The risk is the chain, not the agent

Every serious conversation about agent security right now is a conversation about one agent. Give it its own identity instead of a borrowed human account. Scope it to a single task, a short window, the minimum data. Check that the action still matches the intent it was authorized for. Put a name on it, so somebody answers when it goes wrong.

All of that is correct. It is also scoped to a unit of work that does not exist in production.

The first thing a capable agent does is call another one. It spawns a subtask, hands work to a specialist, queries a tool that is itself an agent, or triggers a workflow owned by a different team. By the time the action lands in a live system, it is rarely the agent you permissioned that took it.

What breaks at the handoff

Picture a routine chain. An agent is authorized to reconcile a billing discrepancy for one customer. It reads the account, decides it needs the payment history, and calls a finance agent. The finance agent needs the customer record updated to proceed, and calls a CRM agent. The CRM agent writes.

Nothing in that sequence looks like an incident. Every step is locally reasonable. And all three pillars have quietly failed.

Identity fails because the credential travels but the scope does not. The second agent is not running under a fresh, narrowly scoped identity issued for its subtask. It is running on whatever the first agent could hand it, which in most implementations today is a token or a service account with the union of everything the workflow might need. You scoped the entry point. The chain widened it back out.

Intent fails because the original purpose is gone by the second hop. The finance agent knows it was asked for payment history. It does not know it was asked in service of a single customer's billing correction. An intent check at that layer can only compare the action against the task it was handed, not the task that started it. The further down the chain you go, the more the authorization question degrades into a formality.

Ownership fails because no owner authorized what actually happened. The person accountable for the billing agent never approved a CRM write. The person accountable for the CRM agent never saw the billing discrepancy. Both did their job. The gap sits in the space between them, and the space between them is where the action occurred.

This is not a failure of the three principles. It is a failure of the unit. We are designing controls for actors, and the thing that carries risk is the chain.

The argument against building the fix right now

The instinct at this point is to design the answer. A delegation governance model. A chain of custody standard. An org chart that assigns accountability across handoffs.

I would resist that instinct for another year.

We are in the boom phase. The shape of agent to agent interaction is being rewritten every few months by model capability, by tooling, by protocol proposals that have not settled. There is no agreed way to pass a scoped, attenuated credential down a delegation chain, no common format for carrying original intent alongside a subtask, no shared vocabulary for what a chain even is. Whatever architecture you finalize this quarter is built on assumptions that will not survive the next capability jump.

That would be a manageable cost if these decisions were cheap to reverse. They are not. Permission architecture gets written into vendor contracts, into procurement requirements, into who reports to whom, into the tooling you standardized the whole company on. Those are the slowest things in any organization to unwind. Committing early does not buy safety, it buys a model of agent behaviour you will be defending long after it stops describing reality.

So the question is not what structure to build. It is what to build that survives being wrong.

Four moves that stay cheap

Propagate intent with the delegation. When an agent hands work down, the original authorized purpose travels with the subtask, not just the subtask. It costs almost nothing to attach and it is the only thing that makes an intent check meaningful three hops in.

Log the chain, not the call. Most audit trails record the action and the actor that performed it. That record cannot answer the only question that matters after an incident, which is why. Capture the full path from the human request to the final write, including the agents that never touched a system themselves.

Budget the chain. Cap delegation depth, total spend, and the number of write actions any single originating request can produce. Not because you know the right number, but because a runaway chain is the failure mode that gets expensive fastest, and a crude ceiling is easy to raise later.

Put the stop button on the chain. Not on the agent. When something goes wrong at two in the morning, the person on call needs to halt everything descending from one originating request, not hunt through six services deciding which agent to kill. And one named person should know in advance that the button is theirs.

None of these four is a governance model. They are plumbing. You can rip any of them out in a sprint, and none of them requires you to have decided what an agent identity ought to look like in 2028.

Why the record is the part you cannot skip

The reason to do even this much now, in the middle of a period where the right answer is genuinely unknown, is that the eventual structure has to be designed from evidence. Not from a framework, and not from the vendor deck.

You will only get to design it well if you can answer, for the past year, what your agents actually did. Which chains formed without anyone planning them. Where scope quietly widened. Which handoffs produced the actions nobody would have approved if asked directly.

Organizations that instrument now will have that record. Organizations that wait for the standards to settle will arrive at the design conversation with nothing but opinions, and will adopt whatever their largest vendor is selling.

Structure can wait. Traceability cannot, because you cannot design the structure later without a record of what actually happened.