A single well-guardrailed agent is a solved design problem by the time a team reaches this lesson — least privilege, approval gates, audit logging, all covered earlier in this course. A system of several agents delegating tasks to each other is a different problem, because every guardrail built for a single agent quietly assumes there is one boundary between trusted instructions and untrusted input, and a multi-agent system has several such boundaries stacked inside itself, each one a place where the assumption can break without anyone noticing.
The failure mode this lesson exists to prevent is delegation laundering an untrusted instruction into a trusted one. An orchestrator agent that receives a request, delegates a sub-task to a specialist agent, and then acts on that specialist's output as though it were the orchestrator's own trusted reasoning has created exactly the trust-boundary confusion that lesson three of this course warned about for a single agent — except now the untrusted content can enter through a sub-agent two or three hops away from the original request, which is much harder to trace and much easier to miss in a review.
This lesson covers how trust and privilege should actually propagate across agent-to-agent delegation, why an orchestrator's full permission set should never be the default a sub-agent inherits, and what a delegation audit trail needs to capture that a single-agent audit log does not.
Analogy🏏Cricket
🏏 Think of it like cricket: a captain delegating a bowling change to his vice-captain, who then quietly lets a specialist bowling coach make the actual field-placement call, has created a chain of delegated authority — and if something goes wrong with that field placement, 'who actually decided this' becomes genuinely hard to trace. MS Dhoni's captaincy was specifically noted for how explicitly he delegated tactical calls to trusted lieutenants like R. Ashwin as a part-time tactical voice, while still remaining the one name accountable to the team management for the outcome — the delegation was real, but the chain of who authorized what stayed traceable, because Dhoni never treated a lieutenant's suggestion as automatically equivalent to his own final call without at least a visible nod. A captain who instead let a specialist coach's suggestion travel silently through a vice-captain and become a field change nobody could trace back to an actual decision point has built a system where a bad call cannot be attributed, reviewed, or corrected efficiently. Just as delegated cricket authority still needs a traceable chain back to who actually authorized a specific decision, delegated authority between AI agents needs a traceable chain back to which specific delegation step actually authorized a specific action. The insight is that delegation without a traceable chain of authorization is not delegation, it is an untracked handoff, and untracked handoffs are where accountability disappears.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.