AI agents
Handoffs, Specialists, and Capability Routing
Design specialist agents and handoffs that preserve user intent, state, evidence, and accountability.
By the end you can
- Define agent handoffs as an operational contract rather than a capability label
- Contrast Static routing with Model-based routing in “A support triage agent handed a billing dispute to a generic sales agent”
- Trace “Handoffs can lose the very constraint that made the task difficult” through a concrete execution path
- Produce “Create a specialist routing test” with evidence for “The correct specialist receives tasks across paraphrases and edge cases”
Example
Inter-Agent Misalignment is 36.9% of the failures in MAST
When a multi-agent system fails, a large share of the damage happens in the seam between agents. The seam has been counted. MAST, the Multi-Agent System Failure Taxonomy, names 14 failure modes in 3 categories. It was built in 2025 by Cemri and colleagues, from 150 expert-annotated traces drawn from a dataset of 1600+ traces produced by 7 multi-agent frameworks. Inter-annotator agreement was kappa = 0.88.
One of the three categories is Inter-Agent Misalignment: breakdowns in information flow between agents. In the 210-trace distribution it accounts for 36.9% of failures. Its modes are exactly the ones a routing table can produce, and each carries a share. Task derailment (FM-2.3) is 7.40%. Failure to ask for clarification (FM-2.2) is 6.80%. Unexpected conversation resets (FM-2.1) are 2.20%. Ignoring another agent's input (FM-2.5) is 1.90%. Information withholding (FM-2.4) is 0.85%.
A destination agent that restarts the conversation and answers a simpler question than the one it was handed is not an anecdote about one bad deployment. It is FM-2.1 and FM-2.3, annotated in traces other people can read. Both sit inside the category that carries more than a third of the observed failures.
- Decision at stake: Design specialist agents and handoffs that preserve user intent, state, evidence, and accountability. The 36.9% MAST files under Inter-Agent Misalignment are failures of that preservation, not of reasoning inside any single agent.
- Hidden assumption: Role names are sufficient evidence that a specialist can perform a task. Task derailment, FM-2.3, is 7.40% of the annotated failures on its own.
- Primary control question: Does the constraint that made the task difficult survive the transfer? Information withholding, FM-2.4, is only 0.85% of failures — rare enough to miss in casual testing, and expensive when it lands.
- Evidence to collect: The correct specialist receives tasks across paraphrases and edge cases. Record it the way MAST recorded its 150 traces: annotated by people who agreed at kappa = 0.88, not scored by the router's own report.
Key idea
A typed packet with a receiver-synthesis step cut medical errors by 23%
Summaries often preserve the topic and omit authority, deadlines, prior refusals, or sensitive context. The receiving agent then optimizes a simplified task that the user never requested.
Medicine ran the experiment. I-PASS is a typed handoff packet with five fields: Illness severity, Patient summary, Action list, Situation awareness and contingency plans, and Synthesis by receiver. Starmer and colleagues tested it prospectively across nine hospitals and 10,740 patient admissions. The results appeared in the New England Journal of Medicine in 2014: “In 10,740 patient admissions, the medical-error rate decreased by 23% from the preintervention period to the postintervention period (24.5 vs. 18.8 per 100 admissions, P<0.001), and the rate of preventable adverse events decreased by 30% (4.7 vs. 3.3 events per 100 admissions, P<0.001).”
The fifth field is the acceptance step. AHRQ PSNet expands it as “Synthesis by receiver: an opportunity for the receiver to ask questions and confirm the plan of care.” Note what it did not cost. Oral handoff duration did not increase: 2.4 vs. 2.5 minutes per patient, P=0.55. A packet with a named acceptance field bought a 23% fall in errors and a 30% fall in preventable adverse events. It bought no extra time.
The design instruction transfers directly. Use typed handoff packets. Require the receiver to acknowledge scope, evidence, and authority before acting.
Without an explicit acknowledgement the receiving agent solves the easier task it was handed and reports success. In nine hospitals that acknowledgement step cost 2.4 vs. 2.5 minutes per patient, P=0.55.
Distinct tools make a specialist; a label does not
A handoff transfers responsibility for the next part of a task to another agent or service. It should carry why the transfer occurred, the current contract, verified state, open questions, allowed authority, and the expected deliverable.
The industry's own capability standard says what a capability declaration is worth. Agent2Agent (A2A) is that standard. Google Cloud donated it to the Linux Foundation in 2025, with AWS, Cisco, Google, Microsoft, Salesforce, SAP and ServiceNow as founding members, and it reached stable version 1.0.0 in 2026. Its AgentCard is a self-describing manifest. The AgentSkill object requires only id, name, description and tags. Examples, inputModes, outputModes and securityRequirements are all optional. Of the skills field the specification says: “Skills represent the abilities of an agent. It is largely a descriptive concept but represents a more focused set of behaviors that the agent is likely to succeed at.”
