The right pattern depends on who must own the decision, how long the task lasts and whether the receiving agent can explicitly accept or reject the mandate.
A reliable handoff does not merely transmit context. It transfers an identifiable mandate between two agents, with an expected outcome, a verifiable working state, referenced evidence, bounded authority and an explicit rule for accepting, rejecting or returning the task. Until the receiver has accepted those elements, the sending agent, or the orchestrator governing it, remains accountable for what happens next.
This distinction matters as soon as an autonomous team distributes a process among several specialists. One agent may qualify a case, a finance agent may inspect an anomaly and a communications agent may prepare the response. If each receives only a conversation summary, the company may know what the agents discussed without knowing who owns the next decision, which evidence supports it or which action remains authorized.
A handoff transfers responsibility, not a conversation
In human work, continuity often feels implicit. A colleague understands that a case has been assigned because they know the organization, its roles and the team's habits. An agent system does not inherit that organizational understanding. It can interpret history, but history alone is neither a formal delegation nor proof of authority.
The OpenAI Agents SDK represents a handoff as a transfer of control to a specialized agent. It can define an input schema, run a function when the transfer occurs and filter the context the receiving agent sees. The same SDK distinguishes this pattern from using an agent as a tool: in that pattern, the coordinator retains the conversation and requests a bounded contribution from a specialist. The first governance decision is therefore whether the specialist advises the current owner or becomes the owner of the next step.
Model capability should not make that decision by itself. The deciding factor is who may produce the next business decision. A specialist may be better at analyzing a contract without being authorized to commit the company; a support agent may take over a customer conversation without automatically inheriting a refund right. Capability explains where to seek help. Authority explains who may close the step.
Three transfer patterns create three different owners
A multi-agent architecture covers several forms of collaboration. Treating them as interchangeable creates blind spots: the work appears to progress while accountability moves without an observable event. The following grid starts with the operating decision rather than the terminology of a particular framework.
| Decision criterion | Specialist called as a tool | Transfer of control | Durable task or work queue |
|---|---|---|---|
| Owner of the decision | The coordinator | The receiver after acceptance | The service that owns durable state |
| Suitable duration | Short and synchronous | Limited to a session or turn | Long, intermittent or asynchronous |
| Expected result | Advice or bounded output | Direct continuation of the interaction | State change and persistent artifacts |
| Context transferred | Minimal structured input | Filtered history and mandate | Identifiers, state, references and events |
| Authority | Remains with the coordinator | Must be redefined for the receiver | Attached to the step and checked at execution |
| Receiver failure | Coordinator resumes | Explicit return or escalation | Retry, failure queue or human owner |
| Observability | Trace of a specialist call | Transfer event and active agent | Lifecycle, status, timestamp and artifacts |
| Good fit | Analysis, classification, synthesis | Routing to an accountable specialist | Work requiring wait, recovery or external coordination |
Calling a specialist as a tool works when one agent must assemble the final answer or enforce a common policy. It reduces ambiguity because the coordinator remains accountable for the result even when it uses several areas of expertise. Its weakness appears when the coordinator becomes a bottleneck, accumulates excessive context or pretends to validate a domain it does not understand.
A transfer of control works when the specialist should continue the interaction directly under its own instructions. It produces clearer specialization but requires the ownership change to be visible. For work that outlives a session, waits for an approval or depends on another system, a durable task is safer: its state does not disappear with the conversation, and recovery does not depend on a model's memory.
The handoff contract must be accepted
A robust handoff can be represented as a contractual envelope. It does not attempt to describe everything that happened. It brings together what the receiver needs to decide whether it can take the mandate and what the governance system needs to verify that assumption of responsibility.
Atlensia diagram: ownership changes only after explicit acceptance; rejection or expiry returns the mandate to a known owner.
The objective describes an observable outcome, not a vague intention. “Check this request against eligibility policy P-17” is actionable; “look at the case” is not. State identifies the current step, the assumptions already tested, the open questions and any blockers. Evidence remains a set of references to authoritative systems, including the identifiers and relevant versions, rather than a copied value that can become stale.
Authority states which reads, writes and decisions are available under the mandate. It should also name prohibited actions, because a missing permission in a long list is harder to interpret than an explicit boundary. Exit conditions define what counts as done, what triggers escalation, when the handoff expires and where it returns when the receiver cannot proceed.
Acceptance must finally produce an event distinct from sending. The system can then record the task identifier, sender, receiver, mandate version, acceptance time and expected next status. If the receiver rejects the mandate because evidence or capability is missing, the case returns to a known owner with a structured reason. A task that has not been accepted should never remain between two agents.
Useful context is smaller than conversation history
Forwarding the complete conversation can feel reassuring because nothing appears to be lost. In practice, this approach mixes expired instructions, abandoned attempts, sensitive information and tool results whose validity may have changed. It also increases processing cost and forces the receiver to reconstruct the task state instead of using it.
The OpenAI Agents SDK provides input filters specifically to modify what the new agent receives. That mechanism illustrates a broader rule: the complete journal supports audit, while the work packet supports execution. The two can be connected through identifiers, but they should not be confused. The receiver needs the minimum sufficient context for action and a way to retrieve original evidence when verification is required.
