegation
Response
Delegation offered
Available options:
offered, active, expired, revoked Delegation acceptance token (returned on offer)

