Inter-agent trust is the missing control in multi-agent governance

At a glance

What this is: This analysis says multi-agent systems fail when downstream agents cannot verify the legitimacy of instructions passed by upstream agents.

Why it matters: It matters because IAM, NHI, and emerging agent governance programmes must treat delegation boundaries as trust boundaries before autonomous handoffs create unreviewable privilege propagation.

By the numbers:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.

👉 Read Noma Security's analysis of inter-agent trust in multi-agent systems

Context

Multi-agent architecture is changing the identity problem from whether an agent should act to whether one agent can trust another agent's instruction. In these systems, the governance gap appears at the delegation boundary, where identity, scope, and accountability often stop being verifiable.

That gap sits squarely inside NHI governance because orchestrator agents, sub-agents, service identities, and scoped credentials all interact in a chain. The first-order question is no longer just least privilege for a single agent. It is whether every handoff preserves verifiable authorization and a bounded blast radius.

For practitioners, the issue is already familiar even if the technology is new. This is least privilege, separation of duties, and auditability applied to machine-to-machine delegation, with the added complication that agent behaviour can shift faster than traditional review cycles can observe.

Key questions

Q: How should security teams govern AI agents that move across multiple trust boundaries?

A: They need runtime controls that follow the agent rather than staying attached to one platform. The practical test is whether enforcement, telemetry, and inventory remain consistent as the agent moves from IDEs to MCP servers to downstream SaaS actions. If the control breaks at the boundary, governance is incomplete.

Q: Why do multi-agent systems create more security risk than single-agent systems?

A: They introduce more trust relationships, more message paths, and more shared state that can be poisoned or misused. Each extra agent expands the attack surface and makes policy enforcement harder. The risk is not only model error, but also uncontrolled delegation, duplicated permissions, and failure propagation across the workflow.

Q: What do organisations get wrong about audit logs for agentic workflows?

A: They often log the final action but not the delegation chain that led to it. For governance, that is incomplete because you need the delegator, the receiver, the scoped credential, and the verification state to understand accountability.

Q: Who is accountable when an AI agent delegation chain causes an unauthorised action?

A: Accountability depends on whether the organisation can reconstruct the chain. If logs capture sender identity, recipient identity, task ID, delegation depth, and validation results, investigators can pinpoint the failing handoff. Without that trail, responsibility becomes ambiguous across the orchestration layer and the individual agents.

Technical breakdown

Why agent-to-agent handoffs break traditional identity trust

Traditional IAM assumes the credential travels with the actor and can be validated at the point of use. In a multi-agent workflow, the receiving agent often sees only a message, not the original human authorization, the upstream session state, or the provenance of the instruction. That makes the handoff itself the trust boundary. If the orchestration layer does not attach cryptographically verifiable identity and scope metadata, the downstream agent has no independent way to confirm legitimacy. The result is implicit trust across a chain that looks orderly but is not auditable end to end.

Practical implication: treat every inter-agent handoff as a security boundary that must carry verifiable identity, scope, and provenance.

Standing privilege becomes transitive across agent chains

When a sub-agent inherits the orchestrator's permissions, the system is no longer enforcing least privilege at the task level. The problem is not just broad access, but delegated broad access that propagates through each hop in the chain. That creates standing privilege by inheritance, even when each individual action looks narrowly scoped. In practice, one compromised upstream session can expose internal data retrieval, code execution, or external transmission paths downstream. This is why multi-agent systems need delegation-specific scoping, not just role design for the primary agent.

Practical implication: issue task-scoped, expiring permissions for each delegation hop instead of copying the orchestrator's session rights.

Why audit trails must show the full delegation chain

A leaf-node log entry that says an action occurred is not enough to govern agentic workflows. Security teams need the delegating agent identity, the receiving agent identity, the scoped credential used, the correlation ID, and whether the instruction was verified or simply accepted from a trusted peer. Without that chain, detection may see a valid action while governance misses the compromised instruction path that produced it. This is the difference between recording execution and recording accountability.

Practical implication: require logs that capture delegation, scope, and verification status, not just the final action.

Threat narrative

Attacker objective: The attacker wants one compromised agent to drive trusted downstream execution across the delegation chain without triggering a trust boundary check.

1. Entry occurs when a poisoned prompt, compromised orchestrator context, or malicious upstream task causes the first agent to generate a believable delegation message.
2. Escalation happens when the downstream agent accepts the instruction as legitimate and inherits permissions broad enough to retrieve data, execute code, or transmit output.
3. Impact follows when the chain propagates the manipulated task across multiple agents, extending the blast radius beyond the original compromise point.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Inter-agent trust is now an identity problem, not just an AI architecture problem. The security failure is not simply that agents can do useful work. It is that a downstream agent may accept an instruction without any independent proof that the upstream agent was authorised to issue it. That breaks the core IAM assumption that authorization can be validated at the point of action. Practitioners should treat delegation trust as a first-class governance domain.

