Before your multi-agent architecture gets too entangled to refactor:
Who owns observability? When an agent makes a bad decision, can you trace why? Do you have logs of what context it held, what it retrieved, what it mutated? Without this, debugging is archaeology.
How is access controlled? An agent that can retrieve any context and mutate any state is a liability. Agent-to-agent calls and agent-to-tool calls need the same access controls you'd apply to any API: authentication, authorization, rate limiting.
Where does context cross trust boundaries? Some context is internal. Some comes from external systems. Some involves user data with compliance implications. The path that context travels through your agent graph is the path that needs security scrutiny.
What's your failure model? Multi-agent workflows fail in non-obvious ways. A single failed retrieval can cascade. A mutation that partially succeeds and partially fails can corrupt state. Design for failure, not just the happy path.