How do organisations decide where to enforce policy in agent-to-agent architectures?

Why This Matters for Security Teams

Agent-to-agent architectures break the old assumption that policy can be attached to a single application or framework and then trusted to hold. Once agents can delegate, chain tools, and call models on behalf of other agents, the enforcement point must see the full request path, not just the local code path. Current guidance suggests the most reliable control point is the gateway because it can evaluate identity, authorization, quotas, tracing, and loop limits consistently across implementations.

This is especially important because agentic failures often look like ordinary integration traffic until the blast radius is already expanding. NHI Mgmt Group notes that 97% of NHIs carry excessive privileges, which is exactly the kind of condition that becomes dangerous when an autonomous workflow starts composing permissions across services. The risk is not only over-privilege, but also policy drift when every framework team invents its own guardrails. The operational lesson is reinforced by work such as the OWASP NHI Top 10 and the NIST AI Risk Management Framework, both of which emphasise runtime governance over static assumptions. In practice, many security teams encounter policy gaps only after an agent has already delegated beyond its intended scope.

How It Works in Practice

Policy enforcement in agent-to-agent systems should be designed as a runtime decision layer, not a code review exercise. The gateway receives each delegation request, model call, and tool invocation, then evaluates whether the requesting agent is allowed to act in that context. That decision typically combines workload identity, task intent, environment constraints, and limits on downstream actions. For example, one agent may be permitted to draft a customer reply, but not to invoke a payment API or spawn another agent without fresh approval.

In practice, the gateway becomes the point where organisations apply policy-as-code, short-lived credentials, and observable controls. A good implementation usually includes:

• Workload identity for each agent so the gateway can distinguish one autonomous entity from another.
• Context-aware authorization so permission depends on the task, not just the agent’s nominal role.
• Quotas and loop safeguards to stop recursive delegation or runaway tool use.
• Central logging and tracing so the policy graph can be reviewed after the fact.
• Ephemeral delegation tokens or JIT credentials so access expires when the task ends.

This model aligns with current thinking in the CSA MAESTRO agentic AI threat modeling framework and the OWASP Agentic AI Top 10, both of which stress that behaviour is dynamic and enforcement must follow the execution path. NHIMG research on the CoPhish OAuth Token Theft via Copilot Studio shows why policy at the control plane matters when one agent can inherit trust from another. These controls tend to break down when teams allow direct agent-to-service calls around the gateway because the policy graph becomes fragmented and unauditable.

Common Variations and Edge Cases

Tighter gateway enforcement often increases latency, integration effort, and operational ownership, so organisations must balance strong control with developer friction. That tradeoff is real, especially in multi-team environments where some agents are internal, some are vendor-managed, and some are built on different orchestration stacks. There is no universal standard for this yet, so current guidance suggests separating policy into a small number of shared enforcement points rather than trying to mirror the same rules in every framework.

Two edge cases matter most. First, delegated sub-agents may need bounded autonomy for a short period, which is where JIT policy issuance is more practical than static entitlements. Second, highly regulated workflows may require an additional business approval step before the gateway releases a sensitive action, such as sending data outside the trust boundary or modifying records. The main exception is offline or air-gapped processing, where a central gateway may be impossible and local enforcement must be paired with stronger pre-approval, but that should be treated as a constrained exception rather than the default.

NHIMG’s Ultimate Guide to NHIs is clear that visibility and privilege hygiene are still weak in most environments, which makes decentralised policy a poor fit for early-stage agent fleets. The practical rule is simple: when the architecture can route around a control, it eventually will. Organisations that enforce at the gateway avoid that drift, while those that embed policy inside each agent usually discover inconsistencies after the first cross-agent incident.

Related resources from NHI Mgmt Group

• When should organisations treat an AI agent as a privileged system?
• How should organisations enforce AI policy compliance across employee and agent use?
• What is the difference between human identity governance and AI agent governance?
• When does AI agent access create more risk than it reduces?