Encrypted agent messages need local audit trails for debugging

A developer working with OpenAI's encrypted MultiAgentV2 message system raised concerns about how encryption impacts debugging multi-agent workflows. The core issue is that when a parent agent delegates work to a subagent, the encrypted delivery hides the intermediate instructions and work steps from the developer. While the parent agent's final diff output may be readable and even pass tests, the developer cannot see what the child agent was actually asked to do.

This creates a debugging blind spot. When something goes wrong, the developer faces three possible failure modes: the parent agent may have formulated the task incorrectly, the child agent may have ignored or misunderstood the task, or the system may have routed the correct instruction but removed or hidden the useful intermediate work. Each failure requires a different fix, but without visibility into what the child actually received, the developer is left guessing.

The developer acknowledges legitimate reasons for encrypted message delivery in hosted systems—protecting message contents from exposure in multi-tenant cloud environments has real security value. However, for agents running against a developer's own repository or machine, the balance shifts. They propose storing a local human-readable audit copy: a plain-text log written to disk that documents what instructions each agent received and what work it performed. This audit copy would not need to be exposed to the model itself, nor would it need to be sent to an external service. It would exist purely for human inspection on the developer's own hardware, allowing them to trace the actual chain of delegation and identify where the failure occurred.

The concern arises from OpenAI's encrypted MultiAgentV2 message system, which protects message contents in hosted environments. However, the encryption creates a blind spot for developers debugging multi-agent workflows where a parent agent delegates work to subagents. The body frames three distinct failure modes—incorrect task definition, task ignorance, and routing errors with hidden intermediate steps—each requiring different fixes. Without visibility into what the child agent was actually asked to do, developers lose the diagnostic information needed to locate the root cause. The proposed solution respects the encryption's legitimate purpose (protecting hosted system message contents) while carving out a local audit trail that remains under the developer's direct control, readable only on their own infrastructure and not transmitted or exposed to the model.