Build Auditable Multi-Agent Handoffs
Transfer control, context, authority, and evidence between specialized agents without losing user intent or creating hidden permission expansion.
By the end
You will be able to
- Define when delegation or full control transfer is justified.
- Create a versioned handoff packet with intent, evidence, authority, budgets, and return conditions.
- Filter context and permissions for the receiving agent rather than copying everything.
- Test misrouting, rejection, timeout, recursion, and unsafe output across agent boundaries.
Distinguish a bounded subtask from a transfer of control
Delegation keeps the parent agent responsible for the final result. The specialist returns a typed artifact that the parent validates and synthesizes. A handoff transfers active control so the specialist continues the interaction under its own instructions.
Choose deliberately. Use delegation for research, classification, review, or generation that should remain behind a coordinator. Use a handoff when a specialist must own the next user-facing phase and the user can understand that transition.
Transfer a contract, not a conversation dump
A handoff packet should name the run and parent, user goal, reason for routing, accepted facts with provenance, unresolved questions, completed actions and idempotency keys, current artifacts, allowed tools, denied actions, budget, success criteria, and return or escalation conditions.
Version the packet schema and bind it to a specific recipient role. The receiving agent validates required fields and can reject an incomplete, stale, misrouted, or over-privileged transfer.
{
"schemaVersion": "1.0",
"runId": "run_42",
"from": "triage",
"to": "curriculum-reviewer",
"reason": "verify-source-support",
"goal": "Review four claims",
"facts": [{"claim": "...", "sourceRef": "src_7"}],
"artifacts": ["draft/module.json"],
"allowedActions": ["read", "comment"],
"deniedActions": ["publish", "delete"],
"budget": {"turns": 3},
"returnWhen": ["review-complete", "evidence-missing", "policy-blocked"]
}Minimize context and re-evaluate authority
Do not forward the full conversation, hidden chain of thought, unrelated personal data, secrets, or every prior tool result. Select only what the specialist needs, preserve source labels, and clearly separate instructions from untrusted material.
Permissions do not automatically flow downhill. Resolve the recipient's identity and tenant, issue scoped credentials where needed, and require fresh approval if the specialist proposes a target or side effect outside the original grant.
Make both sides acknowledge the transfer
The receiver should accept or reject the packet with a reason. On acceptance, record the active agent and transfer time. On return, provide a typed outcome, changed artifacts, evidence, tool actions, remaining uncertainty, and the requested next decision.
Bound recursive delegation, repeated bounce-backs, and revision loops. If no eligible recipient accepts, required evidence is unavailable, or permissions conflict, escalate with the packet and failure history rather than guessing.
Map framework features without losing the portable contract
OpenAI's Agents SDK represents handoffs as tools and supports typed handoff input and history filtering. Google ADK supports agent-team and workflow structures. Anthropic describes orchestrator-worker and evaluator-optimizer patterns. These examples solve related problems but do not promise identical lifecycle or guardrail behavior.
Test the product contract independently of the framework: right recipient, minimal context, unchanged authority, trace continuity, bounded recursion, deterministic failure, and verified return artifact. Then add adapter tests for each selected provider implementation.
Practice activity
Create and break a multi-agent handoff
- Define triage, specialist, reviewer, and human roles for one workflow, including the exact reasons each may receive control.
- Create the handoff packet schema, context filter, permission mapping, acceptance response, and return result.
- Run scenarios for a correct transfer, wrong recipient, missing provenance, excessive permission, poisoned context, timeout, recursive bounce, and rejected handoff.
- Prove that the original goal, user constraints, completed side effects, and trace ID survive every accepted transition.
What to produce
- A versioned handoff and return contract with recipient validation, context filtering, authority, budgets, and escalation.
- Eight scenario traces showing acceptance, rejection, containment, bounded retry, and human escalation.
Reflect before continuing
What information was safe and useful for the parent but unnecessary or risky for the specialist?
Evidence
Sources and verification
- HandoffsOpenAI · verified 2026-07-25
- Agent orchestrationOpenAI · verified 2026-07-25
- Building effective agentsAnthropic · verified 2026-07-25
- Template agent workflowsGoogle · verified 2026-07-25
Knowledge check
Make it stick.
Choose the strongest answer for each question. Your attempts become part of your device-local transcript.