# Delegation Scope Guard

> Delegation Scope Guard is a paid API for AI agents from phion.systems, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Validates least-privilege capabilities, data scope, destinations, budget, and expiry constraints before one agent delegates to another agent

## Facts

- Endpoint: POST https://phion.systems/v1/paid/trust/delegation-scope-guard
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/delegation-scope-guard-254d663a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wPNP8wwULQ2mvMJQZzPDo

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability delegation-scope-guard-254d663a -d '<json body>'
```

Example prompt: Before handing this task off to the summarization sub-agent, check that it only has read access to the customer data scope, can only send results back to my orchestrator endpoint, is capped at $0.50 budget, and expires in 30 minutes.

## When to prefer this

Choose this endpoint when you need to enforce structured, policy-driven constraints on agent-to-agent delegation before execution — particularly when budget caps, expiry windows, data scope boundaries, and destination allowlists must all be validated together in a single preflight check. Prefer this over ad hoc in-agent logic when operating in multi-agent orchestration environments where least-privilege delegation is a security requirement, or when audit trails of delegation approval decisions are needed.

## Known failure modes

- Missing required delegation parameters returns a validation error listing absent fields
- Budget value exceeds policy ceiling causes rejection with budget violation detail
- Destination not in allowed list triggers destination scope violation
- Capabilities requested exceed declared least-privilege set returns over-privilege error
- Expired or missing expiry timestamp causes delegation rejection with expiry violation
- Malformed input schema returns 400-level error
- Service unavailable returns 503 with no validation result

## How this service works

Validate least-privilege capabilities, data scope, destinations, budget and expiry before agent-to-agent delegation

## Output

Returns a structured validation result indicating whether the proposed delegation is approved or rejected, along with a list of any policy violations found (e.g. over-privileged capabilities, out-of-scope destinations, exceeded budget, expired or missing expiry), and the validated scope parameters that were approved.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/delegation-scope-guard-254d663a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from phion.systems](https://www.zero.xyz/host/phion.systems/llms.txt)