Agent-to-agent handoffs expose the real AI data governance gap

At a glance

What this is: This is a vendor analysis of agent gateway policy for AI workflows, with the central finding that inter-agent handoffs create the largest sensitive-data exposure risk.

Why it matters: It matters because IAM and security teams need to govern what each AI agent sends, receives, and retains across delegation chains, not just what each agent can do in isolation.

Context

AI agent workflows create a governance gap when one agent hands a case to another and the handoff includes more sensitive data than the receiving role actually needs. The core problem is not the model call itself, but the transfer of context, findings, and working state across roles that have different access boundaries.

In practice, the handoff becomes a policy boundary, because the outbound package and the return package can each expose different classes of information. That is why an agentic AI identity guide lens is more useful here than treating the flow as a generic workflow automation problem.

The article’s insurer example is a useful pattern, not an outlier: any customer-facing agent escalating to an internal review agent can create the same exposure if governance is applied only to the individual agents rather than the exchange between them.

Key questions

Q: What breaks when AI agents hand off full case context to another agent?

A: The receiving agent often inherits more sensitive data than its role requires, and that excess can persist in memory, logs, or downstream responses. The failure is not the existence of delegation itself, but the lack of a governed boundary around the payload. Teams need role-specific filtering on both the outbound and return path.

Q: Why do agent-to-agent handoffs increase access risk?

A: Agent-to-agent handoffs increase risk because authority can move beyond the original requester and be reissued without the same level of scrutiny. If the receiving agent can delegate again or inherit broader context than it needs, the workflow can accumulate more privilege than the business task justified.

Q: How should security teams govern sensitive data in multi-agent workflows?

A: Treat each delegation step as a policy decision and apply data minimisation at the transfer layer, not only inside the agent. The practical goal is to let the downstream agent do its job without inheriting identifiers, medical details, or internal scoring methods that do not belong in its context.

Q: What is the difference between agent isolation and handoff control?

A: Agent isolation limits what one agent can access on its own, while handoff control limits what can move between agents when work is delegated. Both matter, but they solve different problems. Isolation protects each actor in place; handoff control protects the boundary where one role’s context becomes another role’s input.

Technical breakdown

Why agent-to-agent handoffs create the highest data exposure

In a multi-agent system, each agent may be individually scoped, yet the transfer between them can expand the data set far beyond the receiving agent’s job. The problem is delegation chain accumulation: every hop may preserve, log, or reuse data that was reasonable for the sender but unnecessary for the receiver. This is not just a prompt-design issue. It is a governance issue about how much of the prior working state is allowed to cross role boundaries. The real failure mode is that the handoff is often not represented as a discrete security control at all. See the AI Agent Authorisation Guide.

Practical implication: Treat every agent-to-agent exchange as a governed access event, not as a routine message transfer.

How gateway policy changes what each agent can see

An agent gateway sits between agents and evaluates what can move in either direction based on sender, receiver, and task context. That means policy is applied at delivery time, not only at agent design time. In the article’s example, the fraud-review agent receives the claim facts and anomaly details, but not banking or medical data; the customer-facing agent receives a minimal status update, but not the internal indicators or scoring method. This selective mediation preserves useful analysis while blocking unnecessary disclosure across the delegation boundary. See the Agentic AI Identity Guide.

Practical implication: Use gateway-level policy to separate analytic payloads from customer-facing return messages.

Why scoped placeholders preserve analysis without exposing identity

The article’s placeholder approach shows a useful mechanism for cross-case analysis. A stable surrogate can let an internal agent link multiple claims to the same person or pattern without exposing the real identity inside every downstream context. That is important because many governance designs assume analytics and disclosure are inseparable. They are not. The system can support pattern detection, triage, and escalation while still removing identity-bearing fields from the handoff. The critical architectural point is that pseudonymisation has to survive both directions of travel, not just the first transmission. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Preserve correlation values for internal analysis while stripping direct identifiers before any role change.

