---
title: "Scope attenuation · Highflame Glossary"
description: "Narrowing permissions at each delegation hop so a sub-agent can never hold more authority than the agent that delegated to it."
doc_version: "0.1.0"
last_updated: "2026-07-25T03:14:58.002Z"
canonical: "https://www.highflame.com/glossary/scope-attenuation"
---

[Home](/index.md)·[Glossary](/glossary.md)·Scope attenuation

# Scope attenuation

Narrowing permissions at each delegation hop so a sub-agent can never hold more authority than the agent that delegated to it.

Learn more: [Agent Authorization](/learn/ai-agent-authorization.md)

Part of [the Agent Control Fabric](/platform.md): Highflame's identity, policy, and enforcement substrate for AI agents.

[Book a demo](/contact.md) [All terms](/glossary.md)

## Keep exploring the glossary.

[

### Shadow agents

Agents running across clouds, IDEs, and SaaS that no one inventoried or assigned an owner: the unmanaged majority of an enterprise's agent footprint.

Read →](/glossary/shadow-agents.md)[

### Shadow AI

The AI tools and autonomous agents adopted across an organization without IT's approval. Shadow IT for the agent era, and faster, because an agent takes minutes to wire up and can act on real systems.

Read →](/glossary/shadow-ai.md)[

### SPIFFE / WIMSE

Open standards for verifiable workload identity. Highflame extends them with agent-shaped claims for delegation, trust, and attribution.

Read →](/glossary/spiffe-wimse.md)[

### Tool poisoning

Hiding malicious instructions in an MCP server or tool description so an agent executes them when it loads or calls the tool. Invisible to static config; caught by scanning tools before load and enforcing at the call.

Read →](/glossary/tool-poisoning.md)[

### Trust tier

A provenance-based level on an agent's identity (first-party/attested, verified third-party, or unverified) that gates what the agent is eligible for and tightens its policy. It is a verified input to every decision, never a bypass: each action is still authorized per request, so there is no implicit trust.

Read →](/glossary/trust-tier.md)[

### ZeroID

Highflame's open-source agent identity core (Apache 2.0), built on OAuth 2.1, SPIFFE/WIMSE, and RFC 8693: the inspectable foundation beneath Highflame Identity.

Read →](/glossary/zeroid.md)

## Sitemap

Full site map: [/sitemap.md](https://www.highflame.com/sitemap.md). Machine index: [/sitemap-index.xml](https://www.highflame.com/sitemap-index.xml).