Agents in a delegation chain should return only what every party may see

An AI agent should hand back only what everyone above it in the chain is allowed to see. Tim Tyler of Gravitee made this point in his talk on the AI Engineer show. He argued that limits on access must follow the whole line of delegation, not just the one agent doing the work.

What was said

Tyler presented a framework for governing agents like a digital workforce. One stage gives each agent a role and the least authority it needs. He explained it with an example built around a person called Sven.

Sven can reach four things, which Tyler labelled A, B, C and D. They could be information or tools. Sven uses Agent 203 to talk about projects, and it can reach C and D. Agent 203 hands a task to Agent 409, which can reach D, E and F.

Agent 409 may use all of D, E and F to finish the job. But it can send only D back up the chain. D is the one item that Sven and both agents can all see. Tyler said the scope of authority "never grows beyond what agent 409 has been given." He added that it is narrowed by the lineage.

He also stressed that every agent needs its own identity. Because of that, he said, you can point to Agent 203 and say it is not Agent 409.

Why it matters

Our reading: the usual question is what a single agent may access. Tyler's example asks a second question: who started the request, and through whom did it pass?

Without that second check, an agent deep in a chain could pull in something like E or F. It might then pass it back to a person who was never cleared to see it. Each extra hop adds reach.

For anyone building or buying agent systems, this suggests two checks. Does each agent have its own identity? And is the output filtered against everyone upstream, not only against the agent that produced it?

The other side

Tyler's example is deliberately simple: four letters and one straight chain. He said he chose it to avoid a confusing real scenario. Real delegation can branch and loop, and the excerpts do not show how the return check would be enforced.

He also named limits that this rule does not cover. Outside agents from other parties may call Agent 409, and he said the context they bring is not something Sven controls. The underlying model's built-in alignment can change without the company's control, too.

He drew a further line between behaving and succeeding. An agent can stay inside its authority and still fail at its job. Lineage rules limit what flows back. They do not show that the work was done well.