When the Agents Collapse Into the Model: Authorization After Chain-of-Agents

TL;DR

A growing line of research is moving from multi-agent systems built on prompt and workflow engineering to single models that internalize the multi-agent behavior — dynamically activating tool agents and role-playing agents inside one set of weights. The recent “Chain-of-Agents” paper is the cleanest articulation of that direction.
The capability gains are real. The architectural side effect is uncomfortable: the per-agent identity boundaries that all the current security frameworks rely on disappear into the model. Downstream systems see one caller. The authorization story we’ve been writing in 2026 was built for five callers.
Authorization doesn’t become impossible — it gets pushed down to the action and resource layer. If the “subject” field collapses to one identity, every other field has to carry more weight: action attributes, resource classification, intent claims attached to each tool call. The policy plane survives. The thing it reads changes.

What Just Changed in Agent Architecture

For the last two years, the working definition of an “agentic system” has been a coordination problem. You have a planner agent, a retrieval agent, a code agent, a verification agent, an executor. They pass messages, they delegate, they negotiate. The architectural diagrams look like microservice topologies because, structurally, that’s what they are.

A new line of research is folding that topology back into the model. The recent paper Chain-of-Agents: End-to-End Agent Foundation Models via Multi-Agent Distillation and Agentic RL describes the pattern directly: distill the trajectories of a sophisticated multi-agent system into training data, fine-tune a single model on those trajectories, and let the model dynamically activate different tool agents and role-playing agents inside its own reasoning. No external orchestrator. No inter-agent message bus. One model, multiple internal roles, end-to-end execution.

From a capability standpoint this is exactly what you’d expect to start working. Model-internal coordination cuts latency, eliminates a class of orchestration bugs, makes the agents legitimately data-efficient (they can be trained, not just prompted), and lets reinforcement learning shape the multi-step behavior directly. The benchmarks reflect that.

From an authorization standpoint, something quieter happens. The boundary that every current agent-security framework treats as load-bearing — the boundary between agents — ceases to be observable from outside the model.

The Framework Assumption That Breaks

Every serious agent-security framework shipped in 2026 — Anthropic’s Zero Trust tiers, Microsoft’s defense-in-depth model, the CISA / international joint guide, the IETF AAuth identity work — agrees on one foundational requirement: every agent gets its own verifiable identity. Per-NPE attributes. Distinct credentials. Hardware-rooted where possible.

That requirement assumes there are distinct agents to identify. The Chain-of-Agents pattern violates that assumption. From the perspective of a downstream API, MCP server, database, or tool surface, the call comes from one model with one identity. The fact that the model internally activated a “planner agent” followed by a “tool agent” followed by a “verification agent” is not legible to anything outside the weights.

Per-Agent Identity Becomes Per-Model Identity

If the agents share a model, they share an identity. The cryptographic NPE record now identifies the model, not the role the model is currently playing. Every framework recommendation that says “give each agent its own credential” lands on a single set of credentials.

Delegation Chains Become Internal State

The Anthropic framework talks at length about “unscoped privilege inheritance” when a high-privilege manager agent delegates to a worker. In Chain-of-Agents, that delegation is a hidden layer activation. There is nothing to inspect at the boundary because there is no boundary.

Per-Hop Authorization Loses Its Hops

Externalized policy decision planes — including ours — have argued that every hop in a multi-agent chain should be a fresh authorization decision. When the hops are tokens in a context window rather than HTTP calls between services, the decision plane sees one hop where there used to be four.

Behavioral Baselines Become Multi-Modal

“Normal behavior” for the model is the union of normal behavior for every role it can play. Anomaly detection trained on the merged distribution catches less than detection trained on each agent’s individual distribution. Less signal, same number of decisions.

None of this is a reason to stop publishing per-agent frameworks. The pattern remains correct for systems that have separable agents. But the implicit assumption that all production agent systems will look like that is starting to bend under the weight of the research.

Where the Authorization Decision Has to Go

The good news is that authorization doesn’t become impossible — it gets pushed down. If the subject field collapses to one identity, every other field in the decision has to carry more of the weight.

