Agent delegation fails safely only when authority is delegated with the work, not copied as a reusable credential. An upstream assistant’s identity should not automatically become a downstream service account with blanket access. The receiving service must validate the principal, scope, audience and expiration of each request.
Separate work identity from user identity
The initiating user may request a task, while a coordinator invokes a specialist and the specialist calls an external API. Record all three roles. Prefer scoped delegation tokens for a particular audience, tenant, operation and duration over exporting a user’s session cookie or a long-lived API key. If the receiving service needs greater privileges than were originally granted, ask the proper authority through a separate approval process. Never use a model-generated explanation as proof that the user consented.
A concrete delegation sequence
Imagine a legal-operations agent asking a document agent to draft a contract summary. The coordinator sends document IDs and a read-only permission token; the document agent can read exactly those authorized files. It returns a signed or otherwise verifiable result reference, not an unrestricted link to the entire document store. Publishing the summary to external counsel is a separate action requiring recipient and content approval at the parent workflow. Log the chain of delegation without embedding token values.
How to handle authorization-required states
A2A supports the concept of tasks that require authorization before proceeding. A remote agent should explain what authorization is needed without asking the model to collect passwords through ordinary text. The client can present a trusted approval or account-linking experience and resume only after a verifiable security handshake. Reject instructions delivered inside untrusted artifacts that claim higher priority or demand broader permissions.
Failure, revocation and account boundaries
Credentials can expire while a multi-hour job is in flight. Design a pause-and-renew path that does not broaden scope. When a user revokes access, propagate the revocation to downstream jobs, caches and tokens, including work waiting in queues. A cancelled task should not keep making API calls through an old token. Reconcile in-flight changes and document any actions that cannot be undone; audit records must distinguish requested from committed operations.
Testing and architecture choice
Attempt cross-tenant task reads, incorrect audience tokens, replayed approval messages, scope escalation by nested agents and redirect-based credential forwarding. Measure successful unauthorized reads and writes at the API, not merely whether the model declines to help. For simple read-only tools, direct authorization checks can be easier to reason about than a hierarchy of autonomous agents.
Keep delegation explicit and revocable
A delegated workflow should say whether downstream services act on behalf of the user or their own organization identity. This affects audit history, permission scope and who may approve a sensitive step. Record the entire chain and bound each credential to a purpose. Prohibit an agent from copying a token into a different tool merely because it wants to complete the task faster; create a fresh, consented authorization instead.
Production acceptance and review test
Revoke a user in a simulated multi-agent job while a delegated worker is waiting on a queue. Verify that later tool calls fail and cached file references cannot reopen restricted material. Test a remote agent that changes its declared permissions mid-task. A safe orchestrator pauses and asks an authorized operator to reassess the scope, while preserving an immutable record of earlier actions.
Scope, version and availability
Features documented by a current vendor page are not assumed to have existed in earlier releases. Where a historical launch date is provided, it is supported by a dated first-party publication. Exact subscription tier, market availability, quotas, API billing, licensing permissions and deployment regions are not asserted without a directly applicable record. This is researched editorial guidance rather than a claim of independent hands-on testing, deployed operation or statutory certification.
Sources and Further Reading
- A2A Protocol Project — A2A specification (source reviewed 2026-10-25)
- OpenAI — Designing AI agents to resist prompt injection (source reviewed 2026-10-25)