Vectors | When Agents Call Agents

When Agents Call Agents

How ordinary tool calls create shadow delegation

Niki A. Niyikiza published on

August 22, 2026

21 min,

4073 words

Categories:

Agentic Security

Tags:

security

ai

agents

delegation

Calls to agents increasingly come from other agents, as general-purpose assistants route work to specialists. On the wire, these are ordinary tool calls, but if you zoom out and look at them architecturally, each one is a delegation boundary. The calling agent hands part of a user’s task to a separate agent that’s non-deterministic and running in another security context.

Enterprise vendors ship it as a feature. Glean can expose custom agents as MCP tools, Salesforce can publish Agentforce agents for external assistants to invoke, creating “a pathway for tools such as Slackbot, ChatGPT, or Claude to delegate specialized tasks to Agentforce agents,” and Snowflake recommends exposing a Cortex Agent as the client-facing MCP tool for governed business-data applications. Microsoft is the most explicit: in Agent Framework, they envision one agent calling another “as if it were a regular function tool”.

Enterprise IAM can authenticate every participant in the chain and confirm that each call is permitted. What it doesn’t always show is the relationship between the final action and the originating task. Each authorization decision sees only the immediate calling principal. The service at the end of the chain makes the most consequential decision with the least context.

An agent exposed through MCP is discoverable as one more tool, even though invoking it starts its own chain of reasoning, action, and delegation.

Shadow delegation

Consider an on-call engineer who asks an operations assistant (Claude Code, Codex, or an internal equivalent) to investigate elevated latency in the payments service. The assistant invokes an Incident Agent exposed as an MCP tool. During its investigation, that agent retrieves a past incident where rolling back a deployment cleared a similar latency issue, concludes the same remedy applies here, and invokes a Deployment Agent available as one of its own tools.

engineer → operations assistant → Incident Agent tool<br>“Investigate elevated latency in payments.”<br>↳ Deployment Agent tool → production rollback

This execution follows ordinary agentic behavior. The agents interpret the task, select tools, and delegate work as the situation develops. Every local authorization check can also succeed: the engineer is authorized to use the assistant, the assistant to invoke the Incident Agent, the Incident Agent to invoke the Deployment Agent, and the Deployment Agent to perform production rollbacks.

At the production boundary, every familiar signal supports the request: the engineer can authorize rollbacks, the Deployment Agent can execute them, and the logs show how the call arrived. The originating task was an investigation, and that is the one fact the final tool call leaves out.

This is shadow delegation in practice:

One agent assigns work to another, and the handoff travels as an ordinary tool call and is recorded as one. Every participant and call can be visible, yet the on-behalf-of relationship remains implicit.

An explicit handoff is a real improvement: it names the boundary and gives authorization somewhere to attach. Multi-agent frameworks already model delegation that way, and CrewAI hands a delegating agent a tool with the signature Delegate work to coworker(task, context, coworker), naming the work, the context, and the recipient. That tells you who is doing what for whom, and leaves what that agent may do to the credentials it already holds. The signature is missing a fourth argument for the authority the task confers.

Incidents caused by shadow delegation will rarely be classified as delegation failures. The final audit record shows an authenticated agent performing an operation it’s permitted to perform, so investigators reach for excessive permissions, credential misuse, or faulty agent behavior. Each of those diagnoses comes with a fix, and teams apply them: tighter roles, rotated credentials, more guardrails on the model. The handoff itself goes unexamined, and authority still travels the same way.

Authorization for emergent delegation chains

Now take the perspective of a security architect responsible for securing agentic workflows across an organization. The agents, tools, and services involved may come from different teams and vendors, cross several security domains, and assemble into a call graph only at runtime. The organization needs a consistent authorization model that accommodates this flexibility and still gives every enforcement point trustworthy evidence of what authority the task carried and how it reached the agent presenting the request. The rollback scenario is enough to test the familiar approaches against that standard.

You cannot enumerate the graph in advance. A user knows which agent they invoked,...