Good context reduction does not freely summarize critical facts. It preserves identifiers, structured fields and validated decisions, then summarizes only intermediate reasoning that has no recordkeeping value. For an invoice exception, the amount, currency, supplier, purchase order identifier and mismatch reason should remain structured. A comment suggesting why the mismatch might be harmless remains an assumption, clearly separated from evidence.
This separation is consistent with the design of governed agent memory. Useful memory does not replace a system of record. In a handoff, it must not turn a conversational recollection into business truth simply because another agent receives it.
Permissions do not travel with text
The most consequential risk is not missing information but assumed authority. Copying “the customer is eligible for a refund” into a mandate does not give the receiver the right to execute that refund. An autonomous team must solve the information question and the authorization question separately.
The mandate can describe the proposed action, its risk level and the approval required. At execution time, the system must still check the receiver's effective permission, the scope of that permission, the object involved and its validity period. This check belongs close to the business tool because a prompt or handoff message is not a security boundary.
For a reversible, low-risk action, the receiver may have a limited capability such as preparing a draft in a dedicated workspace. For financial, contractual or destructive actions, the transfer should stop before the business effect and request a human decision or a separate approval service. Operational continuity does not justify automatic continuity of privileges.
NIST places clear roles, responsibilities and communication lines at the center of the Govern function in the AI Risk Management Framework. Applied to agents, that principle means changing the technical actor must not erase the human accountability chain. The process owner, policy owner and exception operator remain identifiable even when multiple agents perform the preparatory work.
Long-running work needs durable state
A conversational handoff fits a short interaction. It becomes fragile when the receiver must wait for a document, an approval or an external process to finish. A session may expire, be replayed or be interrupted without telling the company whether the task actually started.
Version 1.0 of the Agent2Agent specification formalizes a useful distinction among a message, task, status and artifact. A task has an identifier and lifecycle; it may be working, require input, complete, be rejected or fail, while its outputs are materialized as artifacts. The protocol does not solve an enterprise's governance on its own, but it reinforces that asynchronous collaboration needs a durable object distinct from the conversation thread.
For long-running work, the handoff should therefore create or update a task in an operational record. The agent receives a reference instead of becoming the sole keeper of state. Events make acceptance, waiting, recovery and closure observable. If a streaming connection closes, the task lifecycle persists, so loss of connectivity is not mistaken for loss of ownership.
Design failure before the happy path
Multi-agent demonstrations often show a router selecting the right specialist. In production, the useful question is what happens when that specialist does not respond, rejects the mandate, discovers a conflict or returns a noncompliant result. Without an answer in advance, retries can duplicate an action and two agents can both believe they own the same case.
Each transfer should be idempotent or protected by a correlation key. A retry carrying the same identifier does not create a second business request. The task record distinguishes “sent” from “accepted,” then “working” from “completed.” Expiry returns the task to its defined owner instead of silently assigning it to the next available agent.
Recovery also depends on the type of work. An analysis with no external effect can be rerun. A reservation, payment or data mutation must first check actual state in the system of record before resuming. The AI agent audit trail should retain the decisions and references needed for reconstruction without indiscriminately storing all conversation data.
Anthropic's account of its multi-agent research system highlights the coordination, evaluation and reliability challenges introduced by multiple agents. Its orchestrator-worker architecture is effective for exploring parallel research directions because a lead agent synthesizes the findings. The example also exposes an important limit: an architecture designed for research contributions does not imply that each worker should receive ownership of a business action.
Recommendations by scenario
In customer support, triage can transfer the conversation to a specialist when that specialist must answer directly and operates under a clear policy. The work packet contains the reason, verified identity, case references, steps already completed and authority boundary. A goodwill request above a defined threshold should nevertheless leave the agent conversation and enter an explicit approval mechanism.
In financial operations, the coordinator should usually keep ownership and call specialized agents as tools for extraction, matching or anomaly analysis. If a step must wait for evidence or approval, it becomes a durable task with a status and business owner. The transfer never carries a payment right; it prepares a decision whose execution follows separation of duties.
In research or decision preparation, several workers can explore directions in parallel and return artifacts to a coordinator. Each worker mandate specifies its scope, deadline, acceptable sources and output format. The coordinator remains responsible for comparing results, identifying contradictions and producing the final synthesis.
Four questions provide a practical choice: who must sign the next decision, how long may the task live, is the action reversible and which system can prove its state? If a coordinator must sign, the specialist remains a tool. If a specialist should immediately continue, an accepted handoff fits. If the work waits, resumes or creates a durable effect, it should become a task governed by persistent state.
Conclusion
A sound handoff is neither an elegant summary nor an isolated routing mechanism. It is an observable change in responsibility. It declares the objective, state, evidence, authority boundaries and exit conditions, then waits for acceptance before treating the mandate as transferred.
This discipline lets an autonomous team specialize without creating orphaned work. It preserves an owner through failures, prevents privileges from traveling with text and separates short interactions from tasks that need durable state. The test is straightforward: after an interruption, the company must still be able to say who owns the task, what has been proven, what remains authorized and where work should resume.
Primary sources and references
OpenAI Agents SDK, Handoffs, active documentation in August 2026
OpenAI Agents SDK, Agent orchestration, active documentation in August 2026
Agent2Agent Protocol, specification 1.0.0, 2026
NIST, AI Risk Management Framework Core, Govern function, 2023
Anthropic, How we built our multi-agent research system, June 13, 2025
Atlensia, platform for autonomous enterprise teams, 2026