Agent protocols & orchestration
The plumbing that decides whether multi-agent work is reliable or merely impressive.
Control plane / data plane separation
Idempotency, retries and compensation
Message provenance
The problem
A demo needs one agent to succeed once. Production needs many agents to fail safely, repeatedly, in a system where something else is already depending on the result. Almost everything hard about that is protocol: how an agent is addressed, what a call carries with it, what happens when a step half-completes, and whether the control path can be told apart from the data path at all. Teams reach for orchestration frameworks and inherit whatever assumptions those frameworks made — usually that every caller is trusted and every step is idempotent, neither of which survives an enterprise.
Where it breaks
| Failure point | What actually happens |
|---|---|
| Identity in the call | Most agent-to-agent calls carry a task and not an actor. The receiving side then has no way to decide whether this caller may ask for this thing — so it does it, and the authority question becomes unanswerable after the fact. |
| Control and data on one path | When instructions and content travel the same channel, retrieved content can be read as instruction. Every prompt-injection result follows from this one design decision, and no amount of filtering repairs it. |
| Partial completion | An agent that books, charges and confirms has three chances to stop halfway. Frameworks retry; systems of record do not deduplicate. The second charge is not a model failure. |
| Fan-out without budget | One agent calling three that each call three is a load pattern nobody sized for, and the failure arrives as a timeout in an unrelated system. |
| Version drift across agents | Two agents built six weeks apart against the same tool disagree about its contract. Neither is wrong; nothing tests the pair. |
| No provenance on the hop | By the third hop nothing carries where the request originated. Reconstruction stops at the boundary of whichever component logged best. |
Standards and regimes named on this page were last checked against their primary sources on . Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
What this actually consists of
- Protocol design for agent-to-agent and agent-to-tool calls, carrying actor and authority rather than task alone
- Separation of the control path from the data path so retrieved content cannot become instruction
- Failure semantics — idempotency keys, compensation, and what a half-completed action means in your systems of record
- Orchestration topology: which work is a graph, which is a queue, and which should never have been an agent
- Propagating provenance across hops so a reconstruction does not end at a component boundary
The test
The test is not whether the happy path runs. It is whether you can take one completed multi-agent action, name every hop, say which actor authorised each, and show what would have happened had step three failed.
Where does this sit in your estate?
The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.