Delegated Identity and Authorization Across Agent Workflows

The problem

• As a request passes through assistants and orchestrators, the user’s identity gets lost.
• The service at the end sees a service account, and the user and the app hold different permissions.

What MACAW does

• Carries Maya’s signed identity through every hop of a $48,000 payment.
• Requires Priya’s approval, and Priya sees Maya, not a service account.
• Refuses Sam, who has no payment role, and an app without payment consent.

What’s different

• The end user’s authority, verified at every hop.
• Role, app consent and approval checked separately.
• Signed decisions form a chain of authorization.

Policy and deployment

Policy

Payments need the writer role and payment consent. Over $25,000 needs Priya.

Deploy

The SecureAI adapters or the macawClient SDK in your app, with policy in the MACAW control plane.