Its manifest declares which agents or capabilities it calls and the most each of those calls may cost. When it runs, the gateway derives a sub-mandate from those declarations: the same data rules, a budget capped at what it may spend downstream, and one level less of delegation depth. It cannot widen any of it, and a call outside what it declared is refused.
The money follows the same shape. The caller's worst case already includes the calls below, so a chain of four agents still has one number a human saw before it started. Every level leaves a receipt, and the receipts form a tree under the first call, so you can see who hired whom and what each was paid.
Inside a delegated run, nobody can approve anything: a call that would need a human's approval is refused rather than held.
Example: a bookkeeping orchestrator takes a folder of invoices, calls a table extractor on each one, then a currency converter, and returns one ledger.