AI agent protocols expose governance gaps in collaborative automation

At a glance

What this is: This is an analysis of AI agent protocols and their role in making multi-agent automation interoperable, with the core finding that standardisation is emerging because ad hoc agent communication creates operational and governance friction.

Why it matters: It matters because IAM and security teams will have to govern how agents authenticate, coordinate and act across systems, not just whether they can complete tasks.

Context

AI agent protocols are standardised rules for how software entities exchange messages, coordinate work and manage failure when they operate across tools and systems. In cybersecurity and risk workflows, the problem is not only automation scale but the lack of a common interaction model for AI agents vs agentic AI.

The article frames a real governance gap: agent ecosystems are moving faster than the identity, authorisation and audit patterns needed to control them. When agents can plan, act and adapt, security teams have to think about inter-agent trust, delegated authority and error containment before the automation becomes operationally critical.

Key questions

Q: How should security teams govern agentic AI as it moves into production?

A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature. That means assigning ownership, scoping permissions tightly, logging every tool action, and revoking access on a defined lifecycle. Production rollout should require clear approval points for high-risk actions and continuous monitoring for drift.

Q: Why do AI agents create new risk in non-human identity management?

A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts. They can connect quickly, persist across teams, and accumulate permissions that are hard to review. That combination increases the chance of unnoticed access drift and credential exposure.

Q: What breaks when multiple agents share tools and data without a common protocol?

A: The failure mode is inconsistent coordination: agents can duplicate work, act on stale context or pass unsafe decisions downstream. Without a common protocol, teams also lose consistent logging and recovery, which makes it harder to tell where a bad action began or how far it spread.

Q: What should teams do before allowing autonomous agents to act across systems?

A: They should require explicit delegation rules, scoped permissions and revocation paths before any autonomous workflow goes live. The critical test is whether the organisation can identify the acting agent, the authority it used and the systems it touched after the task completes.

Technical breakdown

Why agent communication needs a protocol layer

An AI agent protocol defines how one agent or system advertises capabilities, exchanges context, requests actions and handles errors. Without that layer, each framework invents its own dialect, which makes integration brittle and increases the chance of conflicting actions, duplicated work or broken handoffs. In practice, protocols are the coordination surface for tool use, memory access and collaborative decision-making. They do not make an agent safe on their own, but they create a predictable interface that can be governed, logged and tested. See the Agent Identity Standards Tracker.

Practical implication: Treat protocol selection as an architectural control point and require explicit governance for message formats, authority boundaries and error handling.

How protocol choice affects identity and delegation

Protocols matter because they determine who or what is allowed to speak on behalf of an agent, what credentials it can present and how far delegated authority extends. In agentic systems, identity is not just a login event. It is a runtime relationship between the agent, its tools, its memory and the services it calls. If protocol design does not separate authentication from authorisation, agents can inherit broad access without clear policy boundaries. That turns orchestration into an access-control problem, not just a software-integration problem. See the Agentic AI Identity Guide.

Practical implication: Bind every agent interaction to a specific identity and scope, then verify that delegated access cannot outlive the task it supports.

Why multi-agent systems amplify failure modes

Once multiple agents collaborate, small errors become system-wide issues because each agent may amplify stale data, misread context or repeat an unsafe action. Coordination protocols are meant to reduce that risk by defining ordering, conflict handling and recovery behaviour. But the presence of a protocol does not eliminate downstream impact if the underlying trust model is weak. In cybersecurity workflows, a bad signal or poisoned context can propagate across agents quickly, especially when one agent’s output becomes another agent’s input. See the Agentic AI Security Guide.

Practical implication: Test multi-agent workflows for cascading failure and require containment rules that stop bad context from spreading across the system.

Threat narrative

Attacker objective: The objective is to exploit coordination weaknesses so the automation makes unsafe or unreliable decisions at scale.

1. Entry occurs when an agent is connected to tools, datasets or other agents without a consistent protocol and policy boundary.
2. Escalation follows when the agent inherits or propagates authority through poorly defined delegation, letting one action influence many downstream systems.
3. Impact arises when coordination errors, stale context or over-broad access produce incorrect decisions, duplicated actions or uncontrolled system behaviour.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Protocol standardisation is becoming a governance problem, not just an engineering convenience. Once AI agents can negotiate with tools, other agents and shared systems, the question becomes who controls the trust boundary between them. A protocol gives structure to communication, but it does not by itself define policy, ownership or accountability. Practitioners should treat agent protocols as part of identity governance, not as a purely technical plumbing layer.

