Observability and composition: the risk no single audit catches
Egress control, sandboxing, and trust boundaries each secure one agent. This one is different. It is about what happens between agents, which is where the worst failures actually live. Two agents that each pass their own security review can combine into something that fails badly, and no per-system audit will ever see it. You cannot secure what you cannot see, and most organizations cannot see this layer. Only about one in four report full visibility into which of their agents are even communicating with one another.
This is the fifth and final post in our series on securing AI coding agents. The earlier four cover the problem and the three single-agent disciplines: start with the security risks of AI coding agents, which frames the lethal trifecta, then network egress control, sandboxing and execution isolation, and architectural trust boundaries. This post is the one that ties them together. For the full framework across all four disciplines, plus a maturity self-assessment, download The Agentic AI Security Maturity Guide.
Observability for agent systems is the practice of seeing, at runtime, what every agent accesses, what untrusted content reaches it, what it can do, and how it hands off to other agents. It is a security discipline, not an operations nicety.
The risk a per-system audit cannot catch
Take two agents. Agent A reads your deal pipeline and ingests external market reports, but has no way to send data out. Agent B sends email, but has no access to private data. Review each one alone and both are fine. Neither has all three legs of the lethal trifecta.
Connect them and the composite has all three. A poisoned market report read by Agent A can embed pipeline data in a message Agent B sends out. The exfiltration path runs across a boundary neither audit was looking at. Multiply that across every laptop and team and accountability diffuses. When two agents do in sequence what one person used to do, the moment a leak happens can be invisible in any single log.
The vulnerability does not exist inside either system. It exists in the composition. That is the risk no single audit catches.
What observability for agents requires
Four capabilities, in order.
Start with an inventory. What agents run, what each accesses, what untrusted content reaches it, what it can do. Most organizations cannot answer these questions today, and you cannot analyze a system you have not enumerated. The inventory is the foundation.
Instrument every agent-to-agent handoff with trust provenance. For each handoff, capture the input, the output, and where the data came from and how trusted it is. This is distributed tracing applied to agents. You want to follow a piece of data across boundaries and know, at every step, whether it originated from a trusted or an untrusted source.
Run compositional trifecta analysis. With provenance in place, ask the question no per-system review asks: does untrusted content entering one system reach an action channel in another? Run it across the whole graph, not one component at a time. That is what surfaces the emergent violations.
Add anomaly detection on runtime behavior. Baseline what normal looks like and flag deviations. It is the backstop for the risks your static analysis did not anticipate.
Observability is also your incident response
This telemetry is not only preventive. When a chain does cause harm, it is how you reconstruct what happened: where the poisoned input entered, how it propagated across boundaries, and where the emergent violation formed. Without trust provenance on every handoff, a cross-agent incident is nearly impossible to reconstruct, because no single log holds the whole path. With it, you trace the chain end to end.
This is the analysis we run at the start of an engagement, and it takes hands-on runtime experience rather than documentation, which is why most teams cannot do it internally yet. It is also the discipline that ties the other three together. Egress control, sandboxing, and trust boundaries each secure a part. Observability is how you verify the parts still hold once they are composed.
Frequently asked questions
What is observability for AI agents? The ability to see, at runtime, what each agent accesses, what untrusted content reaches it, what it can do, and how it hands off to other agents. It exists to catch risk that forms between systems, which per-system audits miss.
What is compositional risk in multi-agent systems? Risk that appears only when agents are connected. Two agents that are each safe in isolation can, when linked, assemble all three legs of the lethal trifecta, creating an exfiltration path neither system's review would catch.
Why doesn't a per-system audit catch compositional risk? Because the vulnerability does not exist inside any single system. It emerges from the interaction between systems, so a review scoped to one component sees nothing wrong. Only analysis across the whole graph reveals it.
What is trust provenance? Metadata attached to every agent-to-agent handoff that records the input, the output, and the origin and trust level of the data. It lets you follow a piece of data across boundaries and know whether it came from a trusted or untrusted source at each step.
Where to start
Build the inventory first. Every agent, what it can access, what untrusted content reaches it, what it can do. Most teams find gaps just from the enumeration. Then instrument the handoffs and run the compositional question across the graph.
Observability and composition is one of four disciplines that close the agent security gap, alongside network egress control, sandboxing and execution isolation, and architectural trust boundaries. For the full framework and a maturity self-assessment you can run against your own environment, download The Agentic AI Security Maturity Guide.
