Invisible handoff

Agents increasingly delegate. An assistant hands a booking to a travel company’s agent, a payment to a payments agent, a question to a specialist model. Protocols now exist to make this routine: Google announced its Agent2Agent protocol in April 2025 with ‘more than 50 technology partners’, and by June it sat with the Linux Foundation, supported by more than 100 companies.

Each handoff moves context, who the person is, what they want, sometimes what they have said in confidence, to a party with its own operator, terms and incentives. The interface still shows one conversation. When something goes wrong, the person cannot tell which link failed, who now holds their data, or whom to complain to. The Model Context Protocol forbids one specific abuse, a server passing on the person’s own access token to the next system, because a downstream service would then trust it ‘as if it came from the MCP server’. The wider question of what context travels with a task is left to each operator.

The UK Information Commissioner’s Office warns that ‘agent-to-agent communication that isn’t visible to human observers’ may affect transparency, that ‘It will become increasingly difficult to understand how and where information is processed’, and that this kind of invisible processing could stop people exercising their information rights. OWASP’s Top 10 for agentic applications lists insecure inter-agent communication among the main risks. NIST’s 2026 concept paper on agent identity asks how agents can ‘log their actions and intent in a tamper-proof and verifiable manner’ and how to bind each action ‘back to human authorization’; Singapore’s framework for agentic AI says delegations of authority ‘should be clearly recorded’. The receipt this pattern asks for is being specified, not yet required.

Today the chain is disclosed to companies, not people. OpenAI’s sub-processor list names the third parties that handle data for its business and API customers; its consumer plans are largely outside it. That is normal practice, and it means the person talking to an assistant has less of a map than the company paying for one.

The law expects visibility, with a gap. Under the EU’s GDPR people must be told ‘the recipients or categories of recipients’ of their personal data, so a notice that names only categories is lawful on its face. The Court of Justice closed part of that gap in 2023: asked, a controller must give ‘the actual identity of those recipients’, unless they cannot yet be identified. For a chain of agents assembled at run time, that is exactly the case the exception describes.