Inspect or revoke delegation

Replace the placeholders with values from your own authorized scope before copying this prompt into an MCP client.

Inputs

• {{workspace_id}} Stable workspace ID.
• {{application_id}} Stable application ID.
• {{delegation_id}} Exact delegation ID.
• {{action}} Inspect or revoke.
• {{request_key}} Stable key for a revoke, unused for inspection.

Prompt

Use execution.delegation.read through read_v2_program in {{workspace_id}} / {{application_id}} with delegationId {{delegation_id}}.
Report the active_version, verified issuer and subject, operation_scope, validity dates and schedule_id/schedule_version when present.
For {{action}} inspect, stop after reading. For revoke, verify authority and a current active version. Read application.state.read for metadataRevision, policyRevision and schemaEpoch.
Call execute_v2_execution_delegation with execution.delegation.revoke, delegationId, version equal to the active_version, expectedMetadataRevision, expectedPolicyRevision, expectedSchemaEpoch and idempotency_key {{request_key}}.
Read the delegation again and verify that active_version is null and revoked_at is set. Return the revoke operationId and committedRevision. Inspect already admitted work separately.
Stop on a missing delegation, no active version, stale revisions or lack of authority.

Example inputs

In the disposable application, use this definition with execution.delegation.create. Supply the fixture operator's verified issuer and subjectId, a UTC validFrom one minute ago, a UTC validUntil 15 minutes ahead, and the current three expected revisions. The caller needs the authority to run rules. Inspect the record first, then separately authorize a revoke and verify the exact receipt.

{
  "delegationId": "docs-rule-delegation",
  "version": 1,
  "operationScope": ["application.rule.run"],
  "scheduleId": null,
  "scheduleVersion": null
}

Tools used include read_v2_program, execute_v2_execution_delegation. See the module guidelines and tool index.