Delegation is where a helpful agent becomes an organization.
One agent asks another to research a question. That agent calls a specialist. The specialist invokes a tool. Each handoff may be reasonable in isolation, but the chain creates a harder question: whose authority is being exercised at the end?
Human organizations answer that question with roles, approvals, budgets, and escalation paths. Agent systems need an equivalent structure. A task handoff should not silently copy every permission held by the caller.
Delegation is an authority decision
A useful delegation record answers:
- Who initiated the task?
- Which agent accepted it?
- What purpose was declared?
- Which actions and resources were delegated?
- How long does that authority last?
- May the recipient delegate again?
- Which human or system owner remains accountable?
If the runtime cannot answer those questions, it has recorded workflow but not authority.
The inheritance trap
The easiest implementation is to let a child agent inherit the parent's credentials. It is also the most dangerous default. A research subtask may need read access to a document collection; it does not automatically need the parent's ability to send messages, change records, or approve transactions.
Authority should attenuate as it moves. A child receives the smallest subset required for its task. A grandchild receives no more than the child was allowed to delegate. Expiration and depth limits should be explicit.
Illustrative scenario
An operations agent is allowed to read invoices and request a payment approval. It delegates invoice extraction to a document agent. The document agent should receive read access to the selected invoices—not the ability to request or execute payment. If it delegates OCR work again, that narrower task should carry a still smaller scope.
This is not a reported customer incident. It is a threat-model example showing why privilege attenuation matters.
What operators should require
Before enabling agent-to-agent delegation, insist on:
- A unique identity for every participant in the chain.
- A declared purpose and bounded action scope for every handoff.
- A permission ceiling that no descendant can exceed.
- Time limits, depth limits, and revocation.
- Approval gates for consequential actions.
- A queryable receipt linking each decision to its parent.
An audit record is useful only when the relevant handoffs pass through the instrumented runtime. Claims of complete coverage should therefore name the enforcement boundary and identify any paths that bypass it.
Clear delegation does not remove risk. It makes authority inspectable, revocable, and attributable. That is the minimum structure required before a collection of agents can be trusted to act like a team.