Build a Cross-Tool Agent Handoff Workflow with the DeepJudge Agent Handoff Protocol

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Introduction

On August 13, 2026, DeepJudge released the Agent Handoff Protocol (AHP) — an open standard for moving users and their context between AI products. The announcement landed with two heavyweight endorsements: Harvey plans to build an integration and enter beta this month, and Thomson Reuters says it will support the effort. The pitch is deliberately simple: today, when you start a research task in one AI tool and finish it in another, everything you learned — the documents you read, the claims you verified, the decisions you made — stays behind. AHP exists to make that context portable.

This workflow builds the infrastructure that makes portable handoffs real inside your own stack: a LangGraph handoff engine that packages identity, conversation state, and verified facts into signed context envelopes, registers them with a shared handoff registry, and lets a downstream agent resume the exact same task in a different tool. If you are already cataloguing agent tools and standards, the MCP directory tracks the complementary layer — how an agent calls tools — while this workflow handles how context travels between agents.

What the Agent Handoff Protocol actually standardizes

DeepJudge's protocol answers three questions that every multi-tool workflow trips on:

1. What is the unit of handoff? A portable context envelope — a structured object carrying identity, conversation state, verified facts, and evidence pointers, not a raw chat log.
2. How is it authorized? The sender requests a short-lived, scope-bound credential; the receiver redeems it against a registry that records every transfer.
3. How is it governed? Every envelope carries an expiry policy and an owner, so context that left tool A does not live forever in tool B.

The design choice that matters most: AHP separates user claims from verified facts. A chat log treats "the user said revenue is $2M" and "the audited filing says revenue is $2M" as the same kind of text. AHP does not — claims stay in the transcript, facts go into a verified layer with evidence pointers. That distinction is what makes a handoff trustworthy enough for regulated workflows like legal and finance, which is exactly why Harvey and Thomson Reuters signed on first.

Architecture overview

graph TD
  subgraph Source[Source Agent - Tool A]
    S1[Conversation State] --> S2[Envelope Builder]
    S3[Verified Facts] --> S2
    S4[Identity & Scope] --> S2
    S2 --> S5[Sign & Register]
  end
  S5 --> R[(Handoff Registry)]
  R --> S6[OAuth Token Grant]
  S6 --> T1{Resume Request}
  T1 --> T2[Verify Token & Scope]
  T2 --> T3[Load Envelope]
  T3 --> T4[Rebuild Context]
  T4 --> T5[Downstream Agent - Tool B]

The pipeline has four stages. Stage one — the source agent distills its conversation into an envelope: identity reference, distilled conversation state, verified-fact layer, and evidence pointers. Stage two — the envelope is signed and registered with the handoff registry, which mints a short-lived OAuth-scoped token bound to that envelope. Stage three — the downstream agent redeems the token, and the registry verifies scope and expiry before releasing anything. Stage four — the receiving agent rebuilds its context from the envelope and resumes the task where the source left off.

Part 1 — The envelope schema

.env

HANDOFF_REGISTRY_URL=https://registry.example.com
HANDOFF_SIGNING_KEY_ID=kh_01
HANDOFF_ENVELOPE_TTL_HOURS=24
HANDOFF_SCOPES=context.read,context.write
OAUTH_ISSUER=https://auth.example.com

schemas.py

from pydantic import BaseModel, Field
from typing import Any, List
from datetime import datetime

class Fact(BaseModel):
    claim: str
    evidence: List[str]  # pointers to source docs
    verified_by: str     # tool + user that verified it
    at: datetime

class Envelope(BaseModel):
    envelope_id: str = Field(alias="id")
    owner: str                 # user or tenant the context belongs to
    source_tool: str
    target_scopes: List[str]   # what the receiver may read
    conversation_state: dict = Field(default_factory=dict)
    verified_facts: List[Fact] = Field(default_factory=list)
    evidence_refs: List[str] = Field(default_factory=list)
    expires_at: datetime
    nonce: str                 # replay protection

The conversation_state is a distilled summary — the task goal, completed steps, open decisions — not the raw transcript. The verified_facts list is the layer that survives the handoff with authority: each fact carries its evidence pointers and who verified it. Keeping target_scopes explicit means a general-purpose agent receiving the envelope does not inherit permission to the source tool's entire data store.

Part 2 — The handoff engine

tools.py

import httpx, json, time
from datetime import datetime, timedelta
import hmac, hashlib

REGISTRY = os.environ["HANDOFF_REGISTRY_URL"]

def sign_envelope(envelope: dict) -> dict:
    body = json.dumps(envelope, sort_keys=True, default=str).encode()
    sig = hmac.new(
        os.environ["HANDOFF_SIGNING_KEY_ID"].encode(),
        body, hashlib.sha256).hexdigest()
    return {**envelope, "signature": sig}

def register_envelope(envelope: dict, token: str) -> str:
    r = httpx.post(f"{REGISTRY}/envelopes",
                   json=sign_envelope(envelope),
                   headers={"Authorization": f"Bearer {token}"}, timeout=15)
    r.raise_for_status()
    return r.json()["grant_id"]

def redeem_envelope(grant_id: str, token: str) -> dict:
    r = httpx.post(f"{REGISTRY}/envelopes/{grant_id}/redeem",
                   headers={"Authorization": f"Bearer {token}"}, timeout=15)
    r.raise_for_status()
    return r.json()["envelope"]

The signing step uses an HMAC keyed by the sender's key ID so the registry can verify integrity without the sender storing a second secret. register_envelope returns a grant_id — the receiver never needs to know the envelope's storage location, only the grant. That indirection is the whole security model: the registry is the only party that knows where an envelope lives and who is allowed to open it.

Part 3 — The LangGraph handoff workflow

graph.py

from langgraph.graph import StateGraph, END
from typing import TypedDict, Annotated, List
import operator

class HandoffState(TypedDict):
    task: str
    conversation: dict
    facts: List[dict]
    target_tool: str
    grant_id: str
    resume_context: dict

def distill(s: HandoffState) -> HandoffState:
    s["conversation"] = summarize_conversation(s["task"], s["conversation"])
    s["facts"] = extract_verified_facts(s["conversation"])
    return s

def package(s: HandoffState) -> HandoffState:
    env = build_envelope(s["task"], s["conversation"],
                         s["facts"], s["target_tool"])
    s["grant_id"] = register_envelope(env, request_token())
    return s

def handoff(s: HandoffState) -> HandoffState:
    s["resume_context"] = {
        "grant_id": s["grant_id"],
        "target": s["target_tool"],
        "task": s["task"],
    }
    return s

g = StateGraph(HandoffState)
g.add_node("distill", distill)
g.add_node("package", package)
g.add_node("handoff", handoff)
g.set_entry_point("distill")
g.add_edge("distill", "package")
g.add_edge("package", "handoff")
g.add_edge("handoff", END)
app = g.compile()

main.py

if __name__ == "__main__":
    result = app.invoke({
        "task": "Verify Q3 revenue claims for the board memo",
        "conversation": {"loaded": ["q3_filing.pdf"], "open": ["SaaS vs license split"]},
        "facts": [],
        "target_tool": "harvey-beta",
    })
    print("Grant issued:", result["grant_id"])
    print("Resume context:", json.dumps(result["resume_context"], indent=2))

Retry rules: envelope registration is idempotent — retry with the same nonce up to 3 times with exponential backoff (500ms base, 2x factor), and the registry returns the existing grant on a duplicate nonce. Token acquisition retries are capped at 2 with a short backoff, because an expired credential is a config problem, not a transient blip. Never retry a redeem that returns a scope-denied error — that is a policy violation that should page the owning team, not loop silently. The workflow mirrors the discipline we apply across the AI workflows library: idempotent writes, capped retries, and a hard line between transient failures and policy failures.

