Joshua Lamerton
Multi-agent systems are becoming a mainstream architectural direction. The attraction is clear: instead of asking one general model to plan, retrieve, calculate, negotiate, and execute, a system can assign each responsibility to a specialized agent.
But specialization does not remove complexity. It redistributes it.
The difficult questions begin when one agent delegates to another. Which identity is acting? Does delegated authority narrow or expand? Which agent owns the final decision? What happens when two agents disagree, repeat an action, or operate on stale context?
These are control-plane problems.
A prototype multi-agent system often looks like a graph of prompts. One model produces a result and another critiques it. In production, the graph becomes an operational system with side effects: database updates, payments, outbound messages, code changes, or physical actions.
At that point, orchestration must manage more than message order. It needs:
Without these capabilities, adding agents increases the number of ways a system can fail without explaining why.
Cloud platforms separate a control plane from a data plane. The data plane performs work; the control plane decides how that work is configured, routed, observed, and governed.
Agent systems need the same distinction.
The execution plane contains models, tools, retrieval systems, and runtime environments. The control plane contains identity, policy, task routing, capability discovery, budgets, observability, and provenance.
This separation allows an organization to change models or agent frameworks without replacing its trust architecture. It also allows policies to remain consistent when the same capability is accessed through a chat interface, an API, a scheduled workflow, or another agent.
Human access control usually assumes a relatively stable user operating through a known application. Agentic systems introduce chains: a human authorizes an application, the application invokes an agent, the agent delegates to a specialist, and the specialist calls a tool.
A secure system should preserve that chain. Each hop should carry evidence of the originating principal, the delegated purpose, permitted capabilities, time limits, and constraints. The receiving tool should not infer authority from the fact that a request arrived from another agent.
This is where provenance becomes operational rather than documentary. It is part of the authorization decision.
Gartner lists multiagent systems among its strategic technology trends for 2026. The opportunity is significant: modular systems can distribute complex work and adapt more easily than monolithic agents. Yet modularity creates coordination overhead.
The successful systems will not necessarily have the most agents. They will have the clearest boundaries: which component may decide, which may act, which evidence must be retained, and when execution must stop.
The next stage of agent engineering is therefore not prompt sophistication. It is control-plane design.