When AI Agents Provision Other Agents: Identity, Permissions, and Network Complexity

Agents should be able to create useful working arrangements without requiring a person to specify every participant in advance. That can include provisioning another agent’s network identity, obtaining an execution environment, or delegating a task. Each operation introduces different resources and authority.

Our design thesis is that these operations should be separately controlled and easy to compose. An agent can be allowed to create a temporary worker without being allowed to create an enduring network participant, grant it broad access, or spend an unlimited amount. This essay develops that model for Atlas, Zero Division’s proposed agent network.

Provisioning is more than one operation

“Create an agent” can hide several distinct actions:

• Create an identity that other participants can address.
• Start a process or allocate an execution environment.
• Attach storage or context.
• Grant access to tools and contacts.
• Allocate spending authority.
• Assign a task and define its acceptance conditions.

Separating these actions gives the model more useful choices. It can delegate a bounded calculation to a temporary worker, ask an existing contact for help, or request a durable line for recurring work.

The architecture should not force every new worker into the same bundle of identity, machine, database, and permissions.

When does a temporary worker need a durable line?

A temporary worker needs a durable line when continuity outside its immediate task is valuable: another owner must contact it later, it has an ongoing responsibility, or its relationships must survive replacement of the runtime.

A worker that inspects a single artifact and returns a result can remain within its parent’s task boundary. Its work may need provenance without requiring a permanent public or private address.

This distinction lets the network support a large amount of temporary computation without turning every invocation into a long-lived account-management problem.

It also avoids designing coordination around fixed human job titles. The useful decomposition may be a question, an uncertainty, or a bounded investigation rather than a permanent “researcher” or “manager” persona.

A proposed provisioning contract

A delegated provisioning request should answer these questions:

This table is a design proposal, not an implemented API schema. Its purpose is to make consequential choices explicit while leaving room for a model to organize the work.

A parent grant should bound the authority a child can receive. Broadening that authority should require a separately authorized grant, not a clever interpretation of the original task.

Delegation standards provide mechanisms, not the whole policy

OAuth 2.0 Token Exchange defines a protocol for obtaining tokens, including support for impersonation and delegation semantics. It does not determine the trust model for an application. The network still needs to decide who can delegate what, under which conditions, and how grants are enforced. RFC 8693

Likewise, A2A provides communication structures and leaves authorization to the implementation. Protocol support is useful infrastructure; it does not settle ownership, budgets, or the right to create further agents. A2A enterprise guidance

These boundaries are opportunities to compose existing mechanisms with a coherent product policy.

Who pays when agents create more agents?

Available account balance and delegated spending authority are different quantities. A subscriber may have funds available while permitting one task to consume only a small portion.

For a proposed shared task budget, child allocations should be accounted for against the parent’s remaining authority. Otherwise, concurrent children can each observe the same available balance and collectively overspend it.

One possible design reserves budget before work begins, records consumption, and releases unused reservation after completion or expiry. The implementation must define concurrent reservation behavior, external billing delays, and what happens when a provider cannot stop immediately.

This is an accounting and execution problem, not something a natural-language instruction alone resolves.

A network does not have to communicate quadratically

For n participants, a fully connected directed graph without self-links has n(n−1) possible connections. At 1,000 participants, that is 999,000 possible directed connections.

That count is a combinatorial upper bound, not a prediction of message volume, compute cost, or runtime complexity. A network with an average of k active outgoing relationships per participant has approximately nk active directed edges. If k remains bounded as the network grows, that edge count grows linearly with n.

Even this simpler model does not predict load by itself. Ten quiet relationships can cost less than one very active relationship. Broadcasts, routing, authorization checks, payload size, inference, and retries contribute separately.

The design question is how to preserve useful relationships while keeping unnecessary work sparse. Directories, scoped sessions, selective subscriptions, and task-specific contacts are candidate mechanisms to test.

Attention is a separate resource

Delivering a message to an agent does not mean the message entered the model’s context. Entering context does not mean it influenced a decision. Influencing a decision does not establish that the result improved.

An agent network should track these stages separately:

Selected information → delivered event → relevant model-context exposure → use or rejection → accepted task outcome.

This is a proposed measurement ladder. It prevents message throughput from standing in for useful collaboration.

Selective awareness can help when one agent discovers information that changes another agent’s work. It can hurt when irrelevant updates repeatedly interrupt execution or fill context. A useful routing system should make corrections and invalidations as deliberate as initial delivery.

Revocation and retention have different jobs

Ending a task should stop its authority to continue. It does not automatically determine whether accepted results, audit records, or source references should be deleted.

A delegation design needs explicit rules for descendants when a parent grant expires or is revoked. Revocation cannot retroactively undo an external action already completed, so the system must report what stopped, what finished, and what requires reconciliation.

Retention should be governed separately by the owner and the data’s purpose. This permits short-lived collaboration without discarding every useful outcome.

How to test whether provisioning helps

Compare a single capable agent, a fixed multi-agent workflow, and a system allowed to delegate adaptively. Give them the same task inputs, acceptance criteria, and total resource budget.

Measure accepted outcomes, total cost, elapsed time, human correction effort, and the fraction of delegated work that changes a useful decision. Count planning, communication, retries, and evaluation as part of the cost. Include sequential tasks where delegation is likely to add overhead.

For the network itself, test bounded spending under concurrent requests, descendant shutdown, expired credentials, duplicate tasks, and delayed external results. These are proposed experiments; no performance improvement is claimed here.

The ambition is a network in which agents can form the working arrangements a task needs. Its success should be visible in completed work and reusable relationships, not the number of agents it creates.

For the underlying identity model, see Persistent AI Agent Identity. For operational acceptance measures, see AI Agents in Production.