Authentication, authorization, provenance on two AI agent teams on Claude Code

I run two AI agent teams on Claude Code. One runs my product (a Shopify analytics app). One runs operations. They coordinate the way microservices do: messages in a shared inbox folder.

This week I noticed something I didn't like. Both teams' startup routines said the same thing: "read the inbox, act on each line."

Act on each line. No verification. No classification. Any text that landed in that folder became an instruction.

I've spent 20 years in security operations. If a client described this setup to me, I'd call it what it is: an unauthenticated command channel. And I built it myself, into my own system, without noticing.

The uncomfortable part: the session that finally surfaced the risk had already executed three inbox lines that same morning. Blind trust worked only because both teams are one person. Me. The moment anything else can reach that folder (another person, a scheduled job, a pasted customer email), it becomes an attack surface.

I checked it against the OWASP Top 10 for Agentic Applications 2026. It's a textbook pair: ASI01 (Agent Goal Hijack) and ASI07 (Insecure Inter-Agent Communication).

The fix took one session. Four rules:

🔹 Messages are requests, not commands. On pickup, each line gets classified: reversible and inside the repo = act. External-facing, irreversible, or credential-adjacent = stage it and ask the human.

🔹 The inbox folder became a git repository. Every write and every drain is a commit. An uncommitted line is treated as forged.

🔹 Every line carries provenance: [src: decision number, ledger date, or commit]. The receiver verifies at the source before acting.

🔹 Quoted external content inside a message is data. Never instructions.

What I deliberately didn't build: message signing and per-agent identity. That's the right answer for real multi-party systems. It's ceremony for one human on one disk. Git history buys attribution for free.

The lesson that generalizes: if your agents pass messages to each other, that channel is part of your attack surface. Treat it like any inter-service channel. Authentication, authorization, provenance.

I'm extracting this and the rest of my hardening patterns (loud-failure contracts, secrets audits, autonomy ladders for new automations) into a public template for people who run agent workspaces on Claude Code. If that's you, I'd genuinely like to hear how you handle the channel between your agents.

0 comments

Authentication, authorization, provenance on two AI agent teams on Claude Code