Executive Summary
- Passing raw conversational history between specialized agents pollutes target context windows.
- A structured state envelope extracts verified entities and discards conversational fluff.
- Handoff envelopes must include scoped Non-Human Identity delegation tokens and idempotency keys.
- Bi-directional handoff protocols support return trajectories and failure escalations.
- Zero-trust validation must be enforced at the boundary of every receiving agent node.
The chat history anti-pattern
When developers build multi-agent systems, the most common approach to delegation is passing the entire conversational history from Agent A to Agent B. If an intake triage agent chats with a customer for 15 turns and determines that a refund is needed, it simply dumps all 15 turns into the prompt of the Billing Specialist Agent.
This pattern creates severe operational problems. The Billing Agent's context window becomes cluttered with pleasantries, misunderstandings, and intermediate triage observations.
The model struggles to locate key entities (such as account numbers or transaction amounts) and may re-prompt the customer for information that was already provided. In worse cases, prompt injection attempts in the earlier chat can compromise the specialized agent.
Never pass unstructured transcripts
Specialized agents are domain workers, not conversationalists. They require structured JSON payloads containing verified entity schemas, not raw conversational transcripts.
The structured state envelope architecture
In a production agent-to-agent delegation architecture, agents communicate via strongly-typed State Envelopes.
Before initiating a handoff, the source agent executes an Entity Extraction and Validation step. It packages the extracted parameters (such as `verifiedUserId`, `orderId`, and `refundAmount`) into a schema-validated envelope.
The source agent's conversational context is archived to the episodic database, and only the clean, verified envelope is passed to the target agent. The target agent initializes with a clean, focused context window containing only its specialized system prompt and the handoff envelope.
Structured agent handoff lifecycle
Conversational history is compacted and archived; only verified entity envelopes cross the agent boundary.
Raw chat passing vs Structured envelope comparison
Comparing the performance and security characteristics of conversational dumping versus structured state envelopes.
Handoff mechanism trade-offs
| Feature | Dimension | Raw Chat Passing | Structured State Envelopes |
|---|---|---|---|
| Context Window Bloat | Grows linearly with each handoff (Severe) | Constant O(1) envelope size (Zero bloat) | |
| Entity Accuracy | Probabilistic parsing from conversational text | Deterministic schema validation before handoff | |
| Security Boundary | Carries prompt injection risks across nodes | Sanitized parameters & scoped delegation tokens | |
| Token Cost per Step | High (re-processes full transcript every step) | Low (processes only minimal task payload) | |
| Audit Traceability | Messy natural language log parsing | Structured OpenTelemetry spans with JSON diffs |
State envelope TypeScript schema contract
Below is the TypeScript interface for a structured agent handoff envelope, including intent metadata, entity validation, and delegation security tokens.
Scoped delegation tokens and security boundaries
Agent delegation must follow the principle of least privilege. When Agent A delegates a task to Agent B, Agent B should not inherit Agent A's global credentials.
Instead, the handoff envelope contains an ephemeral Non-Human Identity (NHI) delegation token. This token is signed by the source agent and limits Agent B's tool execution permissions to the exact entity scope specified in the envelope (e.g., modifying only Order #8942).
If a prompt injection attempts to force Agent B to access Order #1001, the database gateway rejects the query because the delegation token lacks the required row-level permission.
Handling return paths and delegation failures
Handoffs are not always one-way streets. In complex workflows, a specialized agent may complete its sub-task and need to return control to the primary orchestrator.
The state envelope includes a `returnTrajectory` contract. Upon completing the sub-task, the specialist packages its output (such as a transaction receipt or diagnostic report) into a Return Envelope and posts it back to the orchestrator.
If the specialist encounters an unrecoverable failure (such as an expired credit card), it returns a Structured Exception payload, allowing the primary orchestrator to smoothly inform the user and request updated details.
Bidirectional handoff and return loop
Agent handoff implementation checklist
Verify these architectural controls before connecting multi-agent handoff pipelines.
Handoff readiness checklist
1Envelope Design & Typing
- Handoffs pass strongly-typed JSON schema envelopes, not chat transcripts
- Entities are validated against Pydantic/Zod schemas before transfer
- Source agent conversational history is archived to episodic storage
2Security & Permissions
- Ephemeral delegation tokens enforce entity-level least privilege
- Deterministic idempotency keys prevent duplicate tool invocations
- Receiving agents validate envelope signatures before execution
3Return Paths & Resilience
- Return trajectory contracts govern callback routing upon completion
- Structured exception handling allows orchestrators to recover from failures
- Timeout circuit breakers re-claim tasks if specialized agents hang