Tool execution governance — delegation check before tool.forward()

smolagents runs tool-calling agents with a minimal footprint. The agent picks tools and executes them. The trust model: if the tool is in the agent's toolbox, it can be called with any arguments.

When agents run in production with tools that have side effects — writing files, calling APIs, sending messages — "the tool is available" isn't the same as "the agent is authorized to use this tool right now, for this task, with these arguments."

Governance wraps tool execution:

from agent_passport_system import create_delegation, govern_action

# Task-specific delegation
delegation = create_delegation(
    delegated_to=agent_key,
    delegated_by=operator_key,
    scope=["tool:web_search", "tool:python_interpreter"],
    # no tool:file_write, no tool:email
    spend_limit=2000,
    expires_in_seconds=600
)

# Agent tries to use a tool outside scope → blocked before execution
result = govern_action(
    action={"type": "tool:file_write", "path": "/etc/passwd", "content": "..."},
    delegation=delegation,
    passport=agent_passport
)
# Blocked. Signed receipt proves the boundary held.

The integration point is the tool execution path. Before tool.forward() fires, delegation is checked. Every call produces an Ed25519-signed receipt — permit or deny, with the full authorization context.

Fits the smolagents philosophy: minimal, composable, one function to wrap tool execution.

pip install agent-passport-system (v0.8.0, Apache-2.0) or npm install agent-passport-system (v1.36.2).