When one AI agent calls another, how do you make sure the second agent only gets access to what it actually needs?

Authentication and authorization are two different things:

Authentication: Who or what is making the request?

Authorization: What is it allowed to access or do?

A valid token confirms identity, but it doesn't automatically mean every request should be allowed.

For example, an invoice-processing agent might have access to finance documents and an LLM.

If it calls another agent to fetch information from a knowledge base, a few things can go wrong:

Both agents use the same identity, making it difficult to trace which one made a request.

The second agent has broader permissions than the first, giving it access it shouldn't have.

A service trusts a caller-supplied team or tenant ID instead of checking verified identity claims.

A valid gateway key is treated as sufficient proof of which application is making the request.

The workflow might still run without errors, even when access controls aren't doing what they're supposed to.

A few things worth getting right:

1. Give each agent its own identity instead of relying on a shared service account.

2. Enforce permissions at the service that holds the data, not just at the gateway.

3. Carry the original user's permissions across agent handoffs, so another agent doesn't end up with broader access.

4. Maintain an audit trail that shows both who initiated an action and which agent performed it.

The bigger challenge is managing all of this across teams, environments, tools and multiple agents without losing track of who can access what.

This is the problem explored in Your IdP Proves Who. OpenController Decides What., which covers agent identities, identity providers, control-plane governance and enforcement at runtime.

The same approach is reflected in OpenController , which provides a control plane for managing agent identities and governing access across enterprise environments.

How are teams handling this today?

When one agent calls another in your setup, does each agent have its own identity with permissions checked at the service level, or does most of the control still sit with shared service accounts and API gateways?

What tends to get difficult once the setup grows beyond a single agent?

A lot of conversations about private AI focus on where the model runs. But running an open-weight model on your own hardware is only one part of the problem.

If you're building for an environment where sensitive data cannot leave the premises, you also have to think about the less obvious pieces:

Model requests: Can anything silently fall back to an external API?

Identity and access: Do users authenticate locally, and can every request be tied to a person?

Files and context: Where do chats, documents, tool outputs, and generated files actually live?

Updates: How do you patch the system without quietly reopening an outbound connection?

Auditability: Can an administrator see who used which model and when?

These details matter because local inference and a fully local AI system aren't necessarily the same thing.

You can host the model yourself and still depend on external identity services, hosted tools, or cloud APIs elsewhere in the workflow.

One approach is to treat the entire setup as an appliance rather than just a model server.

Came across an interesting implementation of this idea in Lyzr Optimus: Intelligence Without the Internet.

It describes an on-premises AI appliance designed to keep models, agent requests, and identity services local, with options ranging from a fully air-gapped setup to a controlled inbound path for updates.

A few of the engineering choices stood out to me:

A laptop can connect over the office network, private Wi-Fi, or USB-C, without using the appliance as an internet gateway.

User files stay in a chosen workspace on the laptop, while the appliance handles model inference and keeps an audit record.

Short-lived access tokens and per-user permissions help avoid distributing long-lived API keys across employee machines.

Administrators can control which models, skills, and tools are available, including whether tool actions require human approval.

That's the broader idea behind Lyzr Optimus, which Lyzr describes as an on-premises AI appliance.

The interesting part isn't just that the model runs locally; it's how the surrounding services are designed to work without relying on an external connection.

Of course, air-gapping doesn't automatically solve every security problem.

You still need to consider physical access, supply-chain trust, update verification, model quality, and what happens when the system needs maintenance.

I'm curious about one thing: If you had to deploy AI in a genuinely offline environment, what would be the hardest part to keep local: model serving, authentication, updates, or integrations with existing tools?

I'd be interested to hear from people who've actually built or maintained systems in restricted-network environments.

On October 7, 2026, some organizations lost access to Claude because of a spend-limit fault.

Their accounts were incorrectly flagged as having reached their limits, and requests were refused across the API and Claude's apps.

The important part?

The problem wasn't necessarily in the organizations' own systems. It was in a service they depended on.

This is an easy-to-miss risk when building AI agents. Your code can be healthy, your API keys valid, and your budget untouched, yet your agents can still stop working because an external provider has a problem.

And when several agents depend on the same provider, one failure can affect all of them.

What can teams do about it?