Part 4 — Authorization and the trust boundary

The handoff registry issues OAuth 2.0-scoped tokens: context.read to view an envelope, context.write to create one. Tokens are short-lived (15 minutes default) and bound to a single grant, so a leaked token cannot be replayed against the whole registry. The receiving agent's credential is checked against the envelope's target_scopes and the token's scopes — both must allow the read.

What stays out of the envelope is as important as what goes in:

1. Never include API keys, passwords, or raw model reasoning traces.
2. Never include unverified user claims in the verified-fact layer — they stay in the summarized conversation.
3. Always keep sensitive payloads in tenant-scoped storage, referenced by evidence pointers, so the receiver must present its own credential to reach them.
4. Always set an expiry — the registry drops envelopes after their TTL, and downstream agents treat expired grants as missing context, not errors.

This is the same trust architecture enterprises now mandate for agent identity and access — the latest AI news coverage of non-human identity and least-privilege tool access applies directly to cross-tool context, because a handoff token is, in effect, a machine identity that crosses product boundaries.

The production checklist

1. Distill, never dump. The envelope carries a summarized conversation and verified facts, not a raw transcript — raw logs are where tokens and junk claims leak.
2. Register everything. Every handoff is an API call through the registry, which means every resume is auditable. If a handoff is not in the registry, it did not happen.
3. Scope the receiver. The envelope's target_scopes plus the token's scopes both gate the read; a general agent should never inherit the source tool's full access.
4. Set TTLs on everything. Envelopes expire, tokens expire, and downstream agents treat expired grants as missing context rather than errors.
5. Separate claims from facts. Only verified facts carry evidence pointers into the receiving tool; user claims stay in the conversation summary where they cannot be mistaken for truth.
6. Start with one pair of tools. Wire AHP between your two most-used agents first, prove the resume experience and the audit trail, then expand the registry to the rest of your stack. The same staged rollout pattern runs through the AI workflows library.

Frequently Asked Questions

Q: What is the Agent Handoff Protocol and who backs it?

A: The Agent Handoff Protocol (AHP) is an open standard released by DeepJudge on August 13, 2026 for moving users and their context between AI products. Harvey plans to build an integration and enter beta this month, and Thomson Reuters has also said it will support the effort.

Q: Why do agent handoffs need a protocol instead of just copying chat history?

A: Copying raw chat history leaks tokens, loses the distinction between user claims and verified facts, and gives no way to revoke access. AHP packages identity, state, and evidence into envelopes with explicit authorization and expiry, so the receiving tool only sees what it is entitled to.

Q: How does authorization work in a handoff workflow?

A: The sending agent requests a short-lived OAuth 2.0-scoped token bound to the handoff envelope, the registry records the grant, and the receiving agent redeems the token to read the envelope. The registry's audit log makes every resume action traceable.

Q: What should never go into a portable context envelope?

A: Full API keys, passwords, raw model reasoning traces, and unverified user claims. The envelope carries identity references, a distilled verified-fact layer, and pointers to evidence, with sensitive payloads stored behind tenant-scoped storage.

Q: Does the Agent Handoff Protocol replace MCP?

A: No — they are complementary. MCP standardizes how an agent calls tools; AHP standardizes how context travels between agents and products. A workflow uses MCP for tool execution inside each agent and AHP for the handoff between them.

Closing thoughts

The Agent Handoff Protocol is the first serious attempt to make context as portable as models and tools already are. DeepJudge shipped the standard, Harvey and Thomson Reuters gave it enterprise credibility, and the engineering pattern — distill, package, register, redeem — is now repeatable in any stack. The teams that adopt it early will be the ones whose agents can actually hand work to each other instead of making users start over. Build the envelope discipline now, keep the registry audited, and your multi-tool workflows will finally feel like one system. Track more standards and agent patterns like this one in the MCP directory and on the AI workflows hub.