HumanRoot

Delegation Root Certificate for Autonomous Agents

Every agent action traces back to a human decision. HumanRoot makes that traceable, provable, and legally defensible.

---

The Problem

Autonomous AI agents send emails, execute API calls, write to databases, and delegate tasks to other agents. Yet the moment a human delegates authority to an agent is entirely informal — a checkbox, a system prompt, an API key.

When a chain of agents acts — Agent A delegating to Agent B delegating to Agent C — the original human intent disappears entirely.

HumanRoot solves this with a single primitive: the Delegation Root Certificate (DRC).

---

Install

pip install humanroot

Quickstart

fromhumanrootimportdelegatedrc=delegate(
human_id="alice@example.com",
agent_id="my-agent-v1",
scopes=["email.read", "calendar.write"],
expires_in="24h",
)
# DRC propagates automatically through all agent callsagent.run(task, drc=drc)

---

What is a DRC?

A Delegation Root Certificate is a signed, structured, machine-readable record of a human delegation act. It guarantees:

Property	Guarantee
Non-repudiation	Human principal cannot deny having issued the delegation
Scope-binding	Actions constrained by explicit scopes — anything outside is unauthorized
Causal traceability	Every action → DRC → parent DRC → human. Always reconstructible
Restriction-only	Sub-delegations may only restrict, never expand, parent authority
Provider-agnostic	Works across OpenAI, Anthropic, LangChain, CrewAI, custom agents
Revocability	Any DRC revoked instantly, cascades to all children

---

Framework Integrations

Anthropic Claude

fromhumanrootimportdelegatefromhumanroot.integrations.anthropic_claudeimportHumanRootAnthropicdrc=delegate(human_id="alice@example.com", agent_id="claude-agent",
scopes=["text.generate"], expires_in="1h")
client=HumanRootAnthropic(drc=drc)
response=client.messages.create(
model="claude-opus-4-6",
max_tokens=1024,
messages=[{"role": "user", "content": "Summarise this contract."}],
)

OpenAI

fromhumanroot.integrations.openai_chatimportHumanRootOpenAIclient=HumanRootOpenAI(drc=drc)
response=client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": "Draft this email."}],
)

LangChain

fromhumanroot.integrations.langchainimportdrc_runnable, DRCCallbackHandler# Option A: wrap any Runnablesecured_llm=drc_runnable(llm, drc)
result=secured_llm.invoke([HumanMessage(content="Hello")])
# Option B: non-invasive callbackresult=llm.invoke(input, config={"callbacks": [DRCCallbackHandler(drc)]})

CrewAI

fromhumanroot.integrations.crewaiimportdrc_crewcrew=drc_crew(Crew(agents=[...], tasks=[...]), drc)
result=crew.kickoff()

---

Sub-delegation

Agents can delegate to other agents — but only within the bounds of their own authority:

fromhumanrootimportsub_delegate# Agent A delegates to Agent B with reduced scopechild_drc=sub_delegate(
parent_drc,
agent_id="agent-b",
scopes=["email.read"], # subset of parent scopes onlyexpires_at=parent_drc.expires_at-timedelta(hours=1),
)

Rules enforced automatically:

• Child scopes ⊆ parent scopes (expansion forbidden)
• Child expiry ≤ parent expiry
• Delegation depth decrements at every hop
• root_hash always points to the human-signed origin

---

CLI

# Generate a key pair
humanroot keygen --out ./keys
# Issue a DRC
humanroot issue \
--human-id alice@example.com \
--agent-id my-agent-v1 \
--scopes email.read calendar.write \
--expires-in 24h \
--key ./keys/private.pem \
--out drc.json
# Verify a DRC file
humanroot verify --drc-file drc.json --pubkey ./keys/public.pem
# Inspect a delegation chain (requires server)
humanroot chain --drc-id <uuid># Revoke a DRC and all children
humanroot revoke --drc-id <uuid> --reason "key compromised"# Check revocation status
humanroot status --drc-id <uuid>

---

API Server

pip install "humanroot[server]"
uvicorn server.app:app --reload --port 8001

Endpoints:

Method	Path	Description
POST	/drc/issue	Issue a root DRC
POST	/drc/sub-delegate	Sub-delegate from existing DRC
GET	/drc/{id}	Fetch a DRC
GET	/drc/{id}/chain	Full delegation chain
POST	/drc/revoke	Revoke DRC + children
GET	/drc/{id}/status	Revocation status
GET	/drcs	List all DRCs

Interactive docs: http://localhost:8001/docs Dashboard: http://localhost:8001/dashboard

---

Cryptography

HumanRoot uses ES256 (ECDSA P-256) — lightweight, widely supported, no external PKI required.

fromhumanrootimportgenerate_keypair, sign_drc, verify_drcpriv, pub=generate_keypair()
signed_drc=sign_drc(drc, priv)
assertverify_drc(signed_drc, pub)

---

Design Principles

• No blockchain — cryptographic signing does not require a shared ledger
• No centralized authority — any party can issue and verify DRCs independently
• No action content — DRCs authorize; they do not log what agents actually did
• No government identity required — human_id is any stable identifier you control
• Provider-agnostic — the standard is independent of any AI provider or cloud

---

Project Structure

humanroot/
├── humanroot/ # Core SDK
│ ├── models.py # DRC data model
│ ├── crypto.py # ES256 sign/verify
│ ├── chain.py # Sub-delegation + chain validation
│ ├── delegate.py # Public API: delegate()
│ └── cli.py # CLI entry point
├── integrations/ # Framework integrations
│ ├── anthropic_claude.py
│ ├── openai_chat.py
│ ├── langchain.py
│ └── crewai.py
├── server/ # FastAPI server
│ ├── app.py
│ ├── db.py # SQLite persistence
│ └── revocation.py # Revocation with cascade
├── dashboard/ # Web UI — chain explorer
│ └── index.html
├── tests/ # 30 tests
└── spec/ # Formal specification
└── DRC-SPEC-0.1.md

---

Spec

The formal DRC specification is in spec/DRC-SPEC-0.1.md.

Open questions, contributions, and objections welcome:

• github.com/Thinklanceai/humanroot
• info@thinklanceai.com

---

License

MIT