The handoff keeps the receipt

The single agent was hard enough. The multi-agent system is where accountability quietly goes to die, and it dies at the handoff. Picture the now-ordinary arrangement: a planning agent decomposes a goal into tasks and dispatches them; worker agents pick them up; a worker calls a specialized tool-using agent to actually execute; that one calls a service that does the deed. By the time the world changes, the intent that started it all has passed through three or four sets of hands, and at each pass something is lost — a bit of context, a scope, a reason, the identity of who asked. The final act lands in the world attached to the last agent in the chain, which knew only its narrow instruction and nothing of why. Trace it backward and the trail goes cold at the first boundary that did not carry the account across.

This is the seam where responsibility evaporates, and it evaporates for a structural reason, not a careless one. Each agent in the chain keeps its own record, of its own work, in its own frame. The planner logs that it dispatched a task. The worker logs that it received a task and called a sub-agent. The executor logs that it performed an action. Three tidy local records, none of which references the others as a continuous account. Read any one alone and it looks complete. Try to answer the only question that matters — the customer's account was closed; whose decision, resting on what, was that — and you cannot, because the answer is distributed across three records that were never joined, and the joining information, the thread that ties the executor's act back to the planner's intent, was dropped at each handoff as unimportant plumbing.

The instinct is to call this an observability gap and reach for distributed tracing — propagate a request ID, stitch the spans together, reconstruct the call graph. That helps, and it is necessary, but it is not sufficient, and mistaking one for the other is the trap. A trace tells you the executor was called by the worker was called by the planner. It reconstructs the topology of the run. It does not carry the account — the intent, the authority, the inputs each stage acted on, the reason the task was decomposed the way it was. You can have a perfect call graph and still be unable to say why the act was taken or under whose authority, because the trace threaded the calls together and left the accountability content behind. The handoff has to carry more than an ID. It has to carry the receipt.

A trace stitches the calls together. It does not carry the reason across the boundary. Responsibility rides on the account, and the account is what the handoff drops.

Chain of custody is the right model, and it is old

There is a mature discipline for exactly this problem, and it is not a software one. Chain of custody — the rule that governs how physical evidence moves from the scene to the courtroom — exists because everyone understood centuries ago that an object passing through many hands is only trustworthy if each transfer is recorded: who had it, who they gave it to, when, and in what condition. The custody log is not about the evidence itself. It is about the handoffs. A single unrecorded transfer, one gap where the item was in someone's possession with no entry, and the whole chain is broken — the evidence becomes inadmissible not because it is wrong but because its journey can no longer be vouched for. The break at the handoff poisons everything downstream of it.

Multi-agent systems have recreated the evidence-handling problem and mostly skipped the solution. Every delegation is a transfer of custody: the planner hands the worker not just a task but responsibility for a piece of the outcome, and the worker hands it onward. For the final act to be traceable to the original intent, each of those transfers has to be recorded as a transfer — this agent, under this authority, on the basis of these inputs, delegated this task, carrying this context, to that agent, at this time. Then the chain is unbroken: you can walk from the executor's act back through every handoff to the planner's decision and the human goal behind it, and each link vouches for the next. Skip the custody entry at any handoff and you have the software equivalent of evidence that sat unlogged in someone's desk drawer — present, but no longer accountable.

What has to cross the boundary

Concretely, a handoff that keeps the receipt passes forward more than the task. It carries the identity of the delegating agent and, transitively, the human principal the whole chain serves; the authority under which the delegation is made, narrowed to what the sub-task needs rather than the parent's full power; the relevant slice of the account so far, so the receiving agent acts on the same understood inputs rather than a fresh, contextless read; and a reference that lets the receiver's eventual action be linked back to this delegation as one continuous record. The receiving agent then does its work, keeps its per-action records, and — this is the part that closes the loop — those records point back at the handoff that authorized them. Custody is continuous because every act names the delegation it descends from.

The standards work is beginning to name this precisely as the hard part. The emerging federal framing for AI agents calls out delegation-chain accountability as a distinct concern the older risk frameworks did not address, and the security community's agentic risk catalogue puts insecure inter-agent communication and the abuse of delegated trust among the central failure modes of multi-agent systems. Both are versions of the same recognition: the boundary between agents is where authority, identity, and the account are most likely to be lost or forged, and it is therefore the boundary that most needs to be built to carry them intact. The handoff is not neutral plumbing. It is the exact place the system decides whether the final act will have a traceable author or an anonymous one.

So the rule for anyone building past a single agent is simple to state and unforgiving to skip: treat every delegation as a custody transfer and make it carry the receipt. Not just the task, and not just a trace ID — the identity, the narrowed authority, the account so far, and the link that keeps the chain continuous. Do it and a multi-agent system stays legible: an outcome anywhere in it can be walked back, handoff by handoff, to the decision and the human that set it in motion. Skip it and you have built a machine that can act through many hands and answer through none, where every agent points at the one it handed the task to, the chain breaks at the first unlogged transfer, and the harm at the end of it belongs, conveniently, to no one. The custody entry is cheap at the handoff and impossible to reconstruct after. Keep the receipt every time work changes hands.

— Dispatches · The Frontier · Summit Cognitive

---