Hire a travel agent, and the agent may quietly pass the hotel search to a booking service, which in turn passes the payment to a processor. You now depend on parties you never chose. Agency law, the body of law governing people who act on someone else's behalf, has been suspicious of that arrangement for centuries. Its maxim is delegatus non potest delegare: a delegate cannot delegate.
AI agents are beginning to hand tasks to other agents. One early sketch of how that should work is an Internet-Draft submitted October 30 to the IETF, the body behind many of the internet's technical standards. Still only a proposal, it asks for something a lawyer would recognize: that "the authority passed at each hop is narrowed to the delegated task rather than broadened." Each agent that receives work should be able to check that its permission traces back to the original person and has not grown along the way.
Narrowing is the part we already know how to build. A 2014 security paper described macaroons, digital permission slips that any holder can restrict before passing them on. Each restriction is cryptographically chained to the one before it, so the next holder can add limits but cannot remove them.
The old law worried about something else. The Restatement of Agency, the standard summary of American agency law, explains in its second edition that a principal relies on the agent's personal qualities. Where a task calls for judgment, the agent you chose cannot substitute someone else's. The exception covers "acts involving no discretion and regarded as mechanical." Your agent could have a clerk type the letter. It could not have the clerk decide what the letter said.
A narrowed permission slip says nothing about that distinction. Ask an agent to find a hotel under $200 near a conference, and it can pass along a slip limited to $200 and one city. The agent downstream still decides what counts as near, whether the cancellation policy matters, and what to give up in exchange. The spending authority shrank, but the judgment moved to a system you never evaluated.
Each handoff could declare what the law has always implied: is this step mechanical, or is it a decision? Mechanical steps could flow freely down a chain. Decisions would need the original person's consent, much as an agent needs authority before appointing a subagent.
There is a second gap. The slip records what an agent may do at the moment of handoff, not whether that permission still holds. The current edition of the Restatement, from 2006, says a subagent's authority ends when it learns that someone above it in the chain has lost theirs. Cancel the first agent, and the third keeps working until the news reaches it. The IETF draft takes cancellation seriously but does not yet say how a stop travels to every slip further down.
Contracts are already handing that problem to the customer. Wells Fargo's online access agreement, effective November 24, asks customers who revoke an agent's access to take steps to stop it and to keep proof that they did. The bank's reasoning, per American Banker, is that granting and withdrawing permission happen where it cannot see. So the job falls to the customer, who has less view of the chain than anyone else involved. A saved stop instruction proves the instruction was sent, not that a subagent three handoffs away ever received it.
Shrinking authority at each handoff is a sound default, and worth building. The chain may also need to record whose judgment made each choice, and to carry a stop to the bottom as reliably as it carried the permission.