Repository navigation
Cryptographic scope enforcement for Squad agent roles #662
Description
Squad assigns roles (lead, frontend dev, backend dev, tester) to agents in a repository. Each role has specific responsibilities defined in markdown. But the enforcement is prompt-based — an agent in the "tester" role could theoretically modify production code if it decided to.
The Agent Passport System (Apache 2.0) provides cryptographic enforcement of role boundaries:
| Squad concept | Current enforcement | With APS |
|---|---|---|
| Role assignment | Markdown instructions | Ed25519 signed delegation with scope |
| Role boundaries | Prompt-based ("you are a tester") | Cryptographic scope enforcement (tester delegation covers only tests/) |
| Cross-role actions | Possible if agent ignores instructions | Impossible — delegation chain check fails before action |
| Audit trail | Git history | Signed 3-signature receipts (intent → policy decision → execution proof) |
| Revocation | Remove agent from config | Cascade revocation — revoking lead invalidates all sub-delegations |
How it would work with Squad:
squad initcreates an Ed25519 identity for each agent alongside the AGENTS.md files- The lead agent receives a delegation from the human developer with full project scope
- Sub-delegations to frontend/backend/tester agents carry cryptographically enforced scope limits
- Every PR action is verified against the delegation chain before execution
- If the tester agent tries to push to
src/api/, the delegation check fails and the action is blocked
This is enforcement, not guidelines. The agent physically cannot exceed its delegated scope.
The protocol is lightweight (Ed25519 + canonical JSON), has both TypeScript and Python SDKs, and ships as an MCP server (120 tools) that any MCP-compatible agent can call.
- SDK:
npm install agent-passport-system(v1.27.0, 1634 tests) - Python:
pip install agent-passport-system(v0.7.0) - MCP server: 120 tools
- GitHub: https://github.com/aeoess/agent-passport-system
- Paper: https://doi.org/10.5281/zenodo.18749779
I run three agents from different creators (Claude, GPT, OpenClaw) that collaborate on development work daily using this protocol. Happy to discuss integration.
Activity
github-actions commentedon Mar 28, 2026
📋 Assigned to Flight (Lead)
Issue: #662 — Cryptographic scope enforcement for Squad agent roles
Flight will pick this up in the next Copilot session.
github-actions commentedon Mar 28, 2026
🏗️ Squad Triage — Flight (Lead)
Issue: #662 — Cryptographic scope enforcement for Squad agent roles
Assigned to: FIDO (Quality Owner)
Reason: Issue relates to testing/quality work
@copilot evaluation: 🔴 Not suitable — issue involves work outside the coding agent's capability profile.
Team roster:
squad:flightsquad:proceduressquad:eecomsquad:fidosquad:paosquad:capcomsquad:controlsquad:surgeonsquad:boostersquad:gncsquad:networksquad:retrosquad:incosquad:guidosquad:telemetrysquad:voxsquad:dskysquad:simssquad:handbooksquad:ralphsquad:copilotdiberry commentedon Mar 31, 2026
🔄 Ralph status: Feature — cryptographic scope enforcement. No PR. Future/backlog — security-critical, needs design.
fix(tui): bump secondary text contrast and wire table wrapping (githu…
bradygaster commentedon May 18, 2026
Closing — interesting proposal but far beyond current scope. Squad uses prompt-based role enforcement by design. Cryptographic enforcement would require fundamental architectural changes and a third-party dependency. Filing away — will revisit if the project's threat model evolves to need this.