Trust Boundaries Between AI Agents

A trust boundary is the point where one security domain ends and another begins. In multi-agent systems, every agent-to-agent interaction crosses a trust boundary. Treating inter-agent communication as trusted by default is one of the most common mistakes in agent system design.

Why Agents Should Not Trust Each Other

Each agent may run a different model, use different tools, and operate under different policies. Agent A might be a tightly constrained summarizer with no tool access. Agent B might have write access to a database. If Agent B accepts instructions from Agent A without validation, a prompt injection in Agent A's input can propagate to Agent B's privileged context.

Defining Trust Levels

Assign each agent a trust level based on its capabilities and exposure to untrusted input.

• Untrusted: Agents that process raw user input or external data. These should have minimal privileges and no ability to instruct other agents directly.
• Semi-trusted: Agents with validated input pipelines but limited tool access. They can request actions from trusted agents but cannot execute privileged operations.
• Trusted: Agents with vetted inputs, restricted tool sets, and behavioral monitoring. They can execute privileged operations but only in response to authorized requests.

Enforcing Boundaries

Policy enforcement at trust boundaries means validating every cross-boundary message. Authensor policies can require that messages include a valid principal binding, that the source agent has the correct role, and that the requested action falls within the target agent's allowed scope.

rules:
  - action: "db.write"
    require_principal_role: "trusted"
    require_source_trust_level: "trusted"
    effect: "allow"

Trust boundaries are not optional in multi-agent systems. They are the foundation on which every other safety mechanism depends. Define them early, enforce them in policy, and audit crossings continuously.