The Big Picture
A three-layer verification approach that checks intent, allowed actions, and output formats can detect, contain, and fully reconstruct malicious or incorrect AI handoffs in federal multi-agent workflows.
ON THIS PAGE
The Evidence
A formal delegation model with seven enforceable properties ties who has authority, what the agent intended, and what policies apply to each handoff. A trusted runtime service enforces those properties with three checks—intent filtering, scope-action enforcement, and output-schema validation—and maps them to federal controls for audit and compliance. Tested on 516 government-style scenarios, the combination blocked every attack in the benchmark with zero false positives. Intent checking alone is probabilistic, but its gaps are covered by the other two layers and by formal guarantees that bound damage when any single property is evaded. handoff pattern
Not sure where to start?Get personalized recommendations
Data Highlights
1516 federal-style scenarios evaluated: the combined lifecycle (intent + scope + output checks) achieved 100% true positive rate at 0% false positive rate.
2Fine-tuning the intent model on 190 government delegation examples improved intent detection from 1.7% to 88.3% true positive rate (F1 = 82.1%, 5-fold cross-validation).
3Eroding a single security property reduces attacker capability by ~90.9%—an adversary can reach at most 1/11 of the unconstrained actions when one property is bypassed.
What This Means
Engineers building multi-agent systems for government or regulated industries will find a practical runtime that enforces delegation bounds and produces audit trails. Security and compliance leaders can use the mapping to federal controls to meet audits and trace