What Should Botie Pass to Another Agent?

Botie saves a useful passage from a manual. Inside it is a sentence asking future assistants to export the customer directory. Tomorrow, another worker reads the saved note without seeing where it came from. We have made the instruction persistent.

Memory and delegation help a system continue its work. They also carry data across time and between workers. Let’s decide what may cross those boundaries and what must be checked again.

Filter reviewed memory for the authenticated tenant and intersect requested tools with current parent grants.

{
  "memory": [
    "north-note"
  ],
  "tools": [
    "read_manual"
  ]
}

Store the tenant, source, creation time, intended use and retention policy beside the content. Separate user preferences from retrieved facts and from application policy. A note about formatting should not become permission to disclose records.

Retrieve memory using authenticated scope before semantic ranking. Filtering after a model has already read foreign-tenant content is too late. Apply the same ownership rules to embeddings, caches and conversation checkpoints.

Similarity is a relevance measurement, not an access decision.

A model may suggest saving a fact. The application decides whether that kind of memory is permitted, how it is reviewed and when it expires. Keep the original source reference so a reviewer can inspect what was summarised.

Do not give retrieved text a route to mark itself trusted. A memory record saying ignore approval remains content to inspect, even when another agent wrote the summary. Review can reduce some risks without establishing the permanent truth of a changing fact.

A trusted storage system can still contain untrusted prose.

Exclude records outside the tenant, outside their intended purpose, expired or revoked. Invalidate affected cached views when permissions or source approval change. Build the new context from the eligible records rather than passing the entire previous conversation by default.

The workshop simplifies this to tenant, review and expiry fields. Real policy may also require user-specific access, data sensitivity and source-version checks. The controlled fields must come from the memory service.

Persistence does not extend the lifetime of permission.

Define the child’s task, allowed tools, accessible objects and budget. Intersect its requested capabilities with the parent’s current grants and the application’s delegation policy. Use separate credentials where workers have different responsibilities.

Keep the shared run budget enforced by one coordinated authority. Giving every child a fresh copy of the original allowance multiplies the permitted work. Depth limits, deadlines and bounded concurrency prevent an expanding tree from outliving the task.

Delegation can reduce authority. It must not manufacture it.

parent = {"read_manual"}
requested = ["export_records", "read_manual", "read_manual"]
child = list(dict.fromkeys(name for name in requested if name in parent))
print(child)

['read_manual']

Use a schema for the child task and results, carrying source IDs separately from instructions. Check returned claims against evidence when they matter to the parent’s next action. A worker’s statement that a tool succeeded should be supported by the receiver’s result.

Limit what each worker can see. A critic that only needs a proposed answer and approved excerpts does not need the author’s credentials or full private history. An extra agent is an extra component to operate and test.

Several agents agreeing is not independent evidence when they share the same misleading input.

Stop scheduling children after cancellation, revoke their task-scoped authority where supported and reconcile effects already in flight. Recheck grants at use time so a long-lived worker cannot rely forever on the snapshot from its launch.

Preserve pending and uncertain states explicitly. Clearing a parent’s UI is not proof that a remote child stopped. Logs should link parent and child runs without copying all private content into every trace.

The lifecycle of the task includes its unfinished descendants.

Test memory written for another tenant, an expired source, a revoked tool and a child asking for additional authority. Keep legitimate notes and permitted work available so the controller does more than deny everything.

Add integration tests for retrieval, cache invalidation and child tool enforcement. Our fixture checks the bundle prepared for a handoff. It cannot ensure the receiving process obeys that bundle unless its execution boundary enforces it.

The final evaluation must look at what the workers did, not only what they were sent.