Handoff Workbench

Delegate work between AI agents without surrendering control: bound authority, require exact human approval, reject expansion, and verify completion.

Comment

Handoff Workbench

Inspiration

AI agents are beginning to delegate work to other agents, but most handoffs are still informal. A prompt can describe a task, yet it rarely proves which capabilities, resources, data, recipients, spending rights, or expiration were actually authorized.

That gap becomes dangerous once agents can take action.

We built Handoff Workbench to make agent-to-agent delegation behave like a signed, bounded transaction. The receiving agent gets exactly the authority required for the task, no more, and the completed work returns with durable evidence.

What it does

Handoff Workbench gives developers and operations teams a complete interface for creating, approving, executing, and verifying bounded work between AI agents.

A user can:

  • Define the task, initiating agent, and receiving agent
  • Limit capabilities, resources, data access, recipients, monetary authority, and expiration
  • Compare the principal’s authority, Agent A’s authority, and the proposed authority for Agent B
  • Approve the exact recipient, digest, policy, and version
  • Execute the full create, approve, offer, claim, accept, start, complete, and verify lifecycle
  • Recover the durable workspace after a reload or restart
  • Verify a signed completion receipt
  • Export the handoff, ordered events, receipt, OpenAPI example, cURL request, TypeScript integration, and MCP guidance

The public one-click scenario safely demonstrates a synthetic dependency-security review without credentials or external services.

The adversarial lab also demonstrates six failures, including capability expansion, monetary-authority expansion, wrong recipient, stale version, conflicting idempotency replay, and signature tampering. Every rejection preserves the version and event count, proving that denied authority never changes state.

How we built it

Handoff Workbench is built in TypeScript on Cloudflare Workers.

Cloudflare Durable Objects with SQLite provide isolated, durable lifecycle state. Canonical payloads, cryptographic digests, Ed25519 signatures, exact-version approval, recipient enforcement, idempotency protection, and policy-subset checks form the authorization boundary.

The browser application and API share a same-origin security model. The public demonstration uses isolated server-assigned sessions, strict origin enforcement, bounded quotas, synthetic data, short expirations, and no credential fields.

OpenAPI and MCP interfaces allow the same policy boundary to serve browser users, applications, and AI agents.

The system is tested across Node and Cloudflare Worker runtimes, including lifecycle transitions, restart recovery, concurrency, idempotency, migrations, cryptographic verification, malformed requests, and adversarial authority expansion.

Challenges we ran into

The hardest problem was ensuring that rejection truly meant no change.

A failed authority-expansion attempt could not increment a version, append an event, alter a receipt, or leave behind a partial mutation. The state before and after every rejection had to be identical.

We also had to bind human approval to the exact handoff digest and version. Approval of a similar proposal is not approval of a changed recipient, capability, resource, or monetary limit.

The final challenge was translating those cryptographic and policy guarantees into an interface that a judge could understand without reading raw JSON.

Accomplishments that we are proud of

Handoff Workbench is a complete, repeatable product experience rather than a static architecture demonstration.

It includes:

  • A one-click signed lifecycle
  • A custom handoff builder
  • Exact human approval
  • Durable versioned events
  • Verified completion receipts
  • Reload and restart recovery
  • Six adversarial demonstrations with zero unauthorized state changes
  • Sanitized integration exports
  • OpenAPI and MCP integration surfaces
  • A live isolated Cloudflare deployment

What we learned

Agent delegation is not merely a context-transfer problem. It is an authorization problem.

A trustworthy handoff must answer five questions:

  1. Who delegated the work?
  2. Which agent may receive it?
  3. What exact authority moved?
  4. What evidence proves completion?
  5. Can every rejected action be shown to have changed nothing?

We also learned that cryptographic rigor and understandable product design do not have to live in separate worlds. The strongest proof is one that humans can see and machines can independently verify.

What’s next

The next step is to connect Handoff Workbench directly to agent runtimes, orchestration platforms, and enterprise policy systems.

Future work includes organization-defined authority templates, external identity providers, multi-agent delegation chains, revocation, richer evidence policies, and SDKs for common agent frameworks.

The larger goal is simple: as autonomous agents begin doing real work, every delegation should carry bounded authority and every completion should return verifiable proof.

Built With

  • better-sqlite3
  • cloudflare-agents
  • cloudflare-durable-objects
  • cloudflare-workers
  • ed25519
  • eslint
  • git
  • miniflare
  • model-context-protocol
  • node.js
  • openai-codex
  • openapi
  • prettier
  • sha-256
  • sqlite
  • typescript
  • vitest
  • web-crypto-api
  • wrangler
  • zod
Share this project:

Updates