ACP in Multi-Agent Systems

How agents discover each other, establish trust, and communicate reliably at scale — and why your manifest quality matters more in multi-agent than single-agent setups.

Why Multi-Agent Systems Break Without ACP

A single-agent app is simple: you know what it can do, how to call it, and what it returns. As soon as you add a second agent — or a third, or a hundred — the coordination problem explodes.

Without a standard like ACP, each agent integration requires custom code. The orchestrator needs hardcoded knowledge of every worker's API shape. When a worker updates its parameters, the orchestrator breaks silently. New agents can't be discovered without manual registration.

ACP solves this by making agent capabilities machine-readable and self-describing. An orchestrator that understands ACP can discover a new agent, understand what it does, verify its readiness score, and start calling it — without human configuration.

Common Multi-Agent Architectures

Orchestrator → Worker

A central orchestrator agent parses task requests and delegates subtasks to specialized worker agents. The orchestrator uses ACP manifests to discover what each worker can do and how to call it.

// Orchestrator reads worker manifests to plan task routing
const workerCapabilities = await fetchManifest(workerUrl);
const matchingAction = workerCapabilities.actions.find(
  a => a.name === "extract_entities"
);
if (matchingAction) {
  await callAgent(workerUrl, "extract_entities", { text: input });
}

ACP benefit: Without ACP, the orchestrator needs hardcoded knowledge of every worker. With ACP, it discovers capabilities dynamically and adapts as workers evolve.

Peer-to-Peer Agent Mesh

Agents discover and call each other directly without a central coordinator. Each agent publishes an ACP manifest; others query a registry to find the right collaborator for a given task.

// Agent registry lookup pattern
const agents = await registry.search({ tags: ["data-analysis", "csv"] });
const bestMatch = agents.sort((a, b) => b.readinessScore - a.readinessScore)[0];
await bestMatch.invoke("analyze_dataset", { fileUrl: dataUrl });

ACP benefit: ACP manifests carry tags, capability descriptions, and authentication requirements — giving the registry enough signal to match agents to tasks without human configuration.

Human-in-the-Loop Agent

An AI agent handles most requests autonomously but escalates decisions above a confidence threshold to a human. ACP clarifies which actions require approval and what parameters they accept.

{
  "name": "approval-required-action",
  "description": "Sends a financial transfer. Requires human approval above $500.",
  "parameters": { ... },
  "safety": {
    "requiresHumanApproval": true,
    "approvalThreshold": { "field": "amount", "above": 500 }
  }
}

ACP benefit: Safety guardrails in the ACP manifest tell orchestrators and humans exactly where human oversight is needed — no code inspection required.

Agent Trust Levels

Multi-agent systems need to make trust decisions fast. ACP manifests signal trust requirements explicitly so orchestrators can gate access appropriately.

🌐Public

Open to any caller. Suitable for read-only data tools, public search agents, and informational services.

No auth in manifest, or auth.type: none

e.g. Weather agent, news summarizer, public database lookup

🔑API Key

Requires a shared secret. Good for paid services, rate-limited tools, and semi-trusted integrations.

auth.type: apiKey in manifest

e.g. WebSnap API, LLM pricing API, enrichment services

🛡️OAuth

Full delegated authorization. User-scoped access with token expiry. For agents that act on behalf of users.

auth.type: oauth2 with scopes declared

e.g. Calendar agent, email agent, CRM update agent

🔒Internal

Private agent, not in public registries. Trust is established out-of-band (VPN, service mesh, mTLS).

visibility: internal in manifest

e.g. Internal DB query agent, proprietary pipeline step

Production Manifest Example

A well-structured manifest that earns a high readiness score in multi-agent environments. Note the complete action schema, auth declaration, rate limits, and safety policy.

{
  "name": "document-summarizer",
  "description": "Reads a URL or raw text and returns a structured summary with key points, entities, and sentiment.",
  "version": "2.1.0",
  "tags": ["nlp", "summarization", "document-processing"],
  "homepage": "https://agents.example.com/summarizer",
  "auth": {
    "type": "apiKey",
    "in": "header",
    "name": "x-api-key"
  },
  "rateLimit": {
    "requestsPerMinute": 60,
    "requestsPerDay": 10000
  },
  "actions": [
    {
      "name": "summarize_url",
      "description": "Fetches a URL and returns a structured document summary. Supports HTML pages, PDFs, and plain text.",
      "parameters": {
        "type": "object",
        "properties": {
          "url": {
            "type": "string",
            "description": "The URL of the document to summarize"
          },
          "maxPoints": {
            "type": "integer",
            "description": "Maximum key points to return (default: 5, max: 20)",
            "default": 5
          },
          "language": {
            "type": "string",
            "description": "Output language ISO code (default: en)",
            "default": "en"
          }
        },
        "required": ["url"]
      },
      "returns": {
        "type": "object",
        "properties": {
          "summary": { "type": "string" },
          "keyPoints": { "type": "array", "items": { "type": "string" } },
          "entities": { "type": "array" },
          "sentiment": { "type": "string", "enum": ["positive", "neutral", "negative"] }
        }
      }
    }
  ],
  "safety": {
    "contentPolicy": "No PII storage. Documents are processed in-memory and not retained.",
    "dataRetention": "none"
  }
}

✓ Complete action schema✓ Auth type declared✓ Rate limits documented✓ Returns schema defined✓ Safety policy present

Validate Your Agent for Multi-Agent Deployment

Run your manifest through ACP Watchtower to get a readiness score, fix missing fields, and generate a shareable hosted report for your team.

Validate your manifest →Read the validation guide