Read the standard's own words carefully: descriptive, and likely to succeed. Four required string fields are what a router gets by default. None of them is a test. Specialization has to come from somewhere else — from distinct tools, data, policies, models, or owners. A role label alone cannot make an agent competent.
An agent with the same tools and the same data is the same agent under a new name, and routing to it renames the failure instead of relocating it.
Case
transfer_to_<agent_name>, transfer_to_human_agents, and what the receiver sees
Three publicly inspectable implementations expose the transfer as an ordinary tool call. You can read what each one hands over.
In the OpenAI Agents SDK a handoff is literally a tool. The documentation states that “Handoffs are represented as tools to the LLM. So if there’s a handoff to an agent named Refund Agent, the tool would be named transfer_to_refund_agent”. It adds that by default “the new agent takes over the conversation, and gets to see the entire previous conversation history”. An input filter is the documented way to change what it receives.
Microsoft’s AutoGen Swarm is a different organisation and a different codebase. It makes the same two choices. Control passes because “the speaker agent is selected based on the most recent HandoffMessage message in the context”, produced through the model's tool calling, and “participant agents broadcast their responses so all agents share the same message context.”
τ-bench does the same thing for the return path. Escalation there is an explicit tool, transfer_to_human_agents. A written domain policy binds it with an if-and-only-if: “You should transfer the user to a human agent if and only if the request cannot be handled within the scope of your actions.”
τ-bench also shows why one successful transfer proves nothing. The benchmark has 115 tasks in τ-retail and 50 in τ-airline, with 7 write and 8 non-write API tools in retail and 6 write and 7 non-write in airline. gpt-4o with function calling scored pass^1 of 61.2 in retail and 35.2 in airline. pass^k is the chance that all k i.i.d. trials of a task succeed. In retail, consistency fell to roughly 25% at pass^8.
The common shape across all three: context transfers by default; authority does not.
Visual
The receiver owns nothing until acceptance clears
A transfer moves through a Routing signal, a Capability profile, a Handoff packet, and an Acceptance before the receiver owns anything. A Return path then carries escalation, rejection, clarification, or completion back to the caller. Acceptance and the Return path should be owned separately, and tested separately.
The Capability profile is the weakest node by construction. The A2A AgentSkill it is usually built from requires only id, name, description and tags, and the specification itself calls the result “largely a descriptive concept”.
The Acceptance node has a regulatory precedent with an order number. Paragraph 2-4-3 of FAA Order JO 7110.65BB, issued in 2025, is titled "Pilot Acknowledgment/Read Back". It requires controllers to ensure pilots acknowledge every clearance and instruction, that items read back are correct, that hold short instructions are read back, and that call signs are used in the read back. Its NOTE gives the reason the transfer is not complete until the receiver speaks: “Until a pilot acknowledges a controller's clearance or instruction, a controller cannot know if a pilot will comply with the clearance or remain as previously cleared.”
The obligation runs both ways. 14 CFR § 91.123(a) puts the duty to raise doubt on the receiver rather than letting it proceed on a guess: “When a pilot is uncertain of an ATC clearance, that pilot shall immediately request clarification from ATC.” The sender obtains a read back. The receiver is required to ask. Neither half is convention, and neither is left to the good sense of whoever is on the frequency.
- 1
Routing signal
Task type, risk, language, domain, tool need, or policy state.
- 2
Capability profile
Declared skills, tools, limits, owner, and supported input modes.
- 3
Handoff packet
Contract, evidence, state, permissions, and unresolved issues.
- 4
Acceptance
The receiver confirms capability and task ownership.
- 5
Return path
Escalation, rejection, clarification, or completion back to the caller.
Steps
Create a specialist routing test
Routing is only testable against paraphrases and overlaps, so build the test from a real workflow's confusable cases. Take requests that two specialists could each plausibly claim. Reword them the way a user would. Record where every version lands.
Run each case more than once. τ-bench measures precisely this and reports pass^k, the chance that all k i.i.d. trials of a task succeed. gpt-4o with function calling scored pass^1 of 61.2 in τ-retail, and consistency fell to roughly 25% at pass^8 in the same domain. A router that worked on the first try is not a router that works.
A test built this way exposes the loss that matters here: a handoff that carries the request and drops the constraint that made the task difficult. MAST files that as task derailment, FM-2.3, at 7.40% of annotated failures. The test also leaves a record of which specialist received what. That record is the only way to tell routing that works from routing that got lucky on the phrasings you happened to try.
The order is fixed by what depends on what. Define capability profiles first: supported tasks, tools, risk limits, ownership. Build confusion cases from overlapping domains, ambiguous language, and unsupported requests. Specify the packet so it transmits contract, state, provenance, permissions, and open questions. Require acceptance, and let the receiver reject work it cannot safely perform — the I-PASS Synthesis-by-receiver field made this a named step rather than a courtesy. Then test the return paths: escalation, clarification, partial result, and downstream failure.
