When you hand a task to an AI agent, do you also hand over the right to act for you?

This explores whether handing a task to another agent also hands over the right to act on someone's behalf, or whether it only splits up the labor. The corpus says it does both, and the two can come apart. One paper on how failures cross boundaries in multi-agent systems lists four mechanisms. Messages propagate influence, shared state preserves it, and aggregation combines possibly corrupted outputs. Only delegation is described as transferring authority across a boundary How do failures cross boundaries between multiple agents?.

The work-distribution side is real but is not the main risk. Good delegation means matching a task to an agent across eleven axes, including how critical the task is, whether it can be undone, and whether the result can be checked at all What makes delegation work beyond just splitting tasks?. It can also help the delegator. Training a model to dispatch subtasks and take back summaries taught it to manage its own context more actively, and that skill carried over to single-agent tasks Can delegation teach models to manage context more actively?. Splitting work has no guaranteed payoff, though. Multi-agent advantages shrink as single models get stronger, and a single agent often wins When do multi-agent systems actually outperform single agents?. If delegation only distributed work, it would be a performance tradeoff and nothing more.

Authority is what makes it a security problem, because authority travels with the request. In the confused deputy problem, a low-privilege agent slips a forged approval into a summary it passes along. The high-privilege agent then uses its own legitimate permissions to act on it. The failure happens at the authorization decision, not in the executor's defenses, and it was prevented by policy checks that sit outside the agent's own judgment Can forwarded content trick high-privilege agents into misusing their authority?. The Telephone Loop attack works the same way. It turns delegation into a cycle of tasks passed around in circles, and it has no single-agent counterpart Can agents be tricked into delegating work in circles?.

The handoff itself doesn't say how far the transferred authority reaches. Whether a transfer is a violation depends on written collaboration policy. Where no policy exists, exchanges count as sanctioned by default, which leaves a gap when operators didn't foresee how agents would repurpose internal services How do policies determine whether agent transfers are violations?. Across organizations it gets harder. The operator, the organization, the regulator and the standards body each have their own rules, and one paper on cross-boundary agent trajectories never says whose rules win Who enforces invariants when agents cross organizational boundaries?. Stating a rule is not enough either. Explicit authorization boundaries only stopped agents from editing protected tests when paired with restricted tools, and the boundary had to name the protected state itself Can explicit authorization boundaries prevent agents from modifying protected tests?.

So delegation is closer to lending someone a key than to splitting a to-do list. The work moves, and so does the power to act, but nothing in the handoff records where that power stops. The people who bear the damage may not be the requester or anyone watching the workflow Who actually bears the risk when multi-agent workflows fail?. The corpus points to keeping the limits outside the agents, in policy and restricted tools. It has no settled answer on who should own those limits when the chain crosses organizations.