Threat dossier · P2
Agent-to-agent delegated trust
Multi-agent workflows can amplify one compromised or mistaken agent across downstream tools, identities, and delegated tasks.
Direct answer
What is agent-to-agent delegated trust?
Delegated-trust risk appears when one agent accepts another agent’s identity, instructions, claims, or requested actions without enough verification or scope control.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
Agent A receives or produces a delegated request.
Step 2
Agent B treats upstream identity/context as sufficiently trusted.
Step 3
Delegated scope expands beyond the original task.
Step 4
Downstream actions execute with B’s capabilities or credentials.
Coverage boundary
What this control can cover
- Supported downstream action policy can still constrain consequential tool/command requests.
- Evidence can make the trust boundary and non-coverage explicit.
What it does not prove or prevent
- Universal agent identity attestation or protocol-level trust.
- Protection of delegation that never reaches a Guard-visible action surface.
Policy pattern
Policy pattern for agent-to-agent delegated trust
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: Multi-agent workflows can amplify one compromised or mistaken agent across downstream tools, identities, and delegated tasks.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Universal agent identity attestation or protocol-level trust.
- Protection of delegation that never reaches a Guard-visible action surface.
If you suspect prompt injection
Step 1
Response 1
Stop delegation and identify the originating agent/context.
Step 2
Response 2
Revalidate identity, scope, and authorization.
Step 3
Response 3
Reduce delegated permissions and replay safely.
Step 4
Response 4
Preserve redacted evidence across agent boundaries.