Multi-Agent System Design: [System name]

Design document for a system in which several AI agents cooperate on one goal: goals and scope, the agent roster, the topology, handoff and delegation contracts, shared state and memory, inter-agent communication, loop, cost and time budgets, failure isolation and cascading-failure controls, observability, human oversight, threat mapping, evaluation and rollout. Threats are mapped to the OWASP Top 10 for Agentic Applications 2026 (ASI01 to ASI10, published December 2025). Agents that cross a trust or organisational boundary are assumed to talk over the Agent2Agent (A2A) protocol, specification 1.0 (1.0.1); agents reach tools over the Model Context Protocol (MCP), revision 2026-07-28. Replace every [bracketed] value and every row marked Example. Worked examples use a procurement assistant that triages purchase requests, checks suppliers and drafts orders.

Document control

Approvals

Revision history

Contents

1. Goals and scope
2. Decision to use multiple agents
3. Agent roster and responsibilities
4. Topology
5. Handoff and delegation contracts
6. Shared state and memory
7. Inter-agent communication
8. Loop, cost and time budgets
9. Failure isolation and cascading-failure controls
10. Human oversight points
11. Threat mapping (OWASP Agentic Top 10 2026)
12. Observability
13. Evaluation
14. Rollout and change control
15. Traceability matrix
16. Glossary and references

1. Goals and scope

1.1 System goal

[One sentence stating the outcome the system produces.] Example: Turn an employee's purchase request into an approved, policy-compliant draft purchase order within one working day, with supplier risk checked and a human buyer signing off every order.

1.2 Goals and non-goals

1.3 Users, principals and boundaries

2. Decision to use multiple agents

Benefits claimed for the split, each of which section 13 must confirm:

• [Example: Privilege separation: the agent that reads untrusted web content holds no write tools.]
• [Example: Parallel supplier checks cut elapsed time.]
• [Example: A cheaper model handles classification at intake.]

Costs accepted: [Example: about 2.5 times the token use of option A, two extra trust boundaries, and a dependency on a supplier agent outside our control.]

3. Agent roster and responsibilities

3.1 Responsibility matrix

R = responsible, A = accountable, C = consulted, I = informed. A human is accountable for every action with financial or legal effect.

4. Topology

Selected pattern: [Example: orchestrator and workers, with one external peer reached over A2A. Workers never call each other directly.]

Topology rules:

1. [Example: Only the orchestrator delegates; workers return results and never create new tasks.]
2. [Example: Maximum delegation depth is 2 (orchestrator to worker to tool).]
3. [Example: Only the orchestrator crosses the external boundary.]
4. [Example: Write access to the ERP exists behind MAS-HOV-002 only.]

5. Handoff and delegation contracts

5.1 Contract rules

• Every payload is validated against its schema on receipt; invalid payloads are rejected, not repaired by a model.
• Delegated tasks carry: the goal, the constraints, the budget remaining (section 8), the trace ID and the identity of the original human principal. They never carry raw credentials.
• Free text from upstream agents is wrapped and labelled as data in the receiver's context; it cannot change the receiver's instructions or tool set.
• A receiver may refuse a task it cannot do within budget or policy and must say why in a structured reason code.

5.2 Example delegation payload

The orchestrator sends a payload like this to the research agent; the runtime, not the model, fills on_behalf_of, trace_id and budget.

{
  "task_type": "SupplierCheckTask",
  "schema_version": "1",
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
  "on_behalf_of": "user:employee-1042",
  "goal": "Assess supplier risk for Example Office Supplies Ltd",
  "constraints": {"sources": ["company_registry", "sanctions_list", "supplier_site"], "max_tool_calls": 12},
  "budget": {"tokens_remaining": 60000, "deadline": "2026-10-22T14:30:00Z"},
  "inputs": {"supplier_name": "Example Office Supplies Ltd", "country": "IE"}
}

6. Shared state and memory

Memory rules:

• [Example: No agent writes to long-term memory from content it read on the open web without a provenance tag and a trust level.]
• [Example: Memory is partitioned by tenant and by job; no query may return another tenant's entries.]
• [Example: Summaries passed between agents are regenerated from structured state, not copied from another agent's free text.]