Least privilege at the agent level is insufficient when privilege is inherited transitively. The article exposes a specific control gap: standing privilege moving through the chain by default. This is not a tooling edge case. It is a governance model that allows an orchestrator's wider permissions to bleed into sub-agent execution, which is why task scope must be separated from session scope. Practitioners need to redesign delegation, not just permission sets.

Inter-agent trust protocol is the right named concept for this emerging control plane. Cryptographic agent identity, scoped task assertions, and dynamic trust evaluation define a new boundary for machine trust. That concept aligns closely with OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework, because the risk is not only misuse, but unverifiable delegation. Practitioners should assume the control plane must prove who authorised what, and when.

Auditability fails when logs capture execution but not delegation provenance. A downstream action without the upstream chain is a forensic record, not a governance record. This matters across NHI, IAM, and agentic AI because the same accountability gap appears whenever a credential, token, or message is passed without verifiable lineage. Practitioners should insist that the identity of the delegator is as visible as the identity of the actor.

The market is moving toward multi-agent systems faster than governance models can adapt. That creates a short-lived but real window where organisations will deploy orchestration before they can verify trust between agents. The implication is not to slow adoption indefinitely. It is to recognise that review cadences designed for human-paced decisions will miss within-chain failures, so the governance model must shift to runtime verification and bounded delegation.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to The 2026 Infrastructure Identity Survey.
• For a broader operating model lens, see OWASP NHI Top 10 and how it frames agentic trust boundaries.

What this signals

Inter-agent trust becomes the new delegation control plane: organisations that already struggle to govern AI agent scope will need a stricter model for who can authorise whom, because the handoff is now the risk boundary. With 53% of security leaders expecting AI to run major portions of infrastructure autonomously within three years, the pressure on identity governance will shift from policy drafts to runtime enforcement.

The practical signal is that this problem will not stay inside AI teams. IAM, PAM, and NHI owners will have to align on the same controls that apply to service accounts and workload identities, but with stronger provenance requirements. The architecture needs to prove delegation, not merely permit it.

As the control plane matures, practitioners should expect more scrutiny on inter-agent authentication, down-scoped delegation, and audit completeness. The organisations that can show chain-of-trust evidence will be better positioned to deploy multi-agent systems without inheriting invisible privilege propagation.

For practitioners

• Map delegation chains before scaling multi-agent workloads Document which agents can pass tasks to which other agents, under what identity, and with what inherited scope. If you cannot show the chain, you cannot govern the chain.
• Issue task-scoped credentials for every handoff Replace copied session permissions with just-in-time, expiring credentials bound to a single delegated task. Do not allow the sub-agent to inherit the orchestrator's full authority by default.
• Require provenance-rich audit logging Log the delegating agent identity, receiving agent identity, scoped credential, correlation ID, and verification state for every inter-agent action. Leaf-node action logs alone are not enough.
• Separate planning from execution roles Avoid architectures where one agent both plans and executes high-impact actions across internal and external systems unless its authority is explicitly bounded and reviewable.
• Test for trust-boundary bypass in agent harnesses Red-team the harness, not just the model, by asking whether a downstream agent will execute instructions from a compromised peer without independent verification.

Key takeaways

• Multi-agent systems create a governance gap at the handoff, where downstream agents often trust instructions they cannot independently verify.
• The main risk is transitive privilege, because copied or inherited authority can move beyond the task scope and widen blast radius across the chain.
• Practitioners need provenance-rich audit trails and task-scoped delegation now, because runtime trust boundaries matter more than static permissions in agentic workflows.

Key terms

• Inter-Agent Trust: Inter-agent trust is the set of assumptions one agent makes about another agent’s identity, input, and authority. If that trust is implicit or unauthenticated, attackers can exploit spoofing, replay, or poisoned messages to steer workflows and trigger broader failures across systems.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Transitive privilege: Privilege that is inherited by a downstream actor through an upstream delegating identity. In agentic environments, it becomes a governance problem when a sub-agent receives more authority than its task requires simply because the orchestrator already had it.
• Provenance-Rich Audit Log: An audit record that captures who delegated, who executed, what scope was used, and whether the instruction was verified. This is the minimum evidence needed to govern agentic workflows because action-only logging cannot explain how trust was established or broken.

What's in the full article

Noma Security's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step examples of how inter-agent trust breaks across orchestration and sub-agent handoffs
• The specific threat model behind poisoned instructions, trust propagation, and chain-wide blast radius
• Architectural guidance on cryptographic agent identity and dynamic trust scoring
• Implementation context for multi-agent frameworks that do not enforce inter-agent authentication by default

👉 The full Noma Security post covers the delegation chain, trust assumptions, and runtime guardrails in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.