The real risk is delegated authority without lifecycle control. Agent systems often need temporary access to data, tools and actions, but their runtime behaviour can exceed the assumptions built into traditional access models. AI agent authorisation becomes central here because task-scoped permissions only work if the system can enforce them per action, not just at login. Security teams should assume that any protocol able to move context can also move privilege unless boundaries are explicit.

Multi-agent collaboration introduces a new form of trust drift. When one agent’s output becomes another agent’s input, errors, stale context and manipulated data can travel quickly through the system. That creates a control problem around provenance, message integrity and recovery, especially in environments where agents support CTI or third-party risk workflows. Practitioners should govern the trust chain between agents as carefully as they govern privileged human workflows.

AI agent identity must be designed as a runtime model, not an account management afterthought. Agents need registration, authentication, delegation, retirement and revocation rules that reflect how they actually operate across tools and sessions. Without that, protocol choices will outpace the organisation’s ability to answer basic questions about which agent acted, under what authority and with what side effects. Security leaders should build agent identity controls before protocol sprawl becomes the default.

The named concept here is protocol-mediated delegation. That is the point where a communication standard quietly becomes an access model because every message can carry authority, context or execution intent. If organisations do not govern that boundary, they will confuse interoperability with control. The practical response is to treat protocol adoption as an identity and policy design exercise from day one.

From our research library:

• A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
• Read next: Agentic AI Identity Guide

What this signals

Protocol-mediated delegation: the next governance challenge is not whether agents can communicate, but whether every message can be tied back to a bounded identity and an enforceable scope. As agent ecosystems expand, organisations will need to manage trust at the point of interaction, not after the fact. That shifts control design toward registration, delegation and revocation rather than loose orchestration.

The most important programme change is that agent governance will need to sit alongside IAM, not inside generic automation tooling. Security leaders already recognise the shift, with 69% of security leaders saying identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. The practical implication is clear: protocols without identity controls will scale disorder faster than they scale productivity.

For practitioners

• Define protocol-level trust boundaries Specify which systems, tools and peer agents each protocol may reach, and require explicit approval for any cross-domain or cross-environment interaction.
• Bind each action to a governed agent identity Assign a distinct identity to each agent, record its delegated scope and revoke access when the task, workflow or session ends.
• Test for cascading failure across agent chains Simulate stale context, conflicting instructions and malformed messages to see how far a bad decision can propagate through collaborating agents.
• Review third-party and open protocol dependencies Map which external frameworks, libraries and message standards your agents rely on, then assess whether their trust assumptions match your policy model.
• Instrument agent activity for audit and attribution Log message origin, tool invocation, delegated authority and recovery actions so investigators can reconstruct how an agent reached a decision.

Key takeaways

• AI agent protocols solve coordination problems, but they also expose where governance for identity, delegation and trust is still immature.
• The core risk is not the protocol itself but the way it can carry authority across systems without enough lifecycle control.
• Practitioners should treat agent communication standards as an access-control decision and not as a purely technical integration choice.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Agentic AI Identity Guide · Agentic AI Security Guide · AI Agent Observability, Audit and Incident Response Guide · Agent Identity Standards Tracker

Key terms

• AI Agent Architecture: The runtime pattern that determines how an AI system receives inputs, makes decisions, uses tools, and hands work off. In governance terms, architecture matters because it defines where identity checks, approvals, and logging must happen, and whether those controls can be applied before or after execution begins.
• Protocol-Mediated Delegation: The transfer of authority through a communication standard rather than a direct human approval step. It matters because a message can carry enough context to trigger actions, use tools or extend access, so the protocol becomes part of the control plane as well as the transport layer.
• Inter-Agent Trust: Inter-agent trust is the set of assumptions one agent makes about another agent’s identity, input, and authority. If that trust is implicit or unauthenticated, attackers can exploit spoofing, replay, or poisoned messages to steer workflows and trigger broader failures across systems.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps security and identity practitioners design controls for systems that act, delegate and scale across modern environments.