Lost in the Handoff 

Kasey Cromer, Netlok | October 6, 2026 

Executive Summary 

Every enterprise AI deployment begins with a human decision. A manager approves a workflow. An analyst initiates a research task. A compliance officer authorizes a report. That human decision carries authority, and that authority is supposed to travel through the system as work gets done. 

In environments where AI agents work together, it often does not. 

When one AI agent hands a task to another, the identity of the original human requester can get lost in the handoff. The agent receiving the task may act with significant authority without any record of who originally approved the action, under what conditions, or with what limits. Security teams are beginning to flag this as a real accountability gap, and the numbers suggest it is arriving faster than most organizations are prepared for. 

Gartner projects that 40 percent of enterprise applications will be integrated with task-specific AI agents by the end of 2026, up from less than 5 percent in 2025. At the same time, only 15 percent of IT application leaders are currently considering, piloting, or deploying fully autonomous AI agents, according to a Gartner survey of 360 IT application leaders conducted in May and June 2025. These two figures tell the same story from opposite directions. Agents are being embedded into enterprise software quickly. The governance structures needed to manage them are not keeping pace. 

Photolok by Netlok operates at the identity layer and integrates with platforms such as Okta Workforce. It cannot solve the full delegation chain problem on its own, but it addresses the most critical point in the chain: the human login that starts it all. 

How the Delegation Chain Works 

In a single-agent AI system, the relationship between human and machine is relatively straightforward. A person makes a request, the agent executes it, and the action can be traced back to the person who initiated it. 

A system where AI agents work together is different. A coordinating AI system receives a task from a human user and breaks it into components, handing those components to specialist agents. Each specialist agent may in turn call additional tools, services, or other agents to complete its portion of the work. The human who initiated the task may be several layers removed from the actions being taken on their behalf. 

This architecture is powerful, allowing enterprises to automate complex processes at a scale and speed no human team could match. It also creates a structural problem: each handoff between agents is a potential point where the original human identity, the limits on what the agent is allowed to do, and the conditions of approval can be lost, diluted, or misrepresented. 

Where Identity Gets Lost 

Current identity and access systems were built around a simple model: a human logs in, receives a session with defined access rights, and actions taken during that session are recorded against that identity. That model breaks down in AI agent chain environments because agents do not log in the way humans do. 

When a coordinating agent hands a task to a specialist agent, it typically passes a task description, relevant context, and whatever login data or digital passes it holds. What it rarely passes is a verifiable record of the human identity that originated the request, the limits on what the agent is allowed to do, or what the receiving agent is permitted to do next. 

The result is that activity records may show that an action was taken, and may even show which agent took it, but may not show who authorized the agent to take it or whether that authorization was ever legitimately granted. ISACA has stated directly that every action taken by an AI system should be recorded in a way that captures who initiated the action, whether human, application, or agent, and the reason for it. In most current enterprise deployments, that standard is not being met. 

The Audit Gap Nobody Is Talking About 

Governance frameworks have not caught up to AI agent chain reality. Only 38 percent of organizations have a formal, comprehensive AI policy, up from 28 percent in 2025, according to ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals. The gap is not simply a matter of policy documentation. It reflects a deeper structural problem: most organizations do not yet have the tools, processes, or frameworks to govern what agents do after they receive a task. 

For security and compliance teams, this creates compounding problems. Incident response becomes more difficult when the chain of actions cannot be reconstructed. Regulatory examinations become more complex when organizations cannot demonstrate that AI actions were taken within approved limits. Internal reviews become less reliable when activity records capture what agents did but not who authorized them. 

Gartner projects that by 2028, at least 15 percent of day-to-day work decisions will be made autonomously through AI agents acting without human input, up from 0 percent in 2024. That projection is not distant. It describes a trajectory that is already underway in the organizations that have moved past early pilots. The accountability infrastructure needed to govern those decisions at scale does not yet exist in most enterprises. 

Hidden Instructions: When the Chain Gets Hijacked 

The delegation chain problem is not only an accountability and compliance concern. It is also a security vulnerability. 

Hidden instruction attacks, which security teams call prompt injection, work by embedding a malicious instruction inside content that an AI agent will read and act on. The agent may follow the hidden instruction without recognizing it as unauthorized. In a system with one agent, the impact is limited by what that agent is allowed to do. In a chain, a single agent that follows a hidden instruction can pass it to every other agent working below it. 

AI agent chains are often designed to minimize human review of intermediate steps. That efficiency is also what makes hidden instruction attacks difficult to detect. The malicious instruction looks like a normal task handoff, carries whatever authority the compromised agent held, and may spread through the chain before any human reviews the outcome. 

