Architecture Reference for governed execution in multi-agent systems. The authenticated control plane through which work is submitted, executed, observed, verified, and retired.
Overview: Three Concerns at the Gateway
Transport Translation
Agents speak REST or MCP; the Gateway maps every inbound request onto NATSClient Secure Channel functions over D-DDN. Callers never require a NATS client.
Authority Resolution
Every operation resolves through SCCheckAndResolve() against D-DDN entity and RDID state before any NATS traffic occurs. Unauthorized callers cannot resolve a channel to route to.
Execution Governance
Flow submission, bidding, task execution, verification, and monitoring are engine operations exposed through scoped REST and MCP surfaces, with every state transition written to D-DDN as an immutable event.
Position in the Framework
Entrelid does not replace an orchestration framework — it governs what agents built on any framework are permitted to do, and produces the record proving what they did.
Framework Layer Responsibilities
Gateway Architecture
Single Go Process
On startup: establishes persistent D-DDN connection via ConnectAPI(), pre-registers channel set through SetupSecureChannels() to obtain the RDID map, attaches the engine, and starts transport listeners.
Transport Listeners
- REST :8080 — 26 routes across six functional surfaces (OpenAPI 3.1.0)
- MCP :8082 — v1.x & v2.x semantics
- Native NATS — sc.gateway.{ch} with SCCheckAndResolve()
- gRPC :9090 and WebSocket :8081 — specified, not in current build
Transport Endpoint Map
Transport-specific credentials — REST Bearer token, MCP session token, NATS request headers — are normalized into the APIToken struct consumed by the Secure Channel API.
The Execution Envelope
The central governance construct. Each unit of delegated work is issued a bounded envelope of four secure channels, each with its own RDID and its own access grant — making least privilege real rather than declarative.
Four Envelope Channels
Delegation
Delegator → Delegatee — Task assignment, scoped inputs, capability grant.
Results
Delegatee → Delegator — Structured artifacts returned for verification.
Monitoring
Delegatee → Observers — Progress events, heartbeat, status transitions.
ToolAccess
Delegatee → Tool Services — Scoped invocation of exactly the tools the task requires.
Envelope Lifecycle
Authority attenuates monotonically down the delegation chain. A delegatee cannot grant capability it does not itself hold — enforced by RDID derivation, not a check that could be skipped.
FlowSpec: Authored Task DAGs
What a FlowSpec Contains
- tasks[] — TaskSpec entries: RequiredCapabilities, DependsOn, ExecutionModel, ContextPrompt, VerificationPrompt, MonitoringMode, VerificationPolicy
- agents[] — Agent registrations eligible to bid
- routing — Assignment and fan-out behavior
- verification — VerifyDef: default policy plus rules[]
Key Properties
Specs are persisted through the flowstore package into D-DDN under a provisioned FlowRegistry catalog entity as append-only events.
Because the DAG is declared before execution, the entire capability chain can be derived and attenuated at authoring time — the delegation graph is known before the first agent runs.
Flow Execution Path
RunFlow() executes a spec deterministically, bypassing LLM decomposition. RunTask() handles single-task submission. Both have ...AndWait() variants for synchronous callers.
Execution Stage Breakdown
Register & Barrier
Agents registered; awaitBidPools blocks until SC run-scoped bid pools exist.
Decompose DAG
DecomposeTask routes by ExecutionModel; pipeline path starts the fan-out watcher.
Bid & Assign
PublishTaskForBidding posts to the run-scoped bid pool. acceptBidForTask issues a just-in-time scoped envelope to the winner.
Execute
executeTask dispatches to the tool branch (InvokeTool) or analysis branch (ExecuteAnalysisTask).
Verify & Complete
performVerification validates the artifact against policy; failure returns the task to bidding. Terminal event emitted; envelopes retired.
Monitoring & Streaming
Two-Request Model
POST /task/run returns 202 with a stream_url. GET /task/{id}/stream drains the run's event channel as SSE. Events route through a per-run sink map keyed by run-ID prefix — multiple concurrent observers each receive the full stream.
Staleness Watchdog
Tasks declaring MonitoringMode: continuous are covered by a watchdog at monitor_interval_secs × 2, emitting AGENT_UNRESPONSIVE when a delegatee goes quiet.
Silence is a governed condition, not an absence of signal.
Governed Multi-Stage Analysis over REST
The reference flow — sf-pipeline-analysis-flow — runs three dependent stages: extract pipeline records, score account health, write an executive briefing.