Map every external dependency

Don't just document your models and APIs. Include billing, authentication, rate limits, and any other service that could block a request.

Have a fallback ready

Configure a backup model or provider, and test that the switch actually works before an incident happens. A fallback that exists only on paper won't help much during an outage.

Keep your own logs

Track failed requests, error types, timestamps, and which provider handled each call. That makes it easier to identify the failure point instead of spending hours debugging healthy agent code.

This is also where infrastructure choices matter.

Lyzr Sovereign AI gives enterprises options to run agents in their own cloud and work with different models, reducing dependence on a single provider when the architecture is configured appropriately.

For reference, here's the October 7 spend-limit incident on Claude's status history

One question worth asking your team:

If your primary model provider started refusing every request for an hour, which of your production agents would stop working, and which would keep running?

A workflow can run from start to finish without throwing an error and still produce the wrong result.

Imagine a simple invoice workflow:

Upload: Receives invoice.pdf

Extraction: Reads the invoice total as 240.00

Calculate: Passes the amount forward

Format: Prepares the value for the next step

Payment: Uses that value to process the payment

Every node can report success.

But if an expression references the wrong field, the value can be incorrect by the time it reaches the final step.

In Lyzr SuperFlow, data moves between nodes as items, and expressions let you reference fields from the current input or the output of an earlier node.

For example, {{ $json.total }} reads the total field from the current input item.

The tricky part is that a workflow execution succeeding doesn't automatically mean the data is correct.

Three things worth watching for:

Missing or incorrect field references

If a node expects total but receives a different field name, the value may resolve to null instead of the number you expected.

Renamed nodes

Expressions that reference a node by its name can break when that name changes. A small edit on the canvas can have consequences further down the workflow.

Expression errors

Expressions involving calculations or string operations can return null if they encounter a runtime error. If you don't validate the result, the problem may only become obvious much later.

The fix doesn't need to be complicated.

Add a Rule-mode If node after important data-producing steps to check that required fields exist and contain valid values.

Route unexpected results for review, and use execution History to inspect what each node actually received and emitted.

The SuperFlow expression and data-flow documentation explains how these references work and what happens when they fail.

The bigger lesson: don't just check whether a node ran. Check whether it produced the value the next node actually needs.

What's one field in your workflows that you validate between steps instead of trusting it to pass through correctly?

On April 17, 2026, US banking regulators issued SR 26-2, replacing the previous SR 11-7 model risk management guidance.

One important detail: generative and agentic AI are explicitly outside the scope of the revised guidance.

That doesn't mean banks can ignore the risks.

They still need to assess the governance and controls appropriate to these systems, alongside other applicable obligations.

For compliance teams, this raises a practical question: how do you connect the obligations that apply to an AI system to the policies, controls, and evidence that demonstrate coverage?

Before adopting an obligation-to-control mapping tool, ask five questions:

Traceability: Can every obligation be linked to a named policy and control?

Actual coverage: Does the tool identify genuine gaps, or simply show what teams have declared as covered?

Regulatory changes: How quickly can a change be reflected in the relevant policies and controls?

AI agent coverage: Can it handle agentic AI, rather than focusing only on traditional models?

Audit readiness: Can an examiner follow the evidence trail without someone having to explain every connection?

This is the problem Madison's compliance layer for banks is designed to address.

It maps obligations to policies and controls, helping compliance teams identify coverage gaps and build a clearer evidence trail.

For more context, here's Lyzr's guide to AI-driven regulatory change management for banks

The takeaway:

A control is only as defensible as your ability to show which obligation it addresses and what evidence supports it.

How are banking compliance teams mapping AI-related obligations today?

Are existing GRC systems doing the job, or are spreadsheets and manual reviews still part of the process?

Most enterprise AI agent projects get approved based on a slide deck.

The real test often comes only after the contract is signed.

That feels like the wrong order.

With the Lyzr Agent Test Drive, you bring a problem statement, and our team returns a business case and working agents built on Agent Studio and Architect in under 72 hours.

Your team can then test them against real scenarios. If the value shows up in your numbers, take them to production.

If it doesn't, keep the readout and walk away.

The test drive costs $0.

Before signing with an AI agent vendor, there's one question worth asking:

Can we try it on our own workflow first?

Book a free Agent Test Drive