A transfer of work, data, or authority from one software agent to another. In security operations, this creates a control boundary that must preserve policy context, identity, and audit trails so that responsibility does not disappear between systems.
Expanded Definition
Agent-to-agent handoff is the controlled transfer of work, state, or delegated authority from one autonomous software agent to another. In agentic AI systems, the handoff is not just a message exchange; it is a governance event where policy context, identity, data minimisation, and auditability must survive the transition. That makes the handoff materially different from a routine API call, because the receiving agent may inherit execution context, tool access, or decision responsibility.
Security teams should treat the handoff as a boundary that needs explicit authorisation, provenance tracking, and step-up controls when risk changes. This is aligned with the risk-centric framing in the NIST AI Risk Management Framework and the task-focused concerns documented in the OWASP Agentic AI Top 10. Definitions vary across vendors on whether a handoff includes only task context or also delegated authority, so NHIMG treats both as security-relevant when the downstream agent can act independently.
The most common misapplication is assuming the receiving agent can be trusted with the same context as the sender without revalidating identity, intent, and scope, which occurs when orchestration layers chain agents together without explicit control checks.
Examples and Use Cases
Implementing agent-to-agent handoff rigorously often introduces orchestration overhead, requiring organisations to balance automation speed against stronger control of authority transfer and evidence retention.
- A triage agent identifies a suspicious login pattern and hands the case to an investigation agent with only the minimum incident context, preserving the original evidence trail.
- An AI support agent escalates a customer request to a billing agent after stripping unrelated personal data, reducing exposure while keeping the workflow intact.
- An autonomous coding agent passes a change request to a test agent, but the transfer includes policy tags that limit repository scope and block new secrets access.
- A security operations workflow uses an agent handoff to move from alert enrichment to containment, with the downstream agent required to reassert identity before executing any destructive action, a pattern that maps to the control emphasis in the CSA MAESTRO agentic AI threat modeling framework.
- In a malicious or compromised workflow, one agent hands a prompt-bearing payload to another agent, and the second agent inherits unsafe instructions unless the system validates the transfer against protections described by MITRE ATLAS adversarial AI threat matrix.
Why It Matters for Security Teams
Agent-to-agent handoff matters because it is often where accountability, least privilege, and context integrity fail together. If the sender can delegate more authority than intended, the receiving agent may act with inherited trust that was never explicitly granted. That creates a blind spot for logging, approval, and incident reconstruction, especially when multiple agents share tools, memory, or workflow state. The issue becomes more serious in environments where agents can touch secrets, customer data, or production systems, because the handoff may silently expand blast radius.
For identity and governance teams, the key question is whether the transfer carries a verifiable identity claim and an auditable policy decision, or just a free-form instruction. The OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework both reinforce the need for traceability, role clarity, and bounded autonomy across AI workflows. Organisations typically encounter the severity of agent-to-agent handoff only after an incident review reveals that responsibility disappeared between systems, at which point the handoff becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF covers governance, accountability, and traceability for agent handoffs. | |
| OWASP Agentic AI Top 10 | OWASP highlights agentic risks around unsafe delegation and context transfer. | |
| CSA MAESTRO | MAESTRO models agent-to-agent interaction risks in orchestrated AI systems. | |
| MITRE ATLAS | ATLAS is relevant when handoffs are abused to propagate adversarial instructions. | |
| NIST CSF 2.0 | PR.AC-4 | CSF access control principles apply when agents inherit or pass authority. |
Define ownership, log transfers, and validate delegated scope for every agent handoff.
