Engineering Verifiable Delegated Authorisation for Multi-Principal Agent Populations: Design, Instrumentation and Five Lessons from ZK-Mercury

Abstract

Populations of autonomous agents belonging to mutually distrusting organisations increasingly act on one another's behalf, yet no deployed mechanism answers, with evidence, whether a given agent was authorised for a given action and by whom. The authorisation layer we describe is deliberately indifferent to how an agent decides: it authorises the type of an act, never the reasoning that produced it, and the same construction therefore serves a symbolic planner, a belief-desire-intention runtime with a language model proposing its plans, and a plain deterministic service. What is not indifferent is the deployment pattern. Delegation chains are now built at run time rather than designed, sub-agent identities live and die inside a single task, and calls cross administrative domains as ordinary behaviour — and where the proposing component is stochastic, the option of trusting a delegator to bound itself disappears altogether. This paper reports the design, implementation and instrumentation of ZK-Mercury, a working accountability layer for such populations, and the engineering knowledge obtained from building it. We derive six requirements from the deployment context, record eight design decisions together with the alternatives rejected and the consequences accepted, and describe an implementation comprising a separable cryptographic engine, five attesting agents integrated into a running multi-agent runtime, a fail-closed reception path, and a verifier deployed on a public test network and exercisable read-only by any reader. The central design decision is to treat the proof system as a replaceable component behind one interface, which converts the artefact into an instrument: five distinct systems are measured over a single delegation relation under identical instrumentation — three of them proving it in full, two proving a stated fragment of it. We report an arithmetic circuit of approximately 9,151 constraints per delegation hop, constant-size proofs of 723 bytes, and verification of that proof at approximately 2.1 × 10⁵ gas measured under a local virtual machine, with the verifier itself deployed on a public test network, together with an explicit account of two confounds that make cross-system figures provisional. We report the measured cost of five instrumented trade-offs, among them the finding that verification cost is not monotone in scope expressiveness — prefix patterns cost more than an order of magnitude above flat sets and some seventeen times above numeric constraints, because cost follows the decision procedure rather than the expressiveness ordering. Five lessons are distilled, three of them negative: per-depth circuit instantiation leaks delegation depth through the choice of verification key; privacy and revocation do not compose without an in-circuit accumulator; a proof of this form attests to authorisation structure rather than to current validity; and maintaining both a cleartext enforcement path and a proof path forces the discipline we state as accept if and only if provable. We measure our own baseline against two deployed alternatives on the same host and report that it is the slowest and largest of the three, together with what that number does and does not mean. We mark throughout which figures are measured and solid and which are prototype, including two adapters that prove strict fragments of the delegation relation and which we therefore do not claim prove delegation.