Congratulations, everyone now has a new job: agent auditor.

The most interesting part of the AgentFlow paper is not that it invents another workflow framework, but that it treats agent programs as a new software supply chain for diagramming.

Previously, code auditing mainly involved checking whether function A called function B.

Now the paths to examine are more troublesome:

Which prompt the user input entered;

Which agent the prompt affects;

Who the agent can hand over to;

Whether shared memory will carry dirty context;

Finally, which tool can write files, send emails, and run commands.

This is what it calls the Agent Dependency Graph.

Lately, I have come to understand this more and more. Opening multiple instances of Codex, Claude, and Cursor is meaningless in itself; what really needs to be managed is each worker's permission boundaries and writeback paths:

What it can read;

What it can write;

What it can call;

When it comes to publishing, deploying, wallets, and production environments, where are the gates;

Where the evidence is written back after it’s done.

Otherwise, the so-called multi-agent workflow will quickly become a bunch of dialog windows that look busy, but no one knows who touched what.

Paper: AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs