The Multi-Agent Trust Problem: Why Agent Meshes Break Perimeter and Single-Identity Assumptions

Ask how to secure an autonomous agent and most answers implicitly assume two things. The first is a perimeter: a line separating the trusted inside, where the agent operates, from the untrusted outside it must be defended against. The second is a single identity: one principal, whose permissions, behavior, and trustworthiness can be reasoned about as a unit. Both assumptions are already strained for one agent, and they collapse entirely for a mesh of them. When agents call each other, delegate work down chains, and depend on results they did not compute, there is no inside and outside — every agent is simultaneously a defender of its own boundary and an untrusted caller at someone else's. And there is no single identity to reason about, because the behavior that matters is the interaction between many. This article is about that collapse: which assumptions break, why they break, and what a security model has to look like once it can no longer lean on either a perimeter or a single trusted actor.

Two Assumptions Single-Agent Security Inherits

Classical security architecture is organized around a perimeter: a boundary, enforced by controls, that separates a trusted interior from a hostile exterior. Inside the perimeter, components are assumed cooperative; outside, hostile; and the security effort concentrates on the boundary. This model has been eroding for years, and NIST SP 800-207, the Zero Trust Architecture, is in large part a formal acknowledgment that the perimeter is no longer a sound basis for trust — that access must be evaluated per request rather than granted by location. But even zero-trust practice, in its common framing, still reasons about one principal at a time: this workload, requesting this resource, is it authenticated and authorized.

The second inherited assumption is single-identity reasoning. Security for a component treats that component as a unit with an identity, a set of permissions, and a behavior profile, and asks whether that unit can be trusted. This is natural and usually correct for a single actor: identity establishes who it is, permissions bound what it may do, and monitoring watches what it does. The unit of analysis is one principal, and the trust question is a property of that principal.

Both assumptions are load-bearing. A great deal of security tooling — firewalls and segmentation for the perimeter, identity and access management for the single principal — exists precisely to enforce them. They are not wrong for the setting they were built for. The problem is that a mesh of agents is a setting they were not built for, and the assumptions do not merely weaken there; they cease to describe the system at all.

The Mesh Breaks Both

A multi-agent system is a set of agents that interact — calling one another's capabilities, delegating subtasks, and consuming each other's outputs. Define it as a directed graph whose nodes are agents and whose edges are interactions: agent A calls agent B, B delegates to C, C returns a result A ultimately relies on. In this graph there is no perimeter, because there is no line that separates a cooperative interior from a hostile exterior. Every agent sits at a boundary of its own — it must defend against callers it does not control — while simultaneously being an unverified caller from the perspective of every agent it invokes. Inside and outside are not global properties of the system; they are relative to each edge.

Single-identity reasoning breaks for a complementary reason. The security-relevant behavior of a mesh is not a property of any one agent but of the interactions between them. An agent that is individually well-behaved can still participate in a harmful chain — passing along a poisoned result, amplifying a compromised peer's output, or lending its authority to a request it should have questioned. Reasoning about each agent in isolation misses exactly the phenomena that make a mesh dangerous, because those phenomena live in the edges, not the nodes.

The OWASP Agentic Security Initiative's attention to multi-agent risks reflects this: the threats it catalogs for agent systems — one agent manipulating another, cascading failures, authority abused across a chain — are edge phenomena, not node phenomena. The mesh, in short, is a graph, and a security model that only reasons about vertices cannot describe what happens along its edges.

What 'Trust' Means Between Agents

To reason about the problem, the word 'trust' has to be made precise, because its everyday looseness hides the structure. Say that agent A trusts agent B for a capability X when A relies on B's behavior with respect to X — accepting B's output, or delegating X to B, without independently re-verifying it. Trust in this sense is always relative to a capability and a truster: A may trust B to retrieve a document but not to authorize a payment, and C may trust B for neither. It is not a global property of B but a directed, capability-scoped relation on the graph's edges.

This definition exposes why trust in a mesh is treacherous. Because trust is reliance-without-re-verification, every trust edge is a place where A inherits B's failures for capability X. If B is compromised, or merely wrong, A absorbs the consequence precisely to the degree it trusted B and did not re-check. And because trust composes along paths — A trusts B, B trusts C — A ends up relying on C's behavior transitively, often without any awareness that C is in the picture at all. The reliance is real even when the relationship is invisible.

Making trust a directed, capability-scoped, composable relation is the move that lets the rest of the analysis be precise. The security question for a mesh is no longer 'is this agent trustworthy?' but 'along which edges does trust flow, for which capabilities, and what does each truster inherit when the trusted party fails?' That reframing — from a property of nodes to a structure over edges — is the conceptual core of the multi-agent trust problem.

The New Attack Surface

The mesh creates attack classes that have no single-agent analogue, all of them living on the trust edges. The first is the confused deputy at scale. A confused deputy is a privileged component tricked into misusing its authority for a less-privileged party; in a mesh, any agent that will act on another agent's request is a potential deputy, and a chain of them multiplies the reach. An attacker who can influence one agent's request can, through transitive trust, spend authority held several hops away, because each hop relies on the previous without re-verifying the ultimate origin of the intent.

The second is transitive compromise. Because trust composes along paths, compromising one agent does not stay local — its poisoned outputs flow to everyone who trusts it for the affected capability, and onward to everyone who trusts them. A single compromised node can taint a wide subgraph, and the taint is invisible to a defender reasoning node by node, because each individual agent is behaving exactly as designed: consuming the output of a party it trusts. The compromise propagates precisely through the mechanism the mesh exists to exploit.

The third is reputation manipulation, which arises the moment trust is derived from observed behavior rather than fixed. If agents decide whom to trust based on reputation — a natural design for an open mesh — then reputation becomes a target. Colluding agents can inflate one another's standing, or a strategic agent can behave well until it has accumulated enough trust to abuse it. The peer-to-peer reputation literature studied exactly these dynamics; the EigenTrust work, for instance, was motivated by the need to compute robust trust scores in the presence of malicious and colluding peers, which is precisely the adversary an open agent mesh faces. These three surfaces — confused deputy at scale, transitive compromise, and reputation manipulation — are the multi-agent trust problem made concrete.

Why the Two Assumptions Fail, Specifically

It is worth being exact about the failure, because the fix depends on it. The perimeter assumption fails because there is no assignment of agents to 'inside' and 'outside' that is stable across interactions. An agent trusted as a peer on one edge is an untrusted caller on another; a partition that is protective for one interaction is meaningless for the next. Segmentation, the perimeter's tool, can reduce blast radius but cannot establish trust, because the thing to be trusted changes with the interaction. Zero-trust's response — evaluate every request on its own merits — is the right instinct, but it must be extended from 'every request to a resource' to 'every inter-agent interaction', which is a larger and more structured space.

The single-identity assumption fails because the security-relevant unit is the interaction, not the principal. Establishing that agent B is who it claims, and is permitted to do what it asks, is necessary but does not answer whether A should rely on B's output for capability X given everything upstream of B. Identity and permission are node properties; the trust decision is an edge property that depends on the whole path behind the edge. A perfectly authenticated, fully authorized agent can still be the wrong thing to trust, if what it is passing along originated in a compromise it could not see.

So the two failures share a root: both assumptions locate security in a place — a boundary, or a node — where the mesh's security-relevant behavior does not live. The behavior lives on the edges and along the paths, and any model that cannot reason about edges and paths will systematically miss the mesh's actual risks while reporting that each individual component is fine.

The Shape of a Solution

Naming what breaks points directly at what a solution must provide, even before choosing mechanisms. First, trust must be decided per interaction, not by membership, because there is no stable inside to belong to — the zero-trust principle carried down to the inter-agent edge. Second, an agent should rely on another's claims only when those claims are verifiable, so that trust rests on evidence a truster can check rather than on the trusted party's assertion — which is what turns a dangerous reliance-without-re-verification into a checked one. Third, because transitive compromise is inevitable once trust composes, failure must be contained: the architecture must bound how far a compromise can propagate along trust edges, rather than assuming compromise will not happen.

These three requirements — per-interaction trust, verifiable claims, and failure containment — are the negation of the three things the mesh took away. Per-interaction trust replaces the missing perimeter with a decision at every edge. Verifiable claims replace the missing single trusted identity with checkable evidence per interaction. And failure containment replaces the missing 'compromise stays outside' assumption with an explicit bound on how far it spreads. Each requirement is a response to a specific broken assumption, which is why they form a coherent set rather than a wish list.

This also sets the agenda for everything a full treatment must build. Per-interaction trust needs concrete trust models — capability-based, reputation-based, zero-trust for meshes — to decide edges. Verifiable claims need mechanisms for agents to prove things to one another, from attestation to signed provenance. Failure containment needs an architecture — brokers, policy meshes, and blast-radius limits — that holds the whole thing together. Each is a distinct problem, and each is a direct descendant of the fact that a mesh has neither a perimeter nor a single identity to lean on.

Limitations and Threats to Validity

This article frames a problem and its structure rather than evaluating a solution, and its claims should be read as analysis, not measurement. The graph model of a mesh is a deliberate abstraction; real agent systems have richer interactions — shared memory, indirect influence through the environment, timing effects — that a directed trust graph does not capture, and some risks may live in those richer channels rather than on explicit call edges. The definition of trust as reliance-without-re-verification is similarly a modeling choice; it is precise and useful, but a given system may embed partial verification that makes real trust edges weaker or stronger than the binary relation suggests.

There is also a scope boundary worth stating. Framing the multi-agent trust problem does not by itself secure a mesh; it identifies what a security model must do — decide trust per interaction, rest it on verifiable claims, and contain failure — without yet providing the mechanisms, which are substantial problems in their own right and depend on the specifics of the deployment. The honest conclusion is that a mesh is a qualitatively different security object from a single agent, that the perimeter and single-identity assumptions genuinely do not apply to it, and that any sound approach must relocate its reasoning from nodes and boundaries to edges and paths. That relocation is the contribution of framing the problem this way; the constructions that follow from it are where the security is actually built.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

Glossary

Multi-agent system (mesh)

A set of agents that interact — calling, delegating to, and consuming each other's outputs — modeled as a directed graph of agents (nodes) and interactions (edges).

Perimeter assumption

The idea that a boundary separates a trusted interior from a hostile exterior, concentrating security at the boundary; it has no stable form in a mesh.

Single-identity reasoning

Treating a component as one principal with an identity, permissions, and behavior whose trustworthiness is a property of that principal alone.

Trust (between agents)

A directed, capability-scoped relation: A trusts B for capability X when A relies on B's behavior for X without independently re-verifying it.

Transitive trust

Trust composing along a path, so that A relying on B, which relies on C, makes A rely on C's behavior — often without awareness that C is involved.

Confused deputy at scale

A chain of agents each acting on another's request, so an attacker who influences one request can spend authority held several hops away.

Transitive compromise

The propagation of a compromised agent's poisoned outputs to everyone who trusts it for the affected capability, and onward, invisible to node-by-node analysis.

Reputation manipulation

Attacks on trust derived from observed behavior — colluding to inflate standing, or behaving well to accumulate trust before abusing it.

References

1. NIST SP 800-207, Zero Trust Architecture (2020)
2. NIST AI 100-1, AI Risk Management Framework (AI RMF 1.0)
3. OWASP Agentic Security Initiative, Agentic AI Threats and Mitigations (2025)
4. OWASP Top 10 for LLM Applications (2025)
5. MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
6. SPIFFE — Secure Production Identity Framework For Everyone, specification (CNCF)
7. Kamvar, Schlosser & Garcia-Molina, The EigenTrust Algorithm for Reputation Management (WWW 2003)
8. IETF RFC 8693, OAuth 2.0 Token Exchange (2020)