- 1
Define capability profiles
Describe supported tasks, tools, risk limits, and ownership.
- 2
Build confusion cases
Include overlapping domains, ambiguous language, and unsupported requests.
- 3
Specify the packet
Transmit contract, state, provenance, permissions, and open questions.
- 4
Require acceptance
Let the receiver reject work it cannot safely perform.
- 5
Test return paths
Exercise escalation, clarification, partial result, and downstream failure.
Example
Observable proof for agent handoffs
Four things are worth observing here, and each of them fails on its own. Two of the four already have measured baselines you can compare against.
MAST enumerates the failure modes of the seam with their shares. Of failure category FC2, Inter-Agent Misalignment, its authors write: “These include unexpected conversation resets (FM-2.1, 2.20%), proceeding with wrong assumptions instead of seeking clarification (FM-2.2, 6.80%), task derailment (FM-2.3, 7.40%), withholding crucial information (FM-2.4, 0.85%), ignoring other agents’ input (FM-2.5, 1.90%), or mismatches between reasoning and action (FM-2.6, 13.2%).”
The leakage half is measured too. Leading agents on CRMArena-Pro reach only around 58% single-turn success and about 35% in multi-turn settings, while clearing over 83% single-turn on Workflow Execution alone. The benchmark, published by Salesforce AI Research in 2025, covers nineteen expert-validated tasks across sales, service and configure-price-quote processes, in both B2B and B2C settings. Competence at a scripted procedure is not competence at holding a conversation someone handed you. On what an agent lets slip, the paper is blunt: “Furthermore, agents exhibit near-zero inherent confidentiality awareness; though targeted prompting can improve this, it often compromises task performance.”
- Signal 1: The correct specialist receives tasks across paraphrases and edge cases — not only on the wordings someone had in mind while building the router. The failure mode is task derailment, FM-2.3, at 7.40%.
- Signal 2: Handoffs preserve constraints and evidence without leaking unrelated data. CRMArena-Pro's probes found near-zero inherent confidentiality awareness, and prompting for it often compromises task performance. This signal has to be measured, not assumed.
- Signal 3: Receivers can refuse unsupported or over-authorized assignments. τ-bench makes refusal a tool, transfer_to_human_agents, bound by an if-and-only-if scope rule. When refusal is missing, MAST's FM-2.2 — proceeding with wrong assumptions instead of seeking clarification — is 6.80% of failures.
- Signal 4: Users do not need to repeat information already verified and permitted to transfer. Unexpected conversation resets, FM-2.1, are 2.20% of annotated failures, and the drop from about 58% single-turn to about 35% multi-turn is where they show up.
One specialist per awkward case builds an untestable maze
Route by capability and risk, then verify acceptance. Avoid specialist proliferation when a tool or a deterministic branch would solve the boundary more clearly. Every added specialist adds a seam, and the seam is where 36.9% of MAST's annotated failures live.
Whoever draws the routing table also owns what that table can lose: a handoff that passes the request along and leaves behind the constraint that made it hard in the first place. Nothing in a capability declaration will catch that for you. A2A's own specification calls its skill set “largely a descriptive concept”. CRMArena-Pro's leading agents fall from around 58% single-turn to about 35% multi-turn. That fall is the tax that transferring ownership has to survive.
The table is working when a task reaches the specialist that can actually handle it, however the user happened to phrase the request; when the constraint arrives together with the task; and when the receiver has both the standing to refuse and, as 14 CFR § 91.123(a) puts it for pilots, the duty to ask rather than proceed.
Adding a specialist for every awkward case turns a routing table into a maze nobody can test.
Key takeaways
- A handoff transfers responsibility for the next part of a task to another agent or service. In MAST's 210-trace distribution, Inter-Agent Misalignment — failures in exactly that transfer — accounts for 36.9% of failures.
- Specialization must come from distinct tools, data, policies, models, or owners. The A2A specification calls its own AgentSkill declarations a descriptive concept, and requires only id, name, description and tags.
- Routing signals — task type, risk, language, domain, tool need, policy state — are worth nothing if the packet drops the constraint. Task derailment is FM-2.3 at 7.40%, information withholding FM-2.4 at 0.85%.
- A capability profile is a claim, not a test. gpt-4o scored pass^1 of 61.2 in τ-retail, and consistency fell to roughly 25% at pass^8 across repeated trials.
- Typed packets with an explicit receiver-synthesis step are measurably better: nine hospitals, 10,740 admissions, medical errors down 23% and preventable adverse events down 30%, at 2.4 vs. 2.5 minutes per patient.
- Acceptance is a rule, not a courtesy. Paragraph 2-4-3 of FAA Order JO 7110.65BB requires the read back, and 14 CFR § 91.123(a) requires the receiver to ask when uncertain.