Agent orchestration
Ajan orkestrasyonu
D3
Agent orchestration is the coordination of which agents run in an application, in what order, and how their next actions are chosen.
Review status: 2026-12-04
Technical explanation
The flow can be determined by application code or by an LLM. In documented multi-agent patterns, one agent can call another as a tool or hand control to another agent.
Conceptual boundaries
Orchestration is workflow coordination, not a proof of autonomy, reliability, domain competence, or correct delegation.
Provider-neutral example
A research workflow routes a retrieval request to a search tool, asks a model to summarize returned evidence, logs the trace, and sends high-impact claims to human review.
Limitations
Prompt injection through user input or retrieved content can redirect a generative AI system’s behavior; coordinating agents does not itself establish protection against that risk.
Related concepts
Atomic claims and evidence
1.1OpenAI Agents SDK, Agent Orchestration
- Source
- OpenAI Agents SDK, Agent Orchestration
- Source role
- Authoritative source
- Exact locator
- Overview: flow of agents and next-action decisions
- Supported claim
- OpenAI defines agent orchestration as the flow of agents in an application, including which agents run, in what order, and how the next action is decided.
- Last verification
- Review due
- Scope limitation
- This is an SDK-specific workflow-design description, not evidence that an orchestrated system is autonomous, reliable, competent, or correct.
2.1NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
- Source
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
- Source role
- Authoritative source
- Exact locator
- Printed pp. 13-14: direct and indirect prompt injection
- Supported claim
- NIST identifies prompt injection as an attack in which input is modified so a generative AI system behaves in unintended ways, including indirect attacks through retrieved data.
- Last verification
- Review due
- Scope limitation
- This is a threat description; it does not imply that every orchestrated workflow is compromised.
2.2OWASP GenAI Security Project, LLM01:2025 Prompt Injection
- Source
- OWASP GenAI Security Project, LLM01:2025 Prompt Injection
- Source role
- Authoritative source
- Exact locator
- LLM01:2025 Prompt Injection risk overview
- Supported claim
- NIST identifies prompt injection as an attack in which input is modified so a generative AI system behaves in unintended ways, including indirect attacks through retrieved data.
- Last verification
- Review due
- Scope limitation
- This is a threat description; it does not imply that every orchestrated workflow is compromised.
3.1OWASP GenAI Security Project, LLM01:2025 Prompt Injection
- Source
- OWASP GenAI Security Project, LLM01:2025 Prompt Injection
- Source role
- Authoritative source
- Exact locator
- LLM01:2025 Prompt Injection risk overview
- Supported claim
- OWASP's 2025 prompt-injection risk entry independently treats prompt injection as a material LLM-application security risk.
- Last verification
- Review due
- Scope limitation
- OWASP risk guidance is not a probability estimate for a particular system or configuration.