Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Rules for handing work between agents
Verify that inter-agent task delegation is restricted by an explicit authorization policy.
OWASP AISVS v1.01, requirement 9.5.5
In plain English
In a multi-agent system, control which agents can hand tasks to which others with an explicit policy. Without one, a low-privilege agent that has been compromised can ask a high-privilege agent to do the damage for it.
What good looks like
- Allowed delegation paths are written down: which agent may delegate what to which agent.
- The runtime blocks any delegation the policy does not allow.
- The receiving agent authenticates the sender and checks the policy.
- Delegations are logged.
How teams usually do it
- Delegation rules in the orchestrator or a policy engine, checked on every hand-off.
- Authenticated agent-to-agent calls using each agent's own identity (9.4.1).
- A delegation depth limit, to stop long chains and loops.
Suggested evidence
- The delegation policy.
- Logs of allowed and refused delegations.
- A test of a disallowed delegation.
Common mistakes
- Any agent able to call any other.
- Agents that trust a message because it says it comes from the orchestrator.
- Sharing every agent's output in one common channel that all agents treat as instructions.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.