Submit
Client POSTs /task/run; receives 202 + stream_url
Bid & Execute
Agents bid on stage 1; winner receives scoped envelope and DCT; result returns on Results channel
Verify & Release
Engine verifies result artifact; on pass, releases stage 2 with verified artifact injected as input
Observe
Client consumes SSE stream throughout; retrieves stored artifact from D-DDN on completion
MCP Tool Execution Bridge
MCP clients invoke tools through the Gateway's MCP surface. Each tool maps to a distinct secure channel with its own RDID — a token may grant a subset of tools, enforced at SCCheckAndResolve rather than in tool-side logic.
Tool Squatting Fails Structurally
An unregistered or unauthorized tool has no resolvable channel to be invoked through, regardless of how it advertises itself.
Scoped Tool Access
Within a governed flow, the invoking token is the task's DCT and the reachable tool set is the envelope's ToolAccess grant.
Human Verification Gate
How It Works
Tasks whose verification policy routes to human review park in TaskVerifying and emit VERIFICATION_PENDING, identifying the assigned validator. A scoped operator endpoint — POST /task/{id}/verify — records the human verdict through the same path as automated verification.
Why It Matters
The verdict is attributed to a specific registered entity in the immutable record. Human sign-off is part of the delegation chain, not a step outside it.
External Agent Participation
An external party can be granted exactly one task's worth of authority, for exactly its duration, with every action attributable — and be fully disarmed the moment the envelope closes.
A bidder outside the trust boundary discovers a task posting, by monitoring its SC, without access to its payload, bids on capability alone, and receives a just-in-time scoped RDID only on acceptance. Execution proceeds inside an envelope revoked at teardown.
Security Considerations
Scoped Tokens
Every agent receives the minimum-privilege token for its work. The Gateway's admin token is never shared with an agent and never leaves the process.
Inner-Channel Opacity
Resolved inner subjects must never be returned to a caller. Leaking it would allow a caller to bypass resolution.
Per-Direction RDIDs
Bidirectional communication uses separate channels with independent RDIDs. Revoking write access in one direction does not disturb read access in the other.
Message Expiry
expireSecs on publish enforces temporal boundaries on sensitive payloads, bounding replay windows and limiting retention of stale data in D-DDN.
Additional Security Controls
Rate Limiting
Per-token limits enforced at the transport layer so a compromised agent cannot flood a channel it is otherwise authorized on.
Transport Encryption
Production deployments must enable TLS on the NATS connection via nats.Secure() or nats.RootCAs(). Not enabled by default in the current ConnectAPI implementation.
Known Exposure — Timing Side Channel
Opaque NOTFound responses are uniform in content but not yet uniform in latency. An observer timing responses precisely may distinguish a missing document from an unauthorized one. Tracked for future treatment.
Audit Durability
Expiry-driven deletion is currently recorded only in the server log. Emitting deletions to the audit topic is required before any deployment where the record must be complete.
Implementation Maturity
Run Isolation Model
How Isolation Works
The engine is shared and runs concurrent flows. Run isolation is achieved by run-prefixing task identifiers — task IDs and depends_on references alike — under a shared D-DDN actor identity.
What It Avoids
No per-run credentials or process-per-run required. The bid window polls and accepts early once a usable bid exists rather than sleeping the full window.
Cascading Revocation
Completion or revocation retires an envelope in a single RDID operation that cascades — every channel and every downstream authority derived from the envelope stops resolving.
No Revocation List
There is no revocation list to distribute and no set of grants to enumerate.
Monotonic Attenuation
Authority attenuates monotonically down the delegation chain — enforced by RDID derivation, not a check that could be skipped.
Instant Disarm
External agents are fully disarmed the moment the envelope closes — no residual authority remains.
The Core Separation
What an agent is instructed to do vs. what it is able to do.
Belongs to the Runtime
What an agent is instructed to do — the prompt, the model, the context assembly. This is the orchestration framework's domain.
Belongs to Entrelid
What an agent is able to do — authority resolved before routing, issued in bounded envelopes, verified at every stage boundary, retired in a single cascading operation.
Three Properties Enterprises Require
Bounded by Construction
The delegation chain is declared before execution. The entire capability chain is derived and attenuated at authoring time.
Attributable End to End
Every state transition is written to D-DDN as an immutable event. Every action is attributed to a specific registered entity.
Revocable in Flight
A single RDID operation cascades through the entire envelope — channels, downstream authority, and all derived grants stop resolving instantly.
Summary
The Entrelid Agent Delegation Gateway resolves authority before routing, issues it in bounded envelopes with per-hop attenuation, verifies structured artifacts at every stage boundary, and retires authority in a single cascading operation.
What results is a delegation chain that is bounded by construction, attributable end to end, and revocable in flight — the three properties an enterprise requires before it will let an autonomous agent near a system that matters.
Entrelid™ Agent Delegation Gateway