# MAS-02 Agent-to-agent authentication (Critical)

Domain: MAS Multi-Agent Systems · HI-AAF v1.3 · Public review · https://humanintel.net/standard/mas/mas-02

Every agent-to-agent invocation is authenticated using credentials issued to the calling agent's non-human identity. Authorization for cross-agent calls follows the principle of least privilege and is enforced at the runtime layer.

Every agent-to-agent invocation is authenticated using credentials issued to the calling agent's non-human identity (IAM-01). Authorization for cross-agent calls follows the principle of least privilege (IAM-03) and is enforced at the runtime layer, not solely in agent prompts or instructions. This control prevents unauthorized agent-to-agent communication and ensures that every cross-agent call is attributable.

Critical control: a Critical failure precludes HI-AAF Certification regardless of the maturity level achieved on any other control.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for MAS-02: All agent-to-agent invocations are authenticated; authorization follows least privilege; enforcement is at the runtime layer; authentication failures are logged and reviewed.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- All agent-to-agent invocations are authenticated.
- Authorization follows least privilege.
- Enforcement is at the runtime layer.
- Authentication failures are logged and reviewed.

## Framework mappings

- NIST AI RMF: MANAGE 2.1
- ISO/IEC 42001: A.8.4
- OWASP LLM Top 10: LLM08
- SOC 2 (TSC): CC6.3
- EU AI Act: Art. 25(1), Art. 14(4)
- MITRE ATLAS: Execution
- Singapore: MAIGF Accountability, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites IAM-01 Dedicated non-human identity: https://humanintel.net/standard/iam/iam-01
- Cites IAM-03 Least-privilege scoping: https://humanintel.net/standard/iam/iam-03
- Glossary: Agent-to-agent: https://humanintel.net/standard/glossary#agent-to-agent

## Cite this control

Human Intelligence. HI-AAF v1.3, MAS-02 Agent-to-agent authentication. Public review edition, July 2026. https://humanintel.net/standard/mas/mas-02