How Do You Audit Agent Handoffs Without Collecting the Raw Messages?

By Aojie (Justin) Yuan · October 2026 · ~5 min read

When one organization's agent hands work to another's, the handoff can carry private facts across a boundary. The obvious fix, logging every message centrally so someone can audit it, creates a new problem: a second repository full of sensitive content. This preprint asks how much auditing is possible without building that repository, and what blocking risky releases actually costs.

Two jobs, kept separate

• Auditing from metadata. An experimental A2A metadata interface reports labels, identities and hashes instead of raw messages, so a shared auditor can check who sent what kind of information to whom without holding the text itself.
• Enforcing release locally. A separate structured gate decides whether a proposed release goes out. It checks authorization, case relevance and exact source support. If the evidence is missing, the answer is unknown, not “safe”.

The paper is explicit that both are scoped checks, not guarantees of semantic confidentiality. Keeping raw text out of the center reduces what is collected; it does not prove nothing leaks.

Non-disclosure, task failure and privacy are three different things, and the results are reported so they are not conflated.

What the experiments show

• 20 authored tasks, all gates seeing the same frozen model proposals: the full gate keeps all 8 benign completions, removes 2 forbidden-marker releases and 4 unsupported-value releases, and returns unknown on 9 tasks.
• Replay of 1,132 archived AgentDojo trajectories: binding actions to their destination cuts native attack success from 165/808 to 0/808, while clean task completion falls from 198/324 to 179/324. Blocking has a utility cost, and the paper reports it next to the security gain.
• A frozen live study: eight methods on 32 development-disjoint tasks, with one 14B model and one seed. Ungated execution completes 10/32 tasks with one attack success among 16 attacked tasks; defended variants complete between 0 and 12 tasks with zero observed attacks.

What it does not show

The live study has too few attacks, and its paired intervals are too wide, to rank one defense above another, and the paper says so. Zero observed attacks in a small sample is not proof of privacy, and an unknown verdict is not a pass. This is a single-author preprint and has not been peer reviewed.

The practical takeaway

If you audit multi-agent systems, keep observation and enforcement as separate components, decide up front what the auditor is allowed to see, and report unknown outcomes, failed tasks and cost alongside attack success. A single “blocked” number hides most of the tradeoff.

Frequently asked questions

Can you audit agent handoffs without centralizing raw messages?

Partly. The paper's experimental A2A metadata interface reports labels, identities and hashes instead of raw message text. That reduces what a central auditor collects, but the paper presents it as a scoped check, not a guarantee of semantic confidentiality.

What does the release gate check?

A separate structured gate checks three things before content is released: authorization, relevance to the case, and exact support in a permitted source. When evidence is missing it returns unknown rather than a safety verdict.

Did blocking attacks cost task completion?

Yes. In replay of 1,132 archived AgentDojo trajectories, destination binding reduced native attack success from 165/808 to 0/808, while clean task completion fell from 198/324 to 179/324. The live study had too few attacks to rank the defenses.

Based on Auditing Agent Handoffs Without Centralizing Raw Messages: Evidence Boundaries and Release Tradeoffs (Preprints.org preprint, 2026, doi:10.20944/preprints202610.2601.v1; not peer reviewed) by Aojie Yuan. Written by Aojie (Justin) Yuan, USC Fortis Lab.