This page is for
An orchestrator calls sub-agents. Sub-agents reach external tools via MCP. When something goes wrong in that chain — wrong decision, data leak, unexpected access — are you still piecing together "who authorized whom for what" from logs and agent memory?
Logs are mutable and fragmented across systems. Do you have a path that keeps the delegation chain itself cryptographically traceable?
- AI platform and product leads rolling out multi-agent orchestration
- Engineering leads building tool ecosystems on MCP servers and A2A protocols
- AI governance leads in regulated industries (finance, healthcare, public sector) where the agent chain has to be auditable
- Teams operating the three layers — delegation scope, tool invocation rights, data access — across organizational boundaries
- Security teams running anomaly detection and monitoring who still see the delegation chain itself as their integrity gap
How Lemma approaches it
At each delegation step in a multi-agent workflow, Lemma generates a ZK proof that binds delegator, delegatee, scope, and timestamp. Proofs are anchored on-chain; each agent operation carries the delegation proof downstream. Tools and APIs verify the cryptographic authority of the caller, not the agent's self-attestation, before responding.
The final output carries a complete proof chain — from the original principal, through every re-delegation node, down to each tool result. When something goes wrong, you don't reconstruct it from logs; each step's authority and data access is already a cryptographic fact you can reference directly.
Where the delegation-proof layer fits into your current agent orchestration and MCP integration is what we map out in a first conversation.
Lemma Discovery Call — Start with a 30-minute conversation
Tell us how your orchestrator and sub-agents are wired today, and where MCP-based tools enter the picture. We'll explore together whether Lemma's delegation-proof layer could fit. No agent implementation or tool spec details required.
If we see a fit, we move to NDA and then into workflow-specific delegation scope design, reference architecture, and PoC design.
A real-world example: who touched that customer record
Picture a financial institution's AI workflow. An orchestrator delegates "credit decision" to a credit-evaluation agent. That agent queries an external credit bureau via MCP, while a second agent reads and formats customer transaction history from the in-house CRM. The orchestrator aggregates the decision at the end.
A few days later, the customer files a disclosure request: "Which agents looked at which fields of my transaction history, and for what purpose?" Even joining internal logs, MCP server logs, and each agent's context history, you cannot cryptographically prove the delegation scope at each step, or whether the data accesses stayed within authority. Reconstruction takes days, and even then the evidence is not non-disputable.
With Lemma in place, the final output carries the full delegation-proof chain — orchestrator → credit agent → MCP tool / CRM-formatting agent. The disclosure request can be answered directly, with no reconstruction: each step's authority and data access is already a cryptographic fact. Every proof is anchored on-chain, so post-hoc tampering is structurally detectable.
Industry-specific delegation scope design, MCP-server and A2A integration patterns, and alignment with regulatory obligations (GDPR data-subject requests, healthcare privacy, financial audit) are shared in the sector-specific kit we send after the consultation call.
Architecture in concept
Lemma does not replace your orchestration framework or your MCP servers. We add a proof at each delegation node and a verification gate on the tool / API side.
Every node's delegation is bound as a ZK proof and passed downstream. Scope can narrow on re-delegation but never widen, and the proof chain grows with each handoff. Tools and APIs verify the caller's cryptographic authority directly — no reliance on agent self-attestation. End-to-end you get a continuous, verifiable path from the original principal to the final action.
Integration with existing orchestration frameworks (LangChain, AutoGen, Claude Computer Use, etc.), MCP / A2A protocol plug-in patterns, and delegation scope-tightening logic design are detailed in the whitepaper and the post-call technical kit.
What Lemma cryptographically guarantees
- The delegator, delegatee, scope, and timestamp of every delegation step
- The monotonic narrowing of scope (re-delegation can tighten but never widen) and the cryptographic binding of the delegation chain
- Cryptographic verification of the caller's authority at every tool / API invocation — no reliance on agent self-attestation
- A continuous, verifiable path from the original principal to the final action, with post-hoc tampering structurally detectable
Ready to issue agent authority as cryptographic attestations — not soft prompts?
Talk to us about your use case. We respond within one business day.