authority
flat-authority recursion
Every recursive level reuses the same broad credential.
a2a recursion
Delegation can issue a child grant no broader than its parent.
recursion with limits
Recursive agents that can't run away.
Agents that call agents recursively can lose authority boundaries and history in interleaved logs. a2a cloud narrows grants by level, signs skill executions on Agent API, public `/invoke`, and standard MCP `tools/call` paths, and keeps formal A2A handoffs in separate ordered protocol history.
narrowed delegation · signed worker executions · ordered history
0
authority gained by recursing deeper
0
signed execution entry points
readable run history
the problem
Deep recursion accumulates authority it should be shedding.
The intuition of recursion is that each level does less — a smaller slice of the problem, with less at stake. Most agent stacks invert that for authority: every recursive call carries the full credential of the root, so a leaf ten levels deep can do everything the top-level agent can. Add interleaved logs and unbounded cost and a recursive run becomes something you can neither trace nor safely let loose. The deeper it goes, the less you can account for it.
Every level reuses the root's broad credential instead of a narrower one.
The call tree is invisible — logs from all levels interleave.
Nothing bounds depth, so cost and access can grow without a ceiling.
Reproducing a deep bug means re-running the entire tree and hoping.
the a2a way
Tie depth to narrowing and sign worker runs.
a2a narrows authority at each recursive level, signs skill-execution records, and preserves ordered handoff events separately so the tree can be inspected end to end.
Authority shrinks as you recurseSigned nodes, ordered eventsDepth and budget are boundedInspect any subtree
Authority shrinks as you recurse
Each recursive call issues a grant that is a strict subset of the level above it. The deeper the recursion, the narrower the authority — depth narrows access instead of accumulating it.
Signed nodes, ordered events
At each level, a skill execution through Agent API, public `/invoke`, or standard MCP `tools/call` produces its own evidence. Gateway responses include it; Agent API evidence is persisted. Formal A2A task state remains separate, and receipts are not cryptographically chained.
Depth and budget are bounded
Grants carry TTLs and scope, while the control plane associates separate per-call economics with verified receipt IDs. Authority stays bounded, and operators can observe spend without treating it as signed receipt data.
Inspect any subtree
The signed ordered event history lets you scrub a recursive branch and isolate where it diverged. Re-executing it deterministically additionally requires replay doubles and seeded randomness.
side-by-side
Unbounded recursion vs. narrowed recursion.
the call tree
flat-authority recursion
Depth disappears into interleaved logs.
a2a recursion
Signed execution nodes, plus handoff order if you record it.
runaway depth
flat-authority recursion
Recursion spends and escalates until something crashes.
a2a recursion
TTLs and scope bound authority; separate ledger data makes per-call economics visible.
debugging a branch
flat-authority recursion
Re-run the whole tree and hope it repeats.
a2a recursion
Inspect a subtree; rerun deterministically only with replay doubles and seeded randomness.
dimension
flat-authority recursion
a2a recursion
authority
Every recursive level reuses the same broad credential.
Delegation can issue a child grant no broader than its parent.
the call tree
Depth disappears into interleaved logs.
Signed execution nodes, plus handoff order if you record it.
runaway depth
Recursion spends and escalates until something crashes.
TTLs and scope bound authority; separate ledger data makes per-call economics visible.
debugging a branch
Re-run the whole tree and hope it repeats.
Inspect a subtree; rerun deterministically only with replay doubles and seeded randomness.
questions
Frequently asked.
What are recursive AI agents?
Recursive AI agents call agents—including instances of themselves—to break a problem into sub-problems and combine results. The pattern is dangerous without limits. Each handoff can narrow the grant at each level, and worker skills executed through the API, MCP, and /invoke entry points produce signed evidence; formal A2A nodes remain protocol history.
How do you stop recursion from escalating access or cost?
Authority only narrows downward. A parent call can grant a child a subset of what it holds and no more, and grants carry short TTLs and explicit scope, so deeper levels have strictly less power than shallower ones. Combined with per-run cost attribution, a runaway branch hits authority and budget limits rather than silently spending or acquiring access it shouldn't have.
Can I trace and reproduce a deep recursive run?
Each level that executes a skill through the API, MCP, or /invoke entry point produces its own signed evidence, while a replay session, if you enable one, keeps the order of events. Formal A2A messages are protocol state. Deterministic reruns still require replay doubles and seeded randomness.
keep reading
Related guides.
All guides live in the guides index.
don't trust the agent
Recurse as deep as you like. Keep the tree.
a2a cloud deploys any agent with managed Postgres, MCP, an API, scoped grants, and signed ordered history. At each level, Agent API, public `/invoke`, and standard MCP `tools/call` skill executions receive receipts; formal A2A task routes remain protocol state.