Threat narrative

Attacker objective: The attacker’s objective would be to obtain sensitive claim data, internal fraud logic, or both by exploiting the agent handoff boundary.

1. Entry occurs when a claims agent escalates a case and forwards the full working package to another agent with a different role and broader internal context.
2. Credential or information exposure follows when the package includes direct identifiers, bank details, and medical data that the receiving agent does not need for its task.
3. Impact occurs when internal fraud indicators, scoring, or methods flow back into a customer-facing context and can be disclosed through later interactions.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent handoffs, not isolated agents, are the real governance boundary: The article is right to focus on the exchange layer because individual agents can be well-scoped and still leak at the point of transfer. Once a case is repackaged for another role, the security question changes from what the agent may do to what the receiving role should be allowed to inherit. Practitioner implication: governance must attach to the delegation event itself, not only to the participating agents.

Identity exposure and analytic usefulness do not need to be coupled: Stable placeholders show that correlation across cases can survive without exposing the underlying identity in every context. That is a more precise model than either full disclosure or blind redaction, and it is especially relevant for fraud review, claims, support, and finance workflows. Practitioner implication: separate linkage value from disclosure value in every inter-agent policy.

Gateway-mediated policy is the only scalable way to keep handoff rules consistent: If every agent pair has to implement its own filtering logic, the governance burden expands faster than the workflow itself. Central mediation turns the handoff into a controllable policy surface and creates a defensible audit trail for what each side received. Practitioner implication: move handoff rules out of agent code and into a shared control point.

Inter-agent workflows create a new class of data minimisation failure: The usual minimisation discussion assumes a request-response pattern, but agent-to-agent delegation can carry prior context, internal findings, and method details forward automatically. That is a different failure mode from ordinary API overexposure because the sender may be acting on behalf of another role, not on behalf of a human requestor. Practitioner implication: reassess data minimisation for every role transition in the workflow, not just at system ingress.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Handoff governance is emerging as a distinct control category: The article points to a pattern that many programmes still miss, because they focus on agent permissions and model calls while leaving transfer logic unowned. The practical shift is to treat inter-agent context exchange as its own control surface, with reviewable policy and evidence.

Identity minimisation now has to survive delegation chains: If a customer-facing agent can receive internal findings back into its context, the programme has not only a data exposure problem but a role-boundary problem. Teams should expect this issue to show up first in claims, support, finance, and fraud workflows where one agent escalates to another.

For practitioners

• Define handoff policies per agent pair Map each sender-receiver combination to the minimum claim, case, and context fields the receiving role actually needs.
• Separate outbound and inbound controls Write different rules for what a review agent may receive and what a customer-facing agent may receive back from the review path.
• Preserve correlation without identity disclosure Use stable placeholders for cross-case pattern detection while removing direct identifiers and health information from transfer payloads.
• Log the exact handoff payload Record the sender, receiver, task, and filtered content so audits can show precisely what crossed the delegation boundary.

Key takeaways

• The article’s central risk is not an individual AI agent acting badly, but sensitive context moving too freely between agents with different roles.
• Agent handoffs can expose both direct identifiers and internal investigation methods, which makes the delegation boundary the real control point.
• Governance improves when teams filter outbound and inbound payloads separately, preserve correlation without disclosure, and log the exact transfer content.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide · MCP Security Guide

Key terms

• Agent gateway: The local or remote control layer that authenticates, pairs, and orchestrates an AI agent’s actions across connected tools. In practice it becomes an identity concentrator, because one gateway session can govern messages, commands, and downstream systems with far broader reach than the user interface suggests.
• Handoff Boundary: A handoff boundary is the point where one agent’s work product becomes another agent’s input. It is where data minimisation, disclosure limits, and auditability must be enforced, because the risk often appears only when context crosses from one role to another.
• Scoped Placeholder: A scoped placeholder is a stable surrogate that lets a system correlate records across workflows without exposing the underlying identity. It preserves analytical value for internal review while reducing unnecessary disclosure in downstream contexts, especially in multi-agent and multi-role workflows.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.