# Why delegated agent work needs delegated authority limits Why the progression from tool use to delegated agents makes authority boundaries part of the task contract, in the context of the October privacy report. Author: Retrivium editorial team Language: en Analysis published: 2026-11-03 Event date: 2026-10-05 Original announcement: https://research.google/blog/open-and-emergent-problems-in-agentic-privacy-and-security-a-contextual-angle/ Canonical URL: https://retrivium.ai/retrospectives/agent-privacy-delegation-authority/ The contextual-agent privacy report identifies delegation as part of a changing software landscape. Looking back from that discussion shows why splitting work between agents also creates a question about the authority each worker should receive. ## The dated path - 2022-10-06: [ReAct: Synergizing Reasoning and Acting in Language Models](https://arxiv.org/abs/2210.03629). - 2023-02-09: [Toolformer: Language Models Can Teach Themselves to Use Tools](https://arxiv.org/abs/2302.04761). - 2026-10-05: [Google publishes a contextual agent privacy report](https://research.google/blog/open-and-emergent-problems-in-agentic-privacy-and-security-a-contextual-angle/). ## A task description is not a complete authority model A worker may need enough information to solve a subproblem without needing all the access available to the parent system. Our retrospective interpretation is that delegation makes purpose-specific access more important. The parent’s ability to read a resource does not establish that every child task should receive the same resource. A useful contract describes the bounded work, the required evidence and the actions that would exceed the worker’s role, rather than relying on a broad instruction to be careful. ## Why authority can expand accidentally A parent agent can pass a conversation containing unrelated private context, or provide a general tool where a narrower operation would suffice. The delegated task then inherits opportunities that were not necessary for its purpose. This is an illustrative architecture concern, not a claim about an incident in a named product. The historical move from reasoning in text to acting through tools makes the distinction observable: the relevant question concerns which capabilities crossed the delegation boundary and why they were needed. ## A counterfactual with a narrower worker Compare a delegated task using a bounded data view with the same task receiving unrestricted parent context. Examine whether the broader view improves the accepted result or merely increases unnecessary exposure. Also test what happens when the subtask discovers that its assigned boundary is insufficient. A controlled escalation path can preserve the purpose of the original task while making the additional access explicit. This evaluation distinguishes necessary collaboration from access expansion that occurred only because copying the full context was convenient. ## What infrastructure should preserve A delegation record can identify the parent task, the worker’s scope, the resources supplied and the result returned. It need not retain every sensitive payload to make those relationships inspectable. The October report sets research directions rather than announcing a universal solution. Its broader implication is that agent coordination includes an authority graph as well as a dependency graph. Infrastructure becomes easier to reason about when it can explain both: which work depended on which result, and which bounded permission justified the action that produced it. ## Technical background Related engineering context: [Delegation tracing](/journal/provider-request-id-trace-context/); [Bounded data access](/journal/rag-server-local-architecture/).