You've heard about Claude Managed Agents. By now — April 11, 2026 — you've probably heard about them six times. Anthropic launched Managed Agents on April 8. Then came the pricing, the early adopters, the "agents as headcount" framing. All covered.

Here's what wasn't: what multi-agent delegation actually looks like under the hood, and why your compliance team should be losing sleep over it right now.

The Architecture Nobody Explained

Anthropic's multi-agent delegation works like this. You define a coordinator agent — the boss — and list which sub-agents it can call. You declare each by ID, no ambiguity. The coordinator farms out tasks; each sub-agent gets its own thread (a separate workspace with its own conversation history) and its own context window — the amount of text the AI can "see" at once, like working memory.

Sub-agents share the same sandboxed container and filesystem, so they can collaborate on files. The coordinator sees a condensed summary of what each sub-agent did. Want full details? Drill into individual thread logs.

Anthropic allows only one level of delegation. The coordinator calls sub-agents, but those sub-agents cannot spawn agents of their own. No recursive rabbit holes. No agent inception. Not yet.

This architecture mirrors microservices — many small programs calling each other instead of one big program doing everything. But with a critical difference: every link in this chain makes probabilistic judgment calls (educated guesses based on patterns), not deterministic ones (same input, guaranteed same output). When a sub-agent misreads context, the error doesn't crash — it propagates politely through the entire system.

In microservices, a bad response returns an error code. In multi-agent delegation, a bad response returns a confident-sounding paragraph that the coordinator may or may not catch.

The Numbers Your Compliance Team Hasn't Seen

According to Gravitee's State of AI Agent Security report, published February 18, 2026, 88% of organizations report confirmed or suspected AI agent security incidents. Only 14.4% have full IT and security approval for their entire agent fleet. Average monitoring coverage sits at 47.1% — meaning more than half of deployed agents operate without anyone watching.

That's single-agent deployments. Now add delegation.

A coordinator fanning out to twelve sub-agents means twelve separate threads making independent judgment calls, each producing condensed summaries that lose detail on the way back up. Your monitoring coverage doesn't multiply — it divides.

The Compliance Gaps Are Already Documented

Augment Code's enterprise audit analysis, published April 8, 2026, mapped multi-agent systems against major compliance frameworks. The gaps are specific:

SOC 2 Type II requires demonstrable controls over data processing. Multi-agent delegation creates chains of processing where intermediate decisions lack individual audit trails.

ISO 42001 (the AI management system standard) requires risk assessment for AI system interactions. Delegated agents interacting through shared filesystems and condensed summaries introduce interaction patterns most risk assessments don't cover.

EU AI Act, Article 12 requires logging to be architecturally possible — not just a policy someone wrote. Most agent platforms don't meet that bar. The coordinator sees summaries; the full thread logs exist but require manual drilling. That's not the same as architecturally integrated logging.

And there's precedent for what happens when regulators catch automated systems producing incorrect outputs. In September 2022, FINRA fined UBS $1.1 million for automated systems that produced systematically incorrect regulatory disclosures over a multi-year period. Automation doesn't get a compliance discount. Delegation won't either.

What "One Level of Delegation" Actually Means

Anthropic's one-level limit sounds like a safety guardrail, and it partly is. But even within that constraint, a single coordinator can fan out to dozens of sub-agents simultaneously. Each makes judgment calls. Each produces thread logs that someone on your compliance team will eventually need to read.

The question has shifted. It's no longer what can one agent do. It's what can one agent authorize without asking you first — and whether your audit trail captures the answer.

The Punchline

Single-agent automation was a tool. Multi-agent delegation is an org chart that writes itself — on probabilistic judgment, with 47% visibility, and compliance frameworks that haven't caught up.

You started with one employee. You now manage a department you never approved.

Welcome to middle management. The AI version.

→ Anthropic Managed Agents Docs → Gravitee: State of AI Agent Security → Augment Code: Enterprise Audit Analysis