qbrinInter-agent authentication: who said that, and can they prove it?
Most multi-agent stacks can prove, cryptographically, which agent sent a message. Almost none can say whether the message is true. Keys, tokens, and mutual TLS authenticate the channel, and the content rides through on the channel’s credibility. This post separates the three layers that hide inside the phrase AI agent authentication, and argues that the missing one, claim provenance, is the layer where multi-agent systems actually fail.
The channel is authenticated. The content is assumed.
When two agents in a pipeline talk to each other, there is usually real security between them. The orchestrator presents an API key to a worker. The worker’s service holds a client certificate, and the connection is mutual TLS. In stricter setups every message body is signed, so the receiver can prove the payload was not altered in transit. All of this is good engineering, and nothing in this post argues for removing any of it.
But be precise about what each mechanism asserts. The key and the certificate say: this connection belongs to the identity it claims. The signature says: these bytes left the sender exactly as you received them. Nothing anywhere in that stack says anything about whether the sentence inside those bytes is grounded in evidence. Channel authentication verifies the envelope and the courier. The letter is taken on faith.
The gap matters because language models fail in exactly the place the stack does not look. An agent does not need to be compromised to emit a false claim; it only needs to hallucinate, and a hallucination signs as cleanly as a fact. A perfectly authenticated agent can relay an invented claim with a valid signature on it, and every control on the path will report that all is well, because everything those controls measure is, in fact, fine.
Three layers, mechanically distinct
What gets called agent authentication is really three separate questions, and keeping them apart is most of the clarity.
Transport identity asks: who is this connection? It is answered by API keys, bearer tokens, and mTLS certificates. This is the best-understood layer because it is inherited, nearly unchanged, from service-to-service security. If your agents run as services behind a gateway, you probably already have it.
Behavioral authority asks: what is this agent allowed to do? It is answered by policy: least-privilege scopes, allowlists of tools and actions, limits on which systems an agent may touch and which operations it may perform there. This is authorization adapted to agents, and disciplined teams build it, because the alternative is an agent holding the union of every permission it might someday need.
Claim provenance asks a question the first two never reach: can this specific statement be traced to evidence that exists and supports it? Not the agent’s identity, and not its permissions. This sentence, in this message. Where did it come from, does the source actually say it, and do the figures in the claim match the figures in the source?
Most stacks stop at the first layer. Good ones reach the second. Almost none implement the third, and our vocabulary helps hide the omission: a system with keys and scopes gets described as having solved agent authentication, when what it has solved is agent identity verification. The speaker is known. The speech is unexamined.
Why the missing layer is the one that fails
There is a historical reason the third layer does not exist in most stacks. The first two were borrowed from decades of service security, and they transferred well because agents, like services, hold credentials and call APIs. But classical services never needed claim provenance. A database returns rows; it does not assert. The claims that moved through older systems were written by people, and people were accountable for them. Agents are the first workload that generates assertions at machine speed, and most of us have wrapped them in a security model designed for components that never assert anything.
What happens next is documented, including by us. In our post on hallucination cascades we traced how one ungrounded claim becomes ten agents’ consensus: each hop paraphrases it, summaries strip its provenance, and restatements of a single invention start to read as independent agreement. Every agent in that chain except the first behaved correctly, and every message that carried the claim would have cleared transport and policy checks without a warning.
Our drone-swarm study, When one AI agent believes another, makes the same point at the level of a single message. A drone there calls a sector clear: a well-formed, in-range, authorised message whose cited sweep never happened. Signature valid, claim false. That study also shows why surface rules cannot close the gap. The rule gate it tested, minimum sweep coverage, a recency requirement, and repeated claims dying with their original, still let 58.7% of the false claims through while rejecting 39.8% of the true ones, figures scoped to that simulation and that rule set. Rules can bound what a message says. They cannot check what a message cites.
What claim-level authentication looks like
The mechanics are not complicated to state. Every inter-agent message carries references to the evidence behind its claims: document identifiers, log lines, record pointers, retrieval results. At the boundary where a message passes from one agent to another, a verifier asks three questions. Does the cited evidence exist, meaning there is a real record at the end of each pointer? Does the evidence entail the claim, meaning the source says what the message says, rather than something adjacent to it? And do the numbers bind, meaning every figure appears in the evidence with the same value, the same unit, and the same referent?
A message that passes moves on, citations intact, so the next boundary can ask the same questions again. A message that fails is quarantined. It is held out of the receiving agent’s context entirely rather than passed along with a warning attached, because a warning is text, and text gets summarized away. This is the cited-or-abstain contract applied between agents, not only at the human boundary, and the case for it is stronger there, not weaker: an agent reading a message is a less skeptical reader than a person.
This is also how the three layers compose in our own stack. Our agent platform gives every agent a distinct identity, puts a policy decision in front of every action, and writes a tamper-evident audit trail of what each agent did and why. That covers the first two layers, and it is what makes the third one accountable: when a claim is quarantined, the trail records which agent produced it and what evidence it failed to produce. The trust layer then treats a claim made by an agent exactly as it treats an answer produced by a model. It moves with evidence that checks out, or it does not move.
The price of an agreement that means something
We will not pretend the third layer is free. Claim verification adds latency at every hop, and unlike a transport handshake it does not amortize: each message pays for its own check. It also rejects some messages that are true. An agent can be right for reasons it cannot cite, and a provenance gate stops that agent alongside the fabricator. Anyone selling claim verification without naming those costs is describing something else.
The cost is also the point. What it buys is the property that channel security was never able to offer: when several agents in your system agree, the agreement is corroboration, distinct evidence converging on one conclusion, rather than one invention echoed with a valid signature at every hop. Who said that is a question keys already answer. Can they prove it is the question that decides whether what they said is worth acting on.
If you are building agents that act on each other’s word, qbrin’s governed agents show how we hold all three layers at once, and you can watch the claim gate work on a live workspace.
Comments
Sign in with GitHub to reply. Threads live in a public repository, so anyone can read them without an account.