KSKS Security Research
Learning map / Session 1 / Scenes 14–17

FOUNDATION 07 · ORCHESTRATION

More agents add options.They also add attack surface.

Select manager, handoff, or code-led orchestration only when specialization and typed handoffs justify the coordination cost.

multi-agentmanagerhandoffsorchestration
Learning guide
Level
Applied
Reading time
12 min
Presentation
Session 1
Progress
8 of 8

01 · Mental model

Start with ownership, not agent count

A manager pattern keeps one component responsible for combining specialist outputs. A handoff transfers control to a specialist. Code-led orchestration makes sequence, approval, and failure behavior explicit in application logic.

Use multiple agents when roles have genuinely different instructions and evidence, work can be separated, and handoffs can be typed and reviewed. Otherwise, one agent with focused tools is usually easier to secure, observe, and evaluate.

02 · Visual explanation

01Managerone owner, agents as tools
02Handoffspecialist takes the turn
03Code-ledexplicit graph + gates
04Policyshared control plane
Three orchestration patternsThe pattern determines where final-answer ownership and policy enforcement live.

03 · Compare and decide

When complexity earns its place

Decision lensStay single-agentConsider multi-agent
ExpertiseOne instruction set covers the taskRoles need different evidence and rubrics
ContextAll steps use the same informationContext can be isolated by specialist
HandoffOne definition of doneTyped artifacts have clear owners
AssuranceSelf-check plus human review is enoughIndependent review adds measurable value

04 · Cybersecurity example

Cybersecurity delivery pack

A delivery pack needs architecture, compliance, detection, and project-planning expertise.

01

Code routes bounded work to specialists.

02

Each specialist returns a typed artifact.

03

A manager reconciles disagreements.

04

Deterministic gates validate the assembled pack.

Outcome: Multiple agents are justified because expertise, artifacts, and review responsibilities are separable.

05 · What to remember

The 60-second recall

01

Agent count is not a value metric.

02

Typed artifacts are safer than uncontrolled agent conversation.

03

Code-led orchestration is strong when approvals and failures must be explicit.

Teach-back prompt: Explain this concept to a teammate using the diagram, then name one failure mode and the control that stops it.

06 · Questions people ask

FAQ

Sometimes, especially with independent evidence or review. They can also amplify shared assumptions, add latency, and create more failure paths. Evaluate the actual workflow.

07 · Primary sources

Continue with authoritative guidance