How do you secure multi-agent software architectures in enterprise AI systems?

Why Multi-Agent Architectures Demand a New Security Playbook

Multi-agent software architectures replace single monolithic LLM endpoints with collections of cooperating agents that plan, call tools, exchange messages, and sometimes delegate authority to one another. Each additional agent expands the attack surface, because every prompt boundary, every tool call, and every inter-agent channel is a place where untrusted input can flow into a model that has real permissions. By September 2026, deployments of two or more cooperating agents inside a single workflow have moved from research demos into production at banks, telecom operators, and government services, and the security community has begun treating the agent topology itself as a primary risk domain rather than a deployment detail.

Also worth reading: How do runtime token governance frameworks function in 2026 enterprise architectures? · What is the definitive structure for an EU AI Act technical documentation template and how do enterprise software teams implement it? · What are the most effective AI contract risk mitigation strategies for enterprise software deployments in 2026?

The trouble with traditional application security is that it assumes deterministic code paths. An agent deciding which of three tools to call next is non-deterministic, which means static rule engines and signature-based scanners miss most abuses. A prompt-injection payload embedded in a tool response can trick the planner agent into exfiltrating data through a second agent that holds broader privileges, producing a chain of behaviour that no individual component would have allowed in isolation. Treating multi-agent security as an extension of API security, or of single-agent guardrails, underestimates this cross-agent propagation problem by roughly an order of magnitude in observed incident severity.

Enterprises that have already moved past single-agent pilots usually cite three recurring pain points: identity sprawl between agents, opaque data flows, and an inability to reproduce an incident after the fact because the agent's reasoning trace was never logged. None of these are solved by a firewall in front of the model. They require a layered strategy that treats agents, tools, and the channels between them as first-class infrastructure.

The Layered Strategy: Agents, Tools, Channels, Identity, Observability

A workable security model for multi-agent systems stacks five defensive layers, each addressing a distinct failure mode rather than overlapping with the others. The first layer covers the agents themselves: model isolation, sandboxed runtimes, system-prompt hardening, and per-agent scope limits. The second layer covers the tools and skills agents can invoke, using allow-lists, egress filtering, schema validation, and rate limits. The third layer covers inter-agent channels, enforcing message-level authentication, structured payloads instead of free text, and minimum-privilege routing rules. The fourth layer is identity and authorisation, mapping each agent and each user request to a short-lived credential with explicit scopes. The fifth layer is observability, capturing prompts, tool calls, plan traces, and decisions in immutable storage that can be replayed during incident response.

Amazon Web Services has published a four-principle model for agentic AI that maps closely onto these layers: least privilege, session isolation, immutable audit trails, and validated tool boundaries. Infosys has framed enterprise multi-agent defence around a similar stack, calling out agent-to-agent authentication and tool egress controls as the two areas most often missing from early deployments. Cisco's Secure AI Factory with NVIDIA extends the same idea to the edge, where agents may run on switches and industrial gateways rather than in central data centres, adding hardware-rooted identity to the layer stack.

The layers are not equally expensive to retrofit. Identity and observability can usually be added within a quarter. Agent isolation and tool allow-lists typically require re-architecting the workflow because they constrain how agents can be composed. Inter-agent channel security is the most common blind spot and the one most likely to require a new gateway component rather than a configuration change.

Agent Identity, Authentication, and Authorisation

Agents in a multi-agent system need identities that survive across requests but rotate frequently enough to limit blast radius. A pragmatic pattern, now common in 2026 deployments, is to bind each agent invocation to a workload identity issued by the platform (for example SPIFFE- or IAM-style), valid for the lifetime of a single workflow run and scoped to the specific tools that workflow needs. The agent's user, the orchestrator, and the downstream tool all verify the same short-lived token rather than sharing a long-lived API key.

Authorisation should follow the principle of least privilege at the agent level, not just the user level. A retrieval agent that can read documents does not need write access to the same documents. A planner agent that selects which downstream agent to call does not need direct access to sensitive data stores. The most resilient designs separate read-only and write-capable roles into different agents so that a prompt-injection compromise of one role cannot silently trigger destructive actions through another. Teleport's positioning of privileged access management for AI agent infrastructure reflects this need: agents, like human operators, are now treated as principals whose access must be brokered, recorded, and time-boxed.

Cross-agent delegation deserves particular care. When agent A calls agent B and passes a user token, the token's scope should narrow, not expand, at each hop. Many teams make the mistake of forwarding the original user's full token, which lets a compromised downstream agent act on behalf of the user in any system the user can reach. A safer pattern is to mint a derived token with only the scopes that the called agent actually needs, and to record the chain of derivation for audit.

Tool Boundaries and Egress Control

Tools are where most multi-agent breaches have materialised in the past 18 months, because tools are the agents' hands and eyes on the outside world. A coding agent that can run shell commands, a research agent that can fetch arbitrary URLs, and a finance agent that can call payment APIs each turn an LLM into a potentially destructive actor if their tool surface is not tightly constrained.

