Agent Visa: Task-Scoped Admission Control for Multi-Agent AI

Short summary

Multi-agent systems invoke sub-agents unconditionally: once an agent can be called, it can act, with no check on whether it belongs in this workflow and no mechanism to remove it once it goes off task. We propose Agent Visa, an admission-control layer built on AI Passport's existing primitives (connections, proposed writes, receipts, revocation) that requires every agent to hold a task-scoped visa before joining a workflow, and evicts it the moment it drifts outside that visa's authority.

The problem

Chained agentic workflows (orchestrator to sub-agent to tool, and back) create a fresh trust boundary at every hop, and current practice does not check it. Scoping is typically binary ("give it the API key"), not task-bound. Worse, the tool-stream channel itself is exploitable: recent work on error-path injection (VATS, arXiv:2606.07992) demonstrates that instructions embedded in ordinary tool error messages drive frontier models to 100% attacker compliance, outperforming standard prompt injection by 3x. The strongest attack in that evaluation, sandwiching the adversarial instruction mid-message inside legitimate error context, succeeded against every model tested regardless of vendor or scale. Prompt-level and model-level defenses did not reliably catch it; two of four evaluated models never flagged a successful attack. To our knowledge, no current multi-agent framework treats this as an admission-control problem rather than a model-alignment problem.

Who is affected

Developers building multi-agent systems, who lack a standard mechanism to scope, audit, or revoke a sub-agent's authority mid-task.
End users delegating work to agentic systems, who have no visibility into which sub-agents or tools acted on their behalf, under what authority, or why.
Anyone whose data traverses an agent chain, where accountability degrades with each additional hop.

How AI Passport is used

We extend AI Passport's app-to-passport connection model to govern agent-to-agent and agent-to-tool admission within a single workflow.

Visa issuance as a scoped Passport connection: An orchestrator requesting a sub-agent invocation requests a connection scoped to task, tool allowlist, and time-to-live, structurally identical to an app requesting a standing Passport connection, except single-task and non-renewing by default.
Passport review as visa approval: The existing "review before sharing" flow becomes "review this sub-agent's requested authority before granting it," routed to the human for high-stakes requests and auto-cleared for pre-approved, narrow-scope patterns.
Receipts as the customs log: Every read and proposed write already generates a receipt. In Agent Visa, this receipt chain becomes the reconstructable audit trail across the full agent graph: which agent read what, proposed what, and when.
Revocation as eviction: AI Passport's existing share, retain, or delete controls extend to live workflows: a sub-agent whose actions fall outside its visa's declared scope has its connection revoked immediately, its pending proposed writes discarded, and the orchestrator rerouted, without terminating the rest of the workflow.

What context, permission, proof, or access is involved

Context: Only the fields the declared task requires, never the user's full passport.
Permission: A scoped, time-limited capability grant (specific tools, specific data fields, bounded duration), not standing account access.
Proof: Every message claiming to grant new authority must carry a Passport-backed visa issuer signature. Free-text tool output, including error messages, carries no authority under any framing, position, or urgency marker. This is a direct structural response to VATS's core finding: the attack works because tool-stream text is treated as instruction-bearing. Remove that assumption architecturally and position-based attacks such as mid-message sandwiching have no channel left to exploit.
Access: Scoped per visa class:
- "Tourist": Read-only access.
- "Work": Multi-step task authority.
- "Transit": Non-transitive delegation authority (where a sub-agent cannot grant a downstream agent more authority than it itself holds).

Who controls access

The passport owner controls every grant, directly for high-stakes visas (broad tool access, first-contact agent identity, sensitive data fields) and via pre-set policy for routine, previously-approved patterns. No agent, including the orchestrator, can self-issue or delegate authority beyond what its own visa carries.

What can be revoked or changed

Any single agent's visa can be revoked mid-workflow without disrupting the rest of the agent graph.
Revocation discards pending, uncommitted actions from the revoked agent immediately.
The full receipt trail is reviewable after the fact, and users can tighten a workflow's default visa scope based on what the trail shows.

Risks or misuse concerns

Compromised orchestrator: An orchestrator issuing visas is a trust concentration point. We mitigate this by routing high-risk requests (broad scope, novel agent identity, sensitive fields) to human review regardless of the orchestrator's own trust level, rather than trusting orchestrator judgment transitively.
Visa fatigue: Approval requests at every hop will be rubber-stamped past a low threshold, defeating the mechanism. We address this with tiered defaults: narrow, previously-approved patterns clear automatically, and only novel or broad requests interrupt the user.
False-positive eviction: Aggressive drift detection risks evicting agents for benign task pivots. We scope deportation triggers to authority violations (an action outside the visa's declared tool or data boundary) rather than content-level task judgment, keeping the check mechanical and auditable rather than a second unreliable layer of AI judgment.
Receipt volume as its own exposure: A long agent chain generates an audit log that is useful for accountability but is itself sensitive, and needs access control at least as strict as the passport data it describes.