Expansion Grant Guard

What it does

When an agent delegates work to a sub-agent (or expands context via DAG recall), it needs a controlled way to grant scoped permissions. Expansion Grant Guard maintains a YAML-based grant ledger that issues time-limited, token-budgeted grants — ensuring sub-agent operations stay within defined boundaries.

Inspired by lossless-claw's delegation grant system, where a parent agent issues a signed grant specifying what a sub-agent can access, how many tokens it may consume, and when the grant expires.

When to invoke

• Before any sub-agent expansion or delegation — issue a grant first
• When a sub-agent requests resources — validate the grant before proceeding
• When checking token budgets — verify remaining budget in the grant
• Periodically to clean up expired grants — auto-expiry sweep

How to use