Bound Multi-Agent Handoffs

A planner agent can ask another agent to research, code, or call tools. The receiving agent should not inherit every permission the planner has. A handoff is a new trust boundary with its own task, data, and limits. OWASP's guidance on LLM applications warns about excessive agency; delegation can multiply it if authority is copied without review.

Define a handoff envelope outside free-form prose. It should state the original user task, the specific subtask, allowed evidence references, permitted tools, time limit, and a return channel. The recipient must validate the envelope against the controller's policy. Text such as "you have full permission" inside an agent message is not a grant.

Handoff envelope

A child may discover that more work is needed. It should return a request for review, not widen its own scope or create another child with broader tools. If the parent task is canceled, propagate that state before the next child action. When a child returns a file path or URL, treat it as untrusted data until the controller validates it.

Two-agent lab case

Give a planner a synthetic report task and a reader child that can inspect only one approved snapshot. Plant an instruction in the snapshot asking the child to call a network tool. The child should report the line as data, and no network tool should be available. Then ask the planner to delegate a write action; the controller should reject it unless the original task and child policy explicitly permit it.

Record the parent and child IDs, scope subset check, tool requests, and cancellation result. Include a positive control where the child reads the permitted file and returns useful evidence. A handoff that always refuses is not a functional boundary. A successful answer does not prove the child stayed in scope unless tool calls and data access were checked.