Delegation in multi-agent systems

A child agent needs an explicit narrower grant from a valid parent; neither a shared credential nor membership in an agent team creates additional permission.

Start with the distinction

From recognition to a bounded effect.

Narrow authority through handoffs, shared limits and revocation across cooperating agents. The references below each own a different question, from the source of permission to the decision at the action boundary. Use them as a map for an architecture review, then test the model against a real task and its downstream execution path.

Start with a decision

What permission survives a handoff?

Each child needs a narrower grant from a valid parent. The final executor should intersect the chain and apply aggregate constraints that several children share. Parallel branches cannot each spend the full origin budget.

Validate the chainCheck every ancestor, expiry and scope subset.Control shared limitsReserve aggregate capacity atomically across children.Stop descendantsDefine when parent revocation reaches queued work.

Architecture review: Run two children against the last available budget, then revoke their parent while one effect is unresolved. Preserve the reservation until the downstream outcome is known.

01 / Delegate safely

Delegate safely

Begin with the principal, purpose and operation before discussing tools.

Multi-agent authorizationValidate effective permission through an entire agent handoff chain.Sub-agent permissionsSpecify the exact work a child may do and whether it may delegate again.Delegated authority for AI agentsExpress what a parent can hand to a child without creating new rights.

02 / Coordinate limits

Coordinate limits

Follow the grant and policy into the protected execution path.

Shared authority budgetsPrevent parallel children from multiplying one aggregate limit.Authority intersection in agent workflowsCompute effective rights from all applicable principals and constraints.Revoking child agentsInvalidate descendants when an ancestor’s permission ends.

Further technical references

Follow a specific boundary.

Authority chain validationValidate every grant edge between an accountable origin and a child action.Monotonic authority narrowingRequire each delegation to be no broader than its valid parent.Delegation depth limitsBound how far an agent can hand work to another agent.Agent fan-out authorityPrevent parallel children from multiplying one task’s effective permissions.Agent convergence securityRecheck authority when outputs from several agents become one consequential action.Cross-runtime agent delegationCarry bounded grant semantics across orchestration products or services.Agent handoff securityTreat an agent-to-agent handoff as a permission change, not merely a message.Delegated approval in agent workflowsSpecify who may approve a child agent’s proposed effect.Multi-party approval for agent actionsRequire independent decisions when one agent effect exceeds a risk threshold.Delegation loop detectionReject cycles in a grant graph before they create ambiguous ancestry.Delegation amplification preventionStop a child from gaining rights through union, reissue or credential substitution.Cross-tenant agent handoffRequire explicit trust and resource agreement before a task crosses tenant boundaries.Delegation receipts for agent handoffsRecord what authority was passed at each edge without mistaking it for execution.Multi-agent incident reconstructionReconstruct which agent and grant caused an effect across handoffs.

Connect the architecture

Identity, permission, decision, outcome.

The key invariant is narrowing: a child receives no action, target, budget or delegation right absent from its parent. Parallel children must share aggregate limits rather than each receiving a fresh full ceiling. Revoking an ancestor should invalidate dependent future actions, including those of paused or remote children. A practical review starts with one handoff record, validates the grant subset, then attempts an out-of-scope operation at the final executor. Conversation history may help explain intent but cannot replace the grant chain.

Platform authority ↗Developer authority model ↗Compliance and audit context ↗ProofGrid Research ↗

Explore the control plane

Make one authority chain reviewable before scaling it.

Request a Conversation