Delegation#

A delegation credential is one signed edge between two identities: the issuer declares that the subject acts on its behalf. It is how an organisation's or a person's identity can vouch for an agent identity it runs. Credentials are the official optional profile ace:delegation:1; normative rules: Delegation profile.

It grants nothing. A credential carries no execution, payment or communication right; verifiers decide what, if anything, it means for them. Revocation is by not renewing: a credential lasts at most seven days and the issuer re-issues it.

Shape#

{ "issuer": "ace:sha256:…", "subject": "ace:sha256:…", "issuedAt": 1760140800, "expiresAt": 1760745600, "signature": { "scheme": "ml-dsa-65", "seq": 1, "value": "…" } }

The issuer signs with its current ML-DSA-65 signing key (action ace:delegation:1). The subject publishes up to four credentials, one per issuer, in its descriptor extension ext["ace:delegation:1"] = {credentials}. A peer verifies a credential itself, against its own lookup of the issuer: Delegation profile.

With the CLI#

# On the issuer
ace delegation issue <subject-ace-id> --days 7 --out cred.json
 
# On the subject
ace delegation add cred.json      # looks the issuer up, verifies, publishes it in the descriptor ext

The file is the bare credential, without a key event log; the issuer must be published. With delegation in both sides' profiles (ace network configure --profiles text,delegation), the issuer can also hand it over as an ace:delegation:1 message {credential}.

SDKs#

SDK functions: TypeScript, Python and Swift SDK references.

The words controller (issuer) and delegate (subject) are informal; the protocol has no role enumeration.