Multi-Agent AI Systems: When Separation of Duties Dissolves

Every enterprise control framework assumes the entity that requests an action and the entity that approves it are different. Multi-agent workflows quietly dissolve that assumption. Three agents each holding modest, individually reasonable permissions can compose an action none of them was authorized to take, and no single permission grant looks wrong in a review.

‍

That is the distinguishing property of multi-agent systems rather than a harder version of single-agent risk. Governing one agent means bounding what it can reach, which agent identity as a control addresses. Governing a network of them means bounding what they can accomplish together, and the controls that do the first do not do the second.

‍

Separation of Duties Dissolves in a Chain

‍

Segregation of duties works because a human cannot approve their own request. Agents can, by routing through each other.

‍

Composed Permissions Look Individually Reasonable

‍

An agent authorized to draft a payment instruction, another authorized to validate formatting, and a third authorized to submit validated instructions together constitute a payment authority nobody granted. Each permission passes an access review on its own terms. The combination is invisible to any control that examines grants rather than paths, and this collusive composition appears in current OWASP work on agentic risks rather than being hypothetical. Understanding how agentic systems differ from generative ones is what makes the distinction land.

‍

The Control Is a Trust Tier, Not a Permission

‍

The fix operates at identity rather than at scope. An agent identity permitted to generate or propose should sit in a different trust tier from one permitted to approve or execute, with the boundary enforced so that no delegation path crosses it. Expressing duty separation as a property of the identity graph rather than as a list of permissions is what makes it reviewable, and permission scoping has to record the tier alongside the scope.

‍

Plan and Execute Belong Apart

‍

Architectures separating deliberation from action give the separation somewhere to live. An agent that plans produces a proposal, and a distinct component with narrower authority carries it out after a check. Preview and execute becoming the same step is how a reasoning failure becomes an irreversible one, which is among the enterprise risks agents introduce that single-model thinking does not anticipate.

‍

Trust Between Agents Is Transitive

‍

Networks learned this lesson already. Traffic originating inside the perimeter was treated as trustworthy until enough incidents proved otherwise, and multi-agent architectures are repeating the pattern with peer agent output.

‍

Poisoned Output Becomes Trusted Input

‍

An upstream agent ingesting an external document carrying injected instructions executes its task incorrectly and passes the result downstream, where the receiving agent has no reason to question a peer. The exploit propagates through the workflow without touching the perimeter again, which is why indirect prompt injection matters more in a chain than in a single call. Inspecting inputs only at the boundary leaves every internal handoff unvalidated.

‍

A Hallucination Entering Shared Memory Becomes Fact

‍

Agents sharing a memory store inherit each other's errors as ground truth. One agent recording an incorrect account number or a malformed parameter creates a value that subsequent agents act on without re-deriving. Provenance tagging on every memory write, recording source and trust level, is what allows a later reader to discount an unverified entry, and expiring unverified memories prevents an error from becoming permanent.

‍

Delegation Depth Is Where Scope Leaks

‍

Chaining is the point of the architecture and also where authorization goes wrong. Two failure modes recur and both are configuration rather than model behavior.

‍

Privilege Drift Down the Chain

‍

A parent agent delegating to a sub-agent hands over its authorization context unless the delegation is explicitly narrowed. Where the parent holds broad access, the sub-agent inherits it and reaches systems nobody intended it to touch. Passing a downscoped, time-bound token at each hop rather than the parent's credentials is the structural answer, and it produces the additional benefit that revocation works at a single point.

‍

Transient Sub-Agents Nobody Registered

‍

Workflows that spawn sub-agents dynamically can create and abandon hundreds within a single run, none of which appears in any register. The population is unbounded by design and the governance model assumes enumeration, so reconciling them requires registration at credential issuance rather than periodic discovery. Where that is impractical, capping delegation depth is a blunt control that at least bounds the number.

‍

Attribution Collapses at Depth

‍

The question an investigation asks is which decision caused the outcome. After an action traverses five agents, each transforming the task slightly, that question has no answer without a recorded lineage linking every handoff.

‍

Signed Handoffs Make Lineage Possible

‍

Requiring inter-agent messages to be signed by the sending identity converts a sequence of calls into an evidentiary chain. Mutual authentication between agents, with semantic validation of the intent being passed, also blocks an intermediary inserting itself into the flow. Recording the chain immutably matters as much as producing it, since a lineage that can be edited after an incident answers nothing.

‍

Coordination Failures Look Like Outages

‍

Agents with slightly misaligned objectives can pass a task back and forth indefinitely, consuming resources until something fails. The symptom presents as a performance problem rather than a security one, so it reaches the wrong queue, and incident classification needs to account for it. Loop limits, execution budgets and circuit breakers that halt a workflow exceeding expected depth are cheap and rarely implemented before the first incident.

‍

The Supply Chain Has No Manifest

‍

Traditional supply chain assurance rests on pinning dependencies and inventorying components. Agents select tools at run time, discovering capabilities from registries and deciding which to trust based on natural language descriptions, so the dependency set is not knowable in advance.

‍

The precedent already exists, with a malicious package impersonating a legitimate email service found in a public registry in 2025, silently copying every message to an attacker. An agent choosing that capability from a description would have had no signal, and the security implications of agents connecting to tools cover the mechanism. Allowlisting which registries and capabilities an agent may select from restores a boundary that pinning cannot.

‍

Capability Advertisements Can Lie

‍

Where an orchestrating model selects a peer agent based on its published description, a deceptive description becomes an attack. Protocols supporting signed capability declarations often do not enforce signing, so verification is a deployment decision rather than a default. Treating an agent registry with the same suspicion as a package registry is the correct posture.

‍

Controls That Operate at Network Level

‍

Three controls address the composition problem rather than the individual agent, and none requires waiting for a standard.

‍

• Trust Tier Boundaries: No delegation path may cross from a proposing identity to an approving one.
• Scoped Delegation Per Hop: Each handoff carries a narrowed, time-bound token rather than the caller's credentials.
• Depth and Budget Limits: Workflows halt on exceeding expected delegation depth, execution time or tool call count.

‍

Replay testing adds a fourth where the estate justifies it. Re-running a recorded period of agent activity against a proposed configuration change surfaces cascade behavior that static review misses, and it depends on having kept the lineage in the first place. Programs already doing behavioral monitoring in production hold the recordings that make replay possible.

‍

Model the Workflow, Not the Agent

‍

Risk assessment applied per agent misses composed exposure entirely, since the individual agents each look modest. Assessing the workflow as the unit, with the question being what the chain can accomplish end to end, produces a different and more useful answer, and quantifying autonomous system risk already works at that altitude. Quantifying that exposure gives the workflow a figure rather than a severity label, which matters because the controls described here cost real engineering time and compete for it.

‍

Bound What the Network Can Accomplish

‍

Single-agent governance asks what an agent can reach. Multi-agent governance asks what a chain of agents can achieve together, and the answer is frequently larger than the sum of the individual grants. Trust tiers that no delegation path may cross, scoped tokens at every hop, signed handoffs producing a reviewable lineage, and hard limits on depth and budget are the controls that operate at that level. Kovrr's AI Security and Governance Platform records agent workflows with owners and exposure attached, so a chain is an assessable unit rather than an implementation detail.

‍

To see which agent workflows exist in your environment and what each chain can reach end to end, book a demo mapped to your own estate.