3 Multi-agent pipelines and orchestration

This chapter explains why real offensive security workflows need more than a single “smart” agent. Single-agent designs can work for narrow tasks, but complex engagements involve dependent stages such as reconnaissance, triage, prioritization, review, and reporting. The chapter presents multi-agent pipelines as a disciplined systems architecture: small, specialized agents perform limited responsibilities, while explicit artifacts, orchestration, safety gates, and shared state make the workflow predictable, auditable, and easier to defend.

A central idea is that agents should communicate through artifacts rather than direct calls, hidden memory, or shared in-process state. Artifacts act as contracts between stages: they record inputs, outputs, rationale, timestamps, provenance, and schema expectations. This enables replay, pause-and-resume behavior, human review, debugging, and downstream reuse without losing context. The orchestrator remains separate from the agents and controls execution order, routing, retries, branching, checkpointing, and failure handling. Memory is also treated as an external layer derived from artifacts, not as hidden intelligence inside an agent.

The chapter emphasizes governance, resilience, and visibility as requirements for production-grade multi-agent systems. Safety gates must live outside the model, enforce authorization and scope, and record human approvals where judgment is required. Robust pipelines should handle transient failures with retries, preserve progress with checkpoints, classify errors appropriately, monitor cost and quality, and generate traces and visual audit records. The chapter concludes by applying these ideas to a reconnaissance pipeline with separate normalization, triage, and reporting agents, then highlights common failure modes such as artifact drift, hidden orchestration, weak safety reviews, stale memory, and overloaded agents.

The general multi-agent system. Each agent consists of its own reasoning loop and can operate either independently or be coupled to other modules. Each agent can generate artifacts, which contain the model responses and information about the model run. These artifacts connect the agents, such that the outputs of one agent become the inputs of another. This structured pipeline is designed to achieve a specific goal defined by the user. To ensure our AI systems don’t go off the rails, guardrails such as safety gates and logging/tracing are implemented for observability.

A monolithic agent accumulates multiple responsibilities, while a staged pipeline composes small, focused agents connected by explicit artifacts.

Agents communicate exclusively through artifacts, which act as explicit interfaces between stages in a multi-agent pipeline.

The reconnaissance agent pipeline. The three AI agents conducting recon, triage, and reporting are orchestrated to run sequentially. Artifacts are handed over from one agent to the next to execute their specific functions.

Memory exists outside the agent loop. Agents consume artifacts and produce artifacts, while shared state persists independently.

Safety and approval flow for multi-agent systems. Each agent’s output passes through one or more approval layers before the next agent can execute its actions.

Audit flow with artifacts. Each transition is backed by logged reasoning, forming a complete audit chain. Every arrow corresponds to recorded evidence: the prompt, tool outputs, and safety decisions captured at each stage.

End-to-end multi-agent pipeline. Agents communicate only through artifacts. Orchestration controls execution order. Safety gates enforce authorization. Shared state enables pause, resume, and replay.

• Pipelines turn individual reasoning loops into orchestrated systems. Each agent contributes a specialized function, but together they create a coordinated workflow that mirrors how real red teams operate.
• Artifacts carry structured intelligence between agents. JSONL records preserve inputs, reasoning, outputs, and timestamps, making every action auditable and reproducible.
• The orchestrator manages execution, safety, and continuity. It decides which agent runs next, enforces gates, transfers artifacts, and logs every step for replay.
• Safety gates embed governance into automation.
• Resilience patterns turn brittle scripts into recoverable systems. Retry logic, checkpointing, and error classification ensure that pipelines continue to run even when tools or models fail.
• Visualization transforms logs into comprehension. Text traces and graphs help operators debug, managers audit, and defenders replay adversarial behavior safely.
• The Recon → Triage → Report pipeline demonstrates orchestration in action. This capstone connects agents, artifacts, gates, and visualization into a single repeatable red-team workflow.

FAQ