# Cookbook request: authority attenuation across CrewAI delegation (Delegate work to coworker) **URL:** \ **Category:** General\ **Created:** [September 1, 2026, 1:07pm UTC](https://community.crewai.com/t/cookbook-request-authority-attenuation-across-crewai-delegation-delegate-work-to-coworker/7774 "2026-09-01T13:07:19Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rafael](https://sea1.discourse-cdn.com/flex025/user_avatar/community.crewai.com/rafael/32/5252_2.png) [@rafael](https://community.crewai.com/u/rafael)\ **Post date:** [September 1, 2026, 1:07pm UTC](https://community.crewai.com/t/cookbook-request-authority-attenuation-across-crewai-delegation-delegate-work-to-coworker/7774/1 "2026-09-01T13:07:19Z")
CrewAI’s delegation tools (“Delegate work to coworker” / “Ask question to coworker”) hand a task to another agent, but the coworker inherits whatever authority your code gives it — there’s no built-in way to guarantee it’s a subset of the delegating agent’s own authority, or to stop a bad tool call before it runs. We wrote a recipe for that: an orchestrator delegates to a coworker, the coworker’s permissions are computed as a strict subset of the orchestrator’s, and an out-of-scope tool call is denied at the `before_tool_call` hook — before the tool body runs, not after. Includes a kill switch (one denial revokes the coworker’s whole subtree) and a signed, offline-verifiable audit log. It’s a working example in our repo (attenu-guard, Apache-2.0), with tests, and the demo runs offline against a scripted model so it needs no API key: [attenu-guard/examples/integrations/crewai at main · attenu-io/attenu-guard · GitHub](https://github.com/attenu-io/attenu-guard/tree/main/examples/integrations/crewai) Would this fit as a Cookbooks entry? I can write it, or just answer questions about the hook points (crewai.hooks.register\_before\_tool\_call\_hook, InterceptionPoint.PRE\_TOOL\_CALL) if that is more useful.