Apply knowledge, tools, and security to an agent team

Isolation between agents

All participants must belong to the same organization and workspace. Even then, each agent keeps only its own knowledge bases, tools, and instructions.

Team membership does not copy resources or create implicit permissions.

Shared context

A specialist receives the current task and the context allowed by team settings. It does not automatically receive the full conversation, metadata, credentials, private traces, or coordinator resources.

Share only what is needed for the delegation. Confirm that any sensitive data is compatible with the agent's purpose and permissions.

Tools

Each specialist can invoke only its active, authorized tools. The coordinator cannot use a specialist's tool merely because it manages the team.

Remove unnecessary authorizations, review external side effects, keep credentials in protected tool configuration, and test each tool independently.

Output contracts

Advanced configuration can require structured output through JSON Schema. If a response does not match the contract, the run is marked partial and the violation remains traceable instead of returning apparently valid structured data.

Best practices

• Separate specialists by responsibility and least privilege.
• Never place secrets in instructions or test requests.
• Review knowledge access when an agent role changes.
• Deactivate teams that should no longer receive traffic.
• Investigate through traces instead of temporarily expanding permissions.