The minimum viable tool boundary is an allow-list of tool names, each with an explicit JSON-schema for arguments and an explicit egress policy for outbound network calls. Anything outside the schema should be rejected before the tool ever runs. AWS's description of its Security Agent architecture, which automates penetration testing across multiple cooperating agents, treats tool allow-listing as non-negotiable and pairs it with a human-in-the-loop checkpoint for any action that mutates state outside the test target. NTT DATA's multivendor agentic services framework takes a similar stance for enterprise infrastructure operations, insisting that any agent action that changes a production system must be previewed and approved.

Network egress from agent tools is the second-most-overlooked control. An agent that can read arbitrary URLs can be tricked into leaking internal documents to an attacker-controlled host through a prompt-injection payload hidden in a web page. Egress filtering at the agent runtime, combined with DNS allow-lists and per-tool proxy rules, reduces this risk sharply. Teams that skip egress controls and rely only on content filters consistently see higher rates of data exfiltration in red-team exercises.

Inter-Agent Channels and Prompt Injection Propagation

When two agents exchange messages, those messages become untrusted input to the receiving agent in exactly the same way as a user's prompt is. A common architectural mistake is to let agents communicate in natural language, which gives a prompt-injection payload in agent A's output full control over agent B's interpretation. The mitigation is structural: define typed message contracts between agents, validate them at the channel boundary, and treat any free-text portion of an inter-agent message as data to be displayed or logged rather than instructions to be followed.

Prompt-injection propagation across agents is qualitatively different from single-agent injection. In a single-agent system, an injected instruction can only manipulate that agent's subsequent tool calls. In a multi-agent system, the injected instruction can manipulate which downstream agent is called, what data that downstream agent is given, and what permissions that downstream agent exercises on the attacker's behalf. Research published in 2025 and reinforced in industry guidance through 2026 suggests that a single injection in one agent can chain through three or more cooperating agents before any human notices, because each hop looks plausible in isolation.

Practical defences include: stripping instructions from inter-agent messages and re-grounding each agent in its own system prompt at the boundary; requiring agents to cite the source of any claim that triggers a privileged action; and inserting a verifier agent that checks whether a proposed action is consistent with the original user goal before it executes. The verifier pattern adds latency and cost, but in incident data it consistently reduces successful cross-agent attacks by more than half.

Observability, Audit Trails, and Incident Response

Observability is the layer that turns a multi-agent system from an opaque black box into a defensible system. At minimum, every agent should log its system prompt version, user prompt, tool calls with arguments and outputs, inter-agent messages, and final outputs, all correlated by a single trace identifier. Logs should be written to append-only storage that the agents themselves cannot mutate, because a compromised planner agent that can rewrite its own logs is essentially unauditable.

Replay capability matters as much as logging. When a security team needs to investigate a suspected exfiltration, they need to be able to reconstruct the exact chain of decisions the agents took, including the prompts that triggered each tool call. Frameworks such as those catalogued in AIMultiple's 2026 list of agentic orchestration platforms increasingly ship with built-in trace stores, but coverage is uneven and teams should validate replay fidelity before relying on any platform's logging for compliance purposes.

Incident response runbooks for multi-agent systems need explicit steps that single-agent runbooks do not, such as revoking all active agent identities, rotating inter-agent signing keys, and quarantining specific agent versions rather than whole services. Allocating an on-call rotation that includes both security engineers and the team that owns the agent codebase is now standard practice at organisations operating agents at scale.

Comparison of Defensive Approaches

No single approach covers the full layer stack. Most enterprises end up combining a platform's built-in identity and tool controls with a gateway for inter-agent channels and an external red-team partner for periodic assurance. The custom-wrapper path is rarely justified once gateways reach feature parity with what a platform offers, and the total cost of ownership of bespoke security plumbing typically exceeds the cost of commercial tooling within 12 to 18 months.

Common Mistakes and Anti-Patterns

The most frequent mistake is treating the orchestrator agent as a trusted component. In many designs, the orchestrator can call any other agent with any payload, which means a compromise of the orchestrator is a compromise of the whole system. Constraining the orchestrator's downstream calls to a typed registry and forcing it to justify each delegation closes this hole without major architectural rework.

A second mistake is reusing human SSO tokens for agent actions. Human tokens are long-lived, broadly scoped, and rarely revoked, which is the opposite of what an agent needs. A third mistake is logging only final outputs and not intermediate reasoning traces, which makes incident reconstruction almost impossible. A fourth is allowing agents to fetch and parse arbitrary web pages without egress controls, creating an easy exfiltration channel. A fifth is failing to version-control system prompts, so a prompt change made by one engineer quietly rewrites the security posture of the whole system without any review.

When to Act and What It Costs

The right time to apply multi-agent security is during the architecture phase, not after the first production deployment. Retrofitting tool allow-lists and identity broker integrations onto a system already in production typically costs three to five times more than designing them in from the start, based on engineering hours reported across 2025 and 2026 enterprise rollouts. A reasonable budget for a mid-sized enterprise initial hardening programme ranges from roughly 200,000 to 750,000 US dollars over six months, including platform tooling, gateway deployment, and external red-team validation, with ongoing annual operating costs in the range of 25 to 40 percent of the initial outlay.

Smaller teams that cannot afford a full programme should still prioritise three controls in this order: per-agent workload identity, tool allow-lists with schema validation, and append-only trace logging. Those three controls alone block the majority of multi-agent incidents observed in the field, and they can often be implemented in a single quarter using existing platform features rather than new purchases.