FIELD NOTE / TIKTOK
Two agents can share one mistaken power.
The complete written thought and the evidence behind it. The video edition will follow its public release.
The written argument is here.
This approved TikTok edition is on the journal now. Its video player and original platform link will appear after each public release is verified.
Two agents can share one mistaken power.
Video caption
Two agents can share one mistaken power. It is not the target service's authorization check. The service must reject an unapproved effect. #EricFieldNotes
Full written post / accessibility read
An intake agent hands a request to an operations agent. The second agent has a generic publish or deploy tool. Even if both agents obey their instructions, the service may see only the same broad credential. Which identity and scope does it actually enforce?
OpenAI's Agents SDK documents input filters and handoff callbacks, with authorization for parsed handoff fields checked before side effects. That helps at the transfer. A downstream tool still needs its own object-level check, especially if another route can call the same service.
Create a disposable action sink that records account, object and actor. First prove an approved packet produces one receipt. Then change the object after handoff, let a delegate retry, and try an alternate tool. Require every unapproved path to leave the counter unchanged.
Keep agent callbacks for early rejection and useful logs, but make the target service enforce the final permit. Do this because delegation increases the number of paths to an action while the service remains the last common boundary.
#EricFieldNotes
Four-beat scene transcript
1. Two agents can share one mistaken power.
An intake agent hands a request to an operations agent. The second agent has a generic publish or deploy tool. Even if both agents obey their instructions, the service may see only the same broad credential. Which identity and scope does it actually enforce?
Visual: A clean handoff does not narrow a broad tool credential.
2. The handoff filter is about context.
OpenAI's Agents SDK documents input filters and handoff callbacks, with authorization for parsed handoff fields checked before side effects. That helps at the transfer. A downstream tool still needs its own object-level check, especially if another route can call the same service.
Visual: It is not the target service's authorization check.
3. Run the two-agent canary.
Create a disposable action sink that records account, object and actor. First prove an approved packet produces one receipt. Then change the object after handoff, let a delegate retry, and try an alternate tool. Require every unapproved path to leave the counter unchanged.
Visual: Authorized control, denied transfer and external readback.
4. Put authorization where routes converge.
Keep agent callbacks for early rejection and useful logs, but make the target service enforce the final permit. Do this because delegation increases the number of paths to an action while the service remains the last common boundary.
Visual: The service must reject an unapproved effect.
Research and claim limits
- OpenAI Agents SDK: handoffs (S131)
- OpenAI Agents SDK handoffs (S207)
- IETF RFC 8693: OAuth 2.0 Token Exchange (S208)
The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.