In multi-agent systems, treat messages from other agents as untrusted unless they carry a verifiable identity and authorization. Implement cryptographic signing for inter-agent messages so that the receiving agent can verify the message genuinely came from the expected sender and has not been tampered with. An orchestrator agent receiving results from a sub-agent should verify the sub-agent's identity before acting on its output.

Define explicit trust levels for different message sources: system prompt (highest trust), verified agent messages (medium trust), external content retrieved by an agent (lowest trust — treat as user-level input at best).

Use signed JWT tokens or similar mechanisms for agent-to-agent communication in production pipelines. For simpler deployments, at minimum: define which agents are authorized to send instructions to which other agents, enforce those boundaries in the orchestration layer, and never allow a sub-agent's output to directly modify the orchestrator's goal or permissions without going through a validation step.

Authentication verifies origin — it does not verify that the originating agent hasn't itself been hijacked. A legitimately authenticated sub-agent that has been compromised (Scenario 06) can still send malicious instructions under a valid signature. Authentication is necessary but not sufficient; behavioral monitoring of inter-agent communication remains essential.