Inter-Agent Communication Allow-Listing

Agent-to-agent and tool-output invocation occurs when the output of one synthetic subject, tool, service, or agent becomes the triggering instruction for another synthetic subject. The effective instruction is propagated through an agent graph, tool chain, orchestration layer, or service-to-service workflow rather than being issued directly by a human operator.

This invocation creates an elevated exposure condition because machine-generated output may be treated as trusted task context by the next synthetic subject. A tool result, worker-agent summary, delegated task, inter-agent message, service response, or generated record may carry instruction-bearing content that causes another synthetic subject to act.

The primary risk is propagation without human review. A compromised, manipulated, or misaligned synthetic subject may produce output that recruits other agents, triggers tool-equipped workers, causes repeated actions, or spreads across a multi-agent system. The resulting behavior may resemble worm-like fan-out, synchronized drift, or cascading action across multiple agents.

A related risk is provenance loss. If inter-agent messages and tool outputs are not signed, attributed, or tagged by trust level, investigators may be unable to determine which agent originated the instruction, which agents propagated it, and where the first unsafe action occurred.

Investigators should review inter-agent messages, tool outputs, orchestration logs, delegation records, shared context, tool-call logs, agent identities, message provenance, and downstream actions across the agent graph. Particular attention should be given to instruction-bearing payloads, repeated payloads across agents, one-to-many fan-out, synchronized identical actions, and actions caused by peer output rather than an approved human instruction.

Investigative Relevance

Agent-to-agent and tool-output invocation is relevant because synthetic subject action may be triggered by another machine actor inside the workflow. The apparent local action may be only one step in a broader propagation chain.

This section is especially relevant where orchestrators delegate to worker agents, agents exchange messages, tools return model-visible output, services generate task instructions, agents share context, or multi-agent systems operate without human review at each handoff.

Agentic harm propagation occurs when an adverse condition affecting one synthetic subject spreads to other synthetic subjects, tools, memory stores, sessions, workflows, or systems. The spread may occur through agent-to-agent messages, shared memory, tool outputs, orchestration handoffs, connector metadata, generated records, or workflow state.

This adverse outcome creates organizational harm because the blast radius expands beyond the initial point of failure. A single poisoned input, unsafe output, false record, contaminated memory entry, or malicious connector may influence multiple synthetic subjects with different roles, permissions, tools, or data access.

The primary harm is system-wide amplification. An instruction, false record, unsafe behavior, misleading output, or malicious tool result may replicate or reappear across the agent graph, causing repeated data exposure, unauthorized actions, misinformation, fraud, operational disruption, or trust degradation.

A related harm is containment difficulty. By the time the adverse condition is detected, the original source may no longer be obvious. The same payload or false state may appear in summaries, task handoffs, memory entries, tool outputs, inter-agent messages, or downstream records, requiring investigators to reconstruct the propagation path across multiple logs and systems.

Investigators should review inter-agent communications, shared memory, orchestration logs, tool outputs, Model Context Protocol (MCP) server records, connector changes, memory writes, task handoff records, non-human identity activity, and downstream actions. Particular attention should be given to repeated instruction patterns, anomalous agent-to-agent message volume, poisoned memory records, tool-definition changes, one-to-many fan-out, and synchronized behavior across multiple agents.

Investigative Relevance

Agentic harm propagation is relevant because synthetic subject harm may not remain isolated. Agentic systems are often designed to share context, delegate work, call tools, and reuse memory, which can allow a localized adverse condition to spread through legitimate coordination paths.

This section is especially relevant where synthetic subjects operate in multi-agent systems, shared memory environments, MCP-connected tool ecosystems, orchestration frameworks, cross-agent workflows, or platforms where one agent’s output becomes another agent’s input.

An orchestrator and worker agent pattern uses a central planning agent to decompose a goal and delegate subtasks to specialized worker agents. The orchestrator may coordinate tool use, pass context between workers, sequence actions, and determine when the overall task is complete.

This deployment pattern creates an elevated exposure condition because the orchestrator may hold broad credentials, connectors, or authority needed to drive the full run. Its identity may aggregate the reach of multiple workers, making it a high-privilege chokepoint inside the system.

The primary risk is that a single manipulated orchestrator can direct harmful activity across many connected workers and systems. If the orchestrator is compromised, misdirected, or influenced by poisoned input, its instructions may propagate through the agent graph without a human reviewing each delegation step.

Investigators should review the orchestrator directive, delegation logic, worker permissions, shared context, credentials, tool access, inter-agent messages, task graph, and execution logs. Particular attention should be given to unexpected delegation paths, worker actions outside assigned subtasks, aggregate access exceeding task scope, and actions that cannot be traced to an approved operator objective.

Investigative Relevance

Orchestrator and worker agent patterns are relevant because they concentrate planning authority and distributed execution in one coordinated system. The orchestrator may not perform every action itself, but it can direct workers that hold specialized access or tools.

This sub-section is especially relevant where a central agent can invoke multiple workers, coordinate cross-system actions, aggregate credentials, pass instructions between agents, or complete multi-step workflows without human review between steps.

Cross-boundary agent collaboration occurs when peer agents owned by different teams, vendors, tenants, or organizations call each other over shared protocols or integrations. Each agent may treat the other’s output as both useful input and trusted instruction.

This deployment pattern creates an elevated exposure condition because trust is extended across boundaries that no single human subject could normally span. An instruction, recommendation, file, record, or tool result produced in one environment may be accepted and acted on inside another.

The primary risk is boundary-crossing instruction propagation. A malicious or injected instruction may move from one agent to another and influence actions outside the original trust zone. Internal confidential information, customer data, intellectual property, or regulated records may also pass to another agent, vendor, tenant, or organization without human awareness, creating legal, contractual, regulatory, or confidentiality exposure.

A related risk is weakened attribution. Logs may show only local agent activity rather than the external agent, source content, or original instruction that caused it. This can make origin, authorization, data movement, and responsibility difficult to reconstruct.

Investigators should review the agents’ directives, inter-agent protocols, trust relationships, authentication model, message provenance, shared context, tool outputs, data tags, and cross-boundary logs. Particular attention should be given to new collaboration paths, externally originated instructions, data appearing outside its authorized trust zone, and actions that cannot be traced to an approved source.

Investigative Relevance

Cross-boundary agent collaboration is relevant because it allows synthetic subjects to extend trust and action across teams, vendors, tenants, or organizations. A harmful instruction or sensitive data transfer may propagate through legitimate collaboration paths while appearing to each receiving agent as authorized input.