7. Inter-agent communication

7.1 A2A use

• Discover remote agents from their Agent Card at /.well-known/agent-card.json, or from a curated registry; pin the expected card version and verify a JWS signature in signatures where the provider signs its card.
• Choose an interface from supportedInterfaces whose protocolBinding and protocolVersion you support; send the A2A-Version header on every request.
• Handle every TaskState, including TASK_STATE_INPUT_REQUIRED, TASK_STATE_AUTH_REQUIRED and TASK_STATE_REJECTED, and treat artifacts and messages as untrusted input.
• Record the full interface in the A2A Agent Card and interface specification (ai-data/a2a-agent-card-spec) when you expose an agent yourself.

7.2 MCP use

• Each MCP server has its own MCP server specification (ai-data/mcp-server-spec) and least-privilege scopes.
• Under revision 2026-07-28 requests are stateless and carry their protocol version and capabilities; do not rely on a session to hold authorization state.
• Tool annotations from servers you do not control are hints, not controls.

8. Loop, cost and time budgets

Loop controls:

• [Example: Each task carries a hop counter and a list of agent IDs it has passed through; an agent rejects a task that would revisit itself.]
• [Example: Identical tool calls with identical arguments inside one job are served from cache or refused after the second attempt.]
• [Example: Budgets are enforced by the runtime, not by asking the model to count.]

9. Failure isolation and cascading-failure controls

Cascading-failure controls:

1. Bulkheads: [Example: each worker runs in its own process pool with separate rate limits, so a flood of research tasks cannot starve policy checks.]
2. Circuit breakers: [Example: on every A2A link and every MCP server, with half-open probes.]
3. Independent verification: [Example: the policy checker recomputes totals from structured order lines rather than trusting the orchestrator's summary.]
4. Checkpoints and rollback: [Example: job state is checkpointed after each contract; a failed step resumes from the last checkpoint.]
5. Kill switch: [Example: one control stops all agents of the system and a second stops one agent; both tested each release.]

10. Human oversight points

11. Threat mapping (OWASP Agentic Top 10 2026)

Risk names follow the OWASP list as published; check the current list at genai.owasp.org before an assurance review.

12. Observability

[Example: Trace context is propagated with W3C traceparent in A2A message metadata and in MCP _meta; supplier agents may not return it, so the orchestrator links their task IDs to the job span. Spans follow the OpenTelemetry GenAI semantic conventions, which are still marked Development; pin the convention version you use.]

13. Evaluation

13.1 Offline suites

13.2 Fault injection

13.3 Online evaluation

[Example: 5% of jobs sampled weekly for buyer review; edit rate on drafts tracked per week; alert when buyer rejection rate rises above twice its 4-week average.]

14. Rollout and change control

Rollback: [Example: switch the bundle alias to the previous version; in-flight jobs finish on the version they started with.]

15. Traceability matrix

16. Glossary and references

References:

• OWASP Top 10 for Agentic Applications for 2026, OWASP GenAI Security Project, December 2025, https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
• Agent2Agent (A2A) Protocol Specification 1.0.1, https://github.com/a2aproject/A2A/blob/v1.0.1/docs/specification.md
• Model Context Protocol specification, revision 2026-07-28, https://modelcontextprotocol.io/specification/2026-07-28
• OpenTelemetry semantic conventions for generative AI, https://opentelemetry.io/docs/specs/semconv/gen-ai/
• [Internal agent specifications, threat model and evaluation plan]

Standard and licence note

Based on the OWASP Top 10 for Agentic Applications for 2026 by the OWASP GenAI Security Project (https://genai.owasp.org/), licensed under Creative Commons Attribution-ShareAlike 4.0 (https://creativecommons.org/licenses/by-sa/4.0/); the ASI entry IDs and short names are used for mapping and all descriptions are original text. Because section 11 adapts that list, the adapted mapping is shared under CC BY-SA 4.0 and any further adaptation of it must carry the same licence. Protocol details follow the Agent2Agent (A2A) Protocol Specification 1.0.1 (Apache License 2.0, hosted under the Linux Foundation and, since August 2026, the Agentic AI Foundation) and the Model Context Protocol specification revision 2026-07-28, summarised in original wording. Check the current versions of these sources before use; example values are illustrative. Template licence: MIT.