Multi-Agent Security

Definition

Multi-agent security protects the identities, messages, resources, and delegated authority involved when agents coordinate, hand off work, or share results. Each handoff is a trust boundary that needs its own checks.

Interoperability allows agents to exchange work, but it does not establish permission for every requested operation. Keep peer identity, task authorization, and business approval distinct. The receiving service remains responsible for checking the operation it performs.

What it covers

Peer identity

Verify the remote service and authenticated caller.

Delegation

Bound what the receiving agent may do for the task.

Messages and artifacts

Restrict access and preserve origin and task context.

Failure containment

Coordinate budgets, cancellation, and committed side effects.

A handoff should carry enough context to identify requester, parent task, allowed work, and limits. Avoid transferring protected memory wholesale merely because a peer can accept a message. Limit artifact visibility to the relevant caller and task.

In practice

Practical design patterns by Min.

• Give child tasks narrower grants where possible, not unrestricted copies of parent credentials.
• Authenticate peers and authorize task and artifact access separately.
• Treat peer output as a claim or result, not an automatic policy update.
• Define how cancellation and budget limits propagate through delegated work.

Test failure paths across the complete graph: denied sub-tasks, delayed responses, duplicate messages, cancellation, and a budget exhausted by parallel workers. Observe whether downstream agents and services honor the same limits.

Working example

Why the controls matter

A research grant does not become purchasing authority when the work reaches another agent. A newly required approval must be obtained through a defined path and checked before payment is committed.

Common pitfalls

• Assuming trust in one agent automatically extends to all its peers.
• Treating a protocol’s authentication support as a complete business authorization model.
• Losing child tasks and side effects when a parent run stops.

Independent agents can each behave plausibly while their combined actions exceed the intended scope. Review the composition and shared resources, not only each component’s isolated evaluation.

Questions for operational review

Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.

• Who is the remote agent acting for?
• Which grants and data cross the handoff?
• How are child work and side effects contained?