Here's what we've learned from delivering agentic systems into production: security and speed are not opposed.
The shift to agentic AI is happening now. Organisations are moving from single-model deployments to orchestrated systems where a master agent coordinates multiple specialists—each handling a specific task, calling APIs, accessing data, or triggering business processes. Salesforce Agentforce, autonomous workflows powered by Claude or GPT, multi-agent chains: these are live. But security thinking hasn't caught up. Most teams are still applying single-agent threat models to systems that are fundamentally different: distributed, delegated, and asynchronous.
The security challenge isn't about locking down one model anymore. It's about governance at scale: Who delegates to whom? What can each agent access? How do you verify an agent didn't drift from its instructions? What happens when an agent calls a third-party API? These are architectural questions, not just tooling ones.
The Architecture Changes the Attack Surface
A master-and-subagent system is not a monolith. Think of it as a managed marketplace: the master agent (or orchestrator) accepts a business request, routes it to the right subagent, verifies the output, and executes. That distribution brings benefits—specialisation, resilience, auditability—but it also multiplies the surface you need to protect.
In a single-model world, security is a line: inputs go in, outputs come out, you inspect the edge. In an agentic world, you have trust boundaries inside the system: between master and subagent, between an agent and external services, between an agent's instructions and its actual behaviour. Each one is a place where things can go wrong—or right, if you design for it.
Consider a sales agent that recommends discounts. In a single-agent system, you'd constrain the model's parameters and monitor output. In a master-subagent system, the master delegates the discount decision to a specialist subagent, which pulls pricing data from an API, consults approval rules, and returns a recommendation. Now you need to ask: Can the subagent see all pricing tiers or just what's relevant to this deal? Can it exceed the approval threshold if it deems it justified? Does the master verify the recommendation before passing it back? These are security questions dressed up as architecture.
Trust, Delegation, and Verification
Intentional Trust
Define what each agent can do and why. Not "the subagent has access to the customer database"—"the subagent can read customer purchase history for the past 12 months to personalise a retention offer." Specificity enables review.
Bounded Delegation
Subagents operate within guardrails: scope, authority, timeout, fallback. A customer-service agent might be permitted to issue a £500 refund without approval, but flag and escalate anything above that to a human.
Continuous Verification
The output is only as good as the audit trail. Log what each agent decided and why. Spot drift. Catch anomalies. This is not post-mortem forensics—it's real-time governance.
These are not new ideas, but they're easy to miss when you're building agents quickly. Teams often assume the AI model will "behave"—that its training or instructions will prevent misuse. Agentic systems at scale demand governance that goes beyond that assumption.
From Principle to Practice
The place this gets real is in implementation. A master-subagent system is only secure if you think about it from the start.
What is each agent's job? What data does it need? What actions can it take? Write this down before you build.
Make trust explicit in code: API keys scoped to each agent, database roles limited to what an agent reads or writes, timeouts and fallback logic for failures.
Log every delegation, every decision, every anomaly. Surface drift: when agent behaviour diverges from baseline, investigate and adjust guardrails.
Pilot with real data and real integrations. Watch for emergent behaviour. Adjust guardrails based on what you see. Only then scale.
Security is Not Separate from Delivery
Teams that build governance into the agent design from the start ship faster, not slower. You catch issues in the sandbox before they hit production. You build confidence in your agents. And you can scale with less toil and less second-guessing.
The organisations moving fastest on AI aren't skipping security—they're building it into the workflow. They define agents and their boundaries explicitly. They instrument trust at the API and data layer. They log everything and alert on anomalies. And because this is baked in, not bolted on, they move faster.
The master-and-subagent world demands this rigour. It's the price of moving quick.
How do you govern agents at scale?
We're building agentic systems into production and learning what security looks like when you distribute trust. If you're scaling Agentforce or building orchestrated agents, we'd like to compare notes.
