A multi-agent system is an architecture in which several AI agents collaborate and delegate to accomplish tasks exceeding the scope of any single agent. Common patterns include manager-worker hierarchies, peer-to-peer collaboration, sequential pipelines, and dynamic agent spawning.
- Several agents collaborating and delegating to complete one larger task
- Patterns include hierarchies, peer collaboration, pipelines, and spawning
- Identity, context, and policy must propagate through every handoff
- Audit chains break at delegation unless attribution is captured per step
Why is a multi-agent system important?
Multi-agent systems matter because they compound the governance problem rather than adding to it linearly. When agent A calls agent B and B calls a tool, the audit chain breaks unless identity, context, and policy propagate through each handoff. Every delegation is a point where attribution can be lost.
The compliance consequence is the same one agent identity raises, amplified. Regimes built around traceable accountability – SOX, HIPAA, PCI DSS – assume the actor named in the log is the actor that took the action. Agent-to-agent delegation makes that assumption fragile, because the agent that acted may be three handoffs away from the identity recorded at the start.
There is a second-order problem specific to composition. Each individual action in a chain can be permitted while the sequence as a whole is one no policy would have approved. Reviewing actions independently misses it, which is why policy has to see the chain rather than only the steps.
What is a multi-agent system?
A multi-agent system is an architecture where multiple agents work on a shared objective, passing work and context between them. It exists because single agents hit limits – context length, reliability across long tasks, and the value of specialization.
Three mechanisms make one work, and each is also a security surface. Delegation passes a subtask from one agent to another with whatever authority that requires, which is where more authority can travel than the subtask needs. Context exchange carries the state the receiving agent needs, which is also how injected instructions cross a trust boundary from content an upstream agent read. Coordination determines sequencing and how results combine, which is what can produce a sequence no participant would have executed alone.
A multi-agent system is not simply several agents in one environment. The defining property is that they invoke each other, which is what creates the handoff and the attribution problem with it.
Types of multi-agent systems
Architectures divide by how authority and sequencing are arranged.
Manager-worker hierarchies place a coordinating agent over specialized subordinates. Authority concentrates in the manager, which makes it the highest-value target and the natural place to enforce policy.
Peer-to-peer collaboration lets agents invoke each other without a central coordinator. It is more resilient and considerably harder to govern, since there is no single point every request passes through.
Sequential pipelines pass work through a fixed series of agents, each performing one stage. Predictable and easier to audit, because the path is known in advance.
Dynamic spawning lets agents create further agents at runtime to handle subtasks. It is the most flexible pattern and the hardest to inventory, since the agent population changes during execution and spawned agents often have no registered owner.
Most production systems are hybrids, and the spawning pattern is the one that most often surprises a security team reviewing an environment.
Multi-agent system & Onyx
Onyx treats every agent in a multi-agent system as a distinct identity, with policy enforcement at each request boundary and an audit trail carried across handoffs. That is what keeps attribution intact where it would otherwise be lost: each agent in a chain is a separate principal, and each delegation is a decision point rather than an inherited assumption.
Because enforcement happens at every boundary rather than only at the entry point, a subordinate agent cannot exceed policy by virtue of having been invoked by a permitted one. Just-in-Time access reinforces the same property, since authority is granted per request rather than passed down a chain. Agent identity and access governance covers the identity side, and dynamic spawning is surfaced by continuous discovery.
