How could delegation security for multi-agent AI change multi-agent delegation workflows over the next two years?

How will delegation security change the way agents work together?

Today, when an AI agent starts a session, it gets a fixed set of permissions that stay the same for the whole session. Each request is checked on its own, without considering what the agent did before. That means an agent could combine individually allowed actions into something harmful, or delegate authority to a sub-agent without any limits. The new wave of delegation security replaces this with a chain of custody: every time Agent A delegates to Agent B, the system records exactly what permissions B gets, and those permissions can only be fewer than A's, never more. This is called 'monotonic attenuation' — a fancy way of saying the authority only shrinks as it flows down the chain [4]. The practical effect is that a compromised sub-agent can't escalate beyond its narrow scope, and the whole chain can be audited later.

The strongest evidence for this shift comes from a study that tested a system called Agentic Principal Chain (APC) across 3,154 real-world attack scenarios. When the system enforced delegation chains with six authorization checks, data exfiltration in the AgentDojo benchmark dropped from 75–100% to 0% across all four domains, and it blocked all 544 data-stealing cases in the InjecAgent benchmark [1]. That's not a theoretical promise — it's a measured result on realistic attack suites. The same study showed that binding each action to the original user intent reduced destructive actions from 38.6% to 4.0% and manipulation from 90.5% to 12.1% [1]. So the change isn't just about preventing data theft; it's about stopping agents from being tricked into doing harmful things in the first place.

What's the catch? Can these systems really verify that an agent is doing what the user intended?

The honest answer is: the cryptographic parts are rock-solid, but verifying intent — whether the agent's action actually matches what the human wanted — is still the weak link. A study of SentinelAgent, a framework for federal multi-agent systems, proved that deterministic intent verification is practically impossible [2]. In their tests, a sophisticated adversary using paraphrasing could fool the intent-checking model 13% of the time, even though all the other six security properties held up perfectly under stress testing [2]. That means an attacker who can craft a cleverly worded prompt might still get an agent to do something unintended, but they'd be constrained to permitted API calls, conformant outputs, and traceable actions — so the damage is limited.

This is a crucial nuance: the security systems are designed to fail safe. Even when intent verification fails, the other layers — like scope conformance and cascade containment — keep the adversary from doing catastrophic damage. The same SentinelAgent study showed that when they fine-tuned the intent model on government-specific delegation examples, detection of malicious intent jumped from 1.7% to 88.3% true positive rate [2]. That suggests the weakness is not hopeless; it's a matter of training the intent model on the right domain. But it also means that for the next two years, we should expect delegation security to be excellent at preventing unauthorized actions, but not perfect at catching every cleverly disguised malicious intent.

What will actually change in how organizations use multi-agent AI?

For organizations, the most immediate change will be the ability to delegate tasks to AI agents without fear of runaway permissions. Instead of giving an agent broad access to a database and hoping it behaves, you'll be able to issue a token that expires in an hour, can only read specific fields, and can only be passed down one level of sub-agents. This is exactly what Delegation Capability Tokens (DCT) provide: cryptographic signatures that prevent forgery, time bounds that limit exposure, and chain tracking for audit [4]. Similarly, Agentic JWT (A-JWT) binds each action to a verifiable user intent and a specific workflow step, and it blocks scope-violating requests, replay attacks, and impersonation with sub-millisecond overhead [3]. That overhead is key — it means the security doesn't slow down the agent's work.

The other big change is accountability. With protocols like Human Delegation Provenance (HDP), every action in a delegation chain can be traced back to the human who authorized it, using only a public key and a session ID — no third-party registry needed [5]. This is a game-changer for regulated industries like finance and healthcare, where you need to prove who authorized what. The papers here converge on the same conclusion: the future of multi-agent workflows is one where delegation is explicit, scoped, and auditable, not implicit and open-ended. The technology is already being standardized — HDP is an IETF draft, and Agentic JWT aligns with ongoing OAuth discussions [3][5]. So within two years, we'll likely see these protocols baked into enterprise AI platforms, making it routine to run fleets of agents with fine-grained, cryptographically enforced permissions.

About These Sources

This answer is built on 5 studies (all preprints) — published from 2025 to 2026, 5 from 2024 or later — selected as the most relevant from 7 studies that passed quality screening, drawn from 52 papers retrieved from a database of over 500 million.

Sources used in this answer

Related research questions