For regulated organizations, the exposure is especially acute. A hidden instruction attack that causes an agent to take an unauthorized action, access data it should not access, or initiate a transaction outside approved limits creates not only a security incident but a potential compliance violation in which the organization may struggle to demonstrate that the action was not authorized. 

Regulatory and Compliance Exposure 

Regulators are beginning to ask questions about AI accountability that most organizations cannot yet answer. In financial services, the expectation that firms maintain records sufficient to reconstruct the basis for significant decisions is not new. What is new is the question of whether that expectation applies when the decision was made by an agent acting on behalf of a human whose authority may not have been recorded in the chain. 

ISACA’s guidance on AI agent governance calls for treating AI agents as accountable parties whose actions must be recorded with the same rigor as human actions. That standard requires organizations to build new processes that can keep up with the dynamic and autonomous nature of AI-driven activity. Most have not yet done so. 

The compliance exposure is not limited to financial services. In healthcare, any AI action that affects patient data or clinical workflow must be attributable to a responsible human authority. In government contracting, record-keeping requirements may extend to actions taken by automated systems. In any regulated environment, the inability to trace an agent action back to a human authorization is a liability that regulators are increasingly positioned to examine. 

Photolok by Netlok: Anchoring Human Identity in the Chain 

Photolok by Netlok operates at the identity layer and integrates with platforms such as Okta Workforce. It does not govern agent-to-agent handoffs or control what AI agents are allowed to do. Its value in an environment where AI agents work together is at the point where every chain begins: the human login. 

Photo-based authentication. Photolok replaces password-based credentials with photo-based authentication designed to strengthen identity assurance at login. Each photo carries an encrypted code that changes with every login, is tied to the user’s registered device, and requires a server-side access code to validate. Even if an attacker obtains the photos, the encryption and device binding make them unusable. A credential that is inherently resistant to phishing and replay makes the starting point of the agent chain more trustworthy. 

1-Time Photo. Users can configure up to five single-use photos for authentication.  Once used, that photo is no longer available, and the encrypted codes tied to it have already expired, stopping any replay attempts. For organizations concerned about keeping active logins secure in environments where agents act on human authority, a more secure human login is the first control in the chain. 

Duress Photo. Users can configure up to two Duress Photos. Duress Photos are silent alarms, randomly selected for display during login, and can signal that a user is being coerced. Selecting a Duress Photo triggers a real-time alert to security teams at the moment it is chosen. The security operations center receives a real-time distress signal while the login appears normal to anyone watching. In environments where AI agents may act with significant authority based on a single human login, protecting the integrity of that login is essential. 

The delegation chain problem cannot be fully resolved at the identity layer alone. It requires recording what each agent does, building limits on what agents are allowed to do, defending against hidden instruction attacks, and governance frameworks that treat agents as accountable parties. But every chain traces back to a human login. Making that login as strong and trustworthy as possible is the most immediate control organizations can apply. 

The Bottom Line 

AI agent chains are arriving in enterprise environments faster than the governance and accountability infrastructure needed to manage them. Agents are handing tasks to other agents, taking actions on behalf of humans whose authorization may not be recorded, and creating record-keeping gaps that security and compliance teams are only beginning to understand. 

The accountability problem is not theoretical. It is a structural gap in how AI agent systems are currently built, recorded, and governed. And it arrives at exactly the moment when organizations face increasing regulatory scrutiny of AI-related decisions and actions. 

The chain begins with a human. Protecting that human login, recording that authorization, and building governance that follows authority through every handoff is the work that regulated and unregulated enterprises must now start. 

Request Your Personalized Demo 

About the Author 

Kasey Cromer is Director of Customer Experience at Netlok. 

Sources 

[1] Gartner. ‘Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, Up from Less Than 5% in 2025.’ August 2025. gartner.com 

[2] Gartner. ‘Gartner Survey Finds Just 15% of IT Application Leaders Are Considering, Piloting, or Deploying Fully Autonomous AI Agents.’ September 2025. Survey of 360 IT application leaders, May to June 2025. Directly reported current finding. gartner.com 

[3] Gartner. ‘Gartner Predicts at Least 15% of Day-to-Day Work Decisions Will Be Made Autonomously Through Agentic AI by 2028.’ 2025. Forward projection to 2028, not a current figure. gartner.com 

[4] ISACA. ‘2026 AI Pulse Poll.’ May 2026. Survey of more than 3,400 digital trust professionals. Directly reported figure: 38% of organizations have a formal, comprehensive AI policy. isaca.org 

[5] ISACA. ‘The Growing Challenge of Auditing Agentic AI.’ 2025. isaca.org 

[6] Netlok. ‘How Photolok Works.’ netlok.com