When to reach for it
- Specialists must be encapsulated.
- The main agent must retain absolute control.
- Security boundaries must be strictly separated.
Agents-as-Tools.
Call a specialist like any other tool.
One orchestrating agent calls other agents exactly like tools, hiding their internal logic and coordination behind a standard tool interface.
When it backfires
- Equal cooperation is needed.
- Specialists require long-term autonomy.
- Interface contracts are unstable.
The tradeoff
Excellent encapsulation is achieved against limited independence for the sub-agents.
A shape you can draw on a napkin.
A caller agent invokes a tool-agent through a standard tool interface. The embedded-agent semantics are hidden behind the call.
Two ways this pattern will hurt you.
Tool-agent latency is invisible to the caller
The caller treats the tool-agent as instant, but it runs a full internal loop. Timeouts fire before the tool-agent finishes.
Fix · Expose expected latency in the tool schema. Use async callbacks or streaming for long-running tool-agents.
Tool-agent failures surface as generic tool errors
The tool-agent throws an internal exception, but the caller only sees 'Tool execution failed.' Debugging requires tool-agent logs.
Fix · Return structured error payloads with a trace_id. Route the caller to a diagnostic node that can fetch and display the full trace.
Threat exposure
What this pattern exposes
Adopting this pattern opens these attack surfaces. Each links to its entry in the threat model.
Full threat model →Where Agents-as-Tools is native.
AWS StrandsNative
OpenAI Agents SDKNative
LangGraphNative
Microsoft Agent FrameworkNative
Google ADKNative