The Action Becomes the Subject

If we can no longer distinguish which sub-agent is acting, the call itself has to declare what it is. Action attributes — read_only, destructive, requires_approval, reversibility_cost — get scrutinized harder because they’re the only fields that still differentiate calls from each other.

Resource Classification Has to Get Sharper

When subject attributes lose resolution, resource attributes pick up the slack. Production vs. sandbox, customer-scoped vs. org-wide, sensitive vs. routine. The decision engine relies more on what’s being acted on, less on who’s asking.

Intent Has to Travel With the Call

Tool calls emitted by Chain-of-Agents-style models should carry an explicit intent claim — what the agent thinks it’s doing and why. The model knows; downstream systems don’t. Making intent a first-class field on every tool call is the cheapest way to recover the signal the boundary used to carry.

Default-Deny Becomes Even More Load-Bearing

If you can’t prove who’s calling, you have to prove what’s allowed. Default-deny on destructive, irreversible, or cross-classification calls becomes the dominant pattern. Earned exceptions, never assumed ones.

The decision plane survives. What changes is its inputs: the policy engine now leans harder on action class, resource class, intent claim, and reversibility cost, and less on which specific agent is asking. That’s a tractable shift, not an architectural impossibility.

What This Means for the Frameworks Shipped This Year

For systems that look like classical multi-agent orchestration — LangGraph, CrewAI, AutoGen, custom Python orchestrators — everything we’ve been writing about authorization in 2026 still holds. Per-NPE identity, per-hop authorization, externalized policy decisions, decision-stream audits. The frameworks are not wrong; they are correct for the dominant architecture today.

For systems that move toward end-to-end agent foundation models — and the research signals strongly that this is happening — the same frameworks need an addendum. Three specific moves get the substrate ready for the shift:

01

Treat the Model as One NPE With Multiple Roles

The NPE record for a Chain-of-Agents-style model should list the roles it’s trained to play and the action classes each role is permitted. The model identity stays single. The role list becomes a policy attribute.

02

Make Intent a First-Class Field on Every Tool Call

Tool calls emitted by foundation agents should carry a declared role and a declared purpose. The decision engine reads it as an attribute, validates it against the trained role list, and enforces the resource-level policy that matches. Intent is the field that lets the policy engine recover what the model boundary used to carry for free.

03

Raise the Floor on Resource Attributes

When subject resolution drops, resource resolution has to rise. Every production resource gets a classification attribute. Every destructive action gets a reversibility-cost attribute. Default-deny holds the line where per-agent identity used to.

How This Maps to ABAC-Enabled Security

⚙

Attributes Carry Different Loads Now

The policy decision still reads subject, action, resource, and context. When the subject field loses resolution, the action and resource fields carry more of the weight. ABAC’s flexibility is what makes it survivable through the shift; static role tables would shatter.

🔐

Intent Becomes an Attribute

If the model is the only identity, what the model claims to be doing is the next-best signal. Declared role + declared purpose, validated against the model’s trained NPE record, becomes a load-bearing input to every decision.

🎯

Default-Deny Is the Floor That Doesn’t Move

Across every architectural shift in 2026 — identity protocols, defense-in-depth patterns, lifecycle frameworks, foundation-model collapse — default-deny on irreversible actions is the one rule that holds. Earn the exception; never assume it.

The Architecture Argument Just Got More Interesting

For most of the last year, the agent-security conversation has assumed a stable architectural target: multi-agent systems with per-agent identity, per-hop authorization, externalized decisions on every call. The frameworks are converging because the architecture they’re built for is converging.

The Chain-of-Agents direction puts a useful asterisk on that convergence. If the agents collapse into the model, the substrate that supports them has to absorb the loss of resolution by leaning harder on what’s still legible — the action being attempted, the resource being touched, the intent being claimed. The policy engine stays. The signal it reads gets reshuffled.

That’s the architecture argument worth having now, before the foundation agents move from arxiv into production. Not can we authorize multi-agent systems? — we’ve answered that. How do we authorize agent systems when the agents are no longer separable from the model? The decision plane is built to handle it. The teams shipping those models should design for it.

When the Agents Collapse Into the Model