Chapter 9: Advanced Agent Patterns

Outline

9.1 Why Advanced Agent Patterns Need Security Discipline

• Why multi-agent systems fail through confused ownership and authority drift, not just model error
• Delegation as a security boundary rather than a productivity trick
• The chapter’s core patterns: scoped delegation, bounded shared state, truthful liveness, and guarded egress

9.2 Role Separation Across Sessions, Subagents, and Workers

• Main session as coordinator rather than universal executor
• Background sessions, cron tasks, heartbeats, and ACP coding agents as different operational roles
• Why identity, lifetime, and authority should not be blurred across these roles

9.3 Delegation as Capability Transfer

• Passing tasks without passing unlimited context or implicit authority
• Using isolated subagents for research, drafting, and coding-heavy work
• Returning proposed results instead of silent side effects

9.4 Shared State, Memory, and Durable Handoffs

• Narrow shared state instead of globally writable memory
• Durable handoffs through database-backed records, task queues, and versioned artifacts
• Distinguishing startup context, human-readable notes, and operational truth

9.5 Approval Boundaries and Human Control

• Why higher-impact actions should converge on explicit approval gates
• Separating analysis, recommendation, and execution
• Preserving evidence of who approved what and under which context

9.6 Coordination Patterns That Scale Safely

• Fan-out/fan-in, reviewer, and specialist patterns
• When to parallelize and when to serialize
• Preventing cross-agent amplification of the same mistake

9.7 Long-Running Work, Liveness, and Truthful Status

• Presence, heartbeats, and health checks as proof of fresh ownership
• Safe handling of background work, retries, and stalled workers
• Why apparent success without current liveness is not trustworthy

9.8 Failure Modes in Multi-Agent Systems

• Duplicate ingress ownership, stale context, uncontrolled egress, and audit gaps
• How multi-agent convenience turns into confused deputy risk
• Containment and recovery strategies that follow boundaries

9.9 Case Study: Delegating Coding Work Without Leaking Authority

• Moving implementation work to a coding agent while preserving review and approval discipline
• Scoped workspace access, bounded outputs, and human checkpoints
• What good delegation looks like in practice

9.10 Chapter Summary

• The patterns that actually make advanced agent systems safe
• Common design mistakes to avoid
• Transition to testing, verification, and performance tradeoffs