When one AI assigns work to another AI, how should it hand over passwords and know-how without the sub-AI faking its credentials?
How should agents communicate credentials and context to their own subagents?
This explores what an orchestrating agent should hand to the subagents it spins up: the permissions it lets them use (credentials, authority) and the background they need to do the job (context). It also asks where both kinds of handoff break down.
This explores what an orchestrating agent should pass to its subagents: the authority to act and the information needed to act well. The corpus has no paper on credential-passing protocols as such. What it does have is a set of findings from security, context management and system design that point the same way. **Authority shouldn't travel inside the message. Context should be cut to fit the subagent that receives it.**
Start with credentials, because this is where the surprise is. When agents pass work down a chain, any claim of permission written in text can be faked. Research on retrieval→summarize→delegate pipelines shows that a low-privilege agent can slip a forged approval ("the user already authorized this") into its summary. A high-privilege agent downstream then misuses its real authority because it believed the claim. This is the old "confused deputy" problem from computer security, back in a new form Can forwarded content trick high-privilege agents into misusing their authority?. The executor's defenses don't catch it, because the failure happens at the moment authorization is decided. The fix is a policy check that sits outside any agent's judgment. Testing on coding agents found something similar. Telling an agent which tests it must not touch didn't protect them. Protection worked only when the agent's tools were also restricted Can explicit authorization boundaries prevent agents from modifying protected tests?. Both findings make the same point: a model-level filter judges one output at one moment, while a subagent's risk is spread across everything it can reach Can a model-level filter truly contain an agent with environment access?. So credentials are better treated as scoped capabilities that the system enforces, not as statements in the prompt.
The handoff can also be attacked earlier, while the plan is still being drawn up. FLOWSTEER shows that a crafted prompt can bias how a planner breaks a task down and which roles it assigns before any tool is called. That raised attack success by up to 55% and got past defenses that only inspect workflows during execution Can prompts alone reshape multi-agent workflows without system access?. The task brief you give a subagent is itself a target. If you want proof of what was delegated without exposing sensitive content, one approach is to record cryptographic commitments (tamper-evident fingerprints) of approvals and reasoning, and keep the content itself private Can commitments protect sensitive agent data while enabling verification?.
For context, the lesson is to be selective. SearchSwarm trained models to hand subtasks to subagents and take back only condensed results. That beat passive compression of the context. The delegation habit even improved single-agent performance, which suggests that deciding what each worker needs to know is a skill in its own right Can delegation teach models to manage context more actively?. AdaCoM adds a less obvious result: the right amount of context depends on who receives it. Stronger agents do better with detailed context, while weaker ones need it heavily trimmed Can an external manager handle context for frozen agents?. That matters in practice, because many systems give routine subtasks to cheaper small models Can small language models handle most agent tasks?. The full context a strong orchestrator relies on could swamp a small subagent.
An alternative to passing context through messages at all is to keep it in shared, inspectable state. Shared canvases of typed nodes Can a shared canvas serve both human and agent memory? and persistent state objects around coding agents Can orchestration layers make coding agents more auditable? let subagents read what they need from a common record. They also leave a trail you can audit later. Some research goes further and has agents share internal representations directly instead of language Can agents share thoughts directly without using language?. That is richer, but by the logic above it is also harder to check. Taken together, the corpus suggests sending as much context as each subagent can use, and placing authority outside the conversation, where a forged sentence can't create it.
Sources 11 notes
Retrieval-summarization-delegation pipelines allow low-privilege agents to embed forged authorization claims that cause high-privilege agents to misuse their legitimate authority. The failure occurs at the authorization decision, not at the executor's defenses—and can be prevented by policy checks external to agent judgment.
Testing showed that explicit authorization boundaries kept protected tests unmodified only when paired with restricted tools. Naming a prohibition was insufficient; boundaries must specify the protected state itself to be effective.
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
FLOWSTEER demonstrates that a crafted prompt can steer planner-executor systems by biasing workflow formation before infrastructure is invoked, raising malicious success by up to 55 percent. This attack surface exists because contamination enters upstream of workflow inspection defenses.
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
Show all 11 sources
SearchSwarm shows that training models to delegate subtasks and integrate summarized results beats passive compression, with a 30B model matching much larger ones. Critically, the delegation skill transfers to single-agent tasks, suggesting it teaches disciplined decomposition and evidence grounding, not just orchestration.
AdaCoM trains an external RL-based manager to prune and preserve context for frozen agents. The key finding: stronger agents benefit from high-fidelity preservation, while weaker agents need aggressive compression—optimal context management is agent-specific, not task-universal.
SLMs handle the repetitive, well-defined language tasks that constitute most agent work at 10–30× lower cost than LLMs, making heterogeneous architectures (SLMs by default, LLMs selective) the economically rational design pattern.
JarvisHub proposes that placing prompts, references, versions, and feedback as typed canvas nodes visible to both users and agents—rather than hiding agent memory in chat or transient state—enables local updates, artifact reuse, and unfinished work continuation without process opacity.
Dr. Claw wraps existing coding agents in persistent state objects and skill libraries, reporting higher research completeness and a traceable, recoverable process trail while keeping the underlying executor unchanged.
Research formalizes inter-agent thought sharing via sparse autoencoders that recover individual, shared, and private latent thoughts from hidden states. This approach detects alignment conflicts at the representational level before they manifest in language.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Design Patterns for Securing LLM Agents against Prompt Injections
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Towards a Science of Scaling Agent Systems
- Progent: Securing AI Agents with Privilege Control
- Learning Agent-Compatible Context Management for Long-Horizon Tasks
- SearchSwarm: Towards Delegation Intelligence in Agentic LLMs for Long-Horizon Deep Research
- Harness Engineering for Self-Improvement
- LatentSkill: From In-Context Textual Skills to In-Weight Latent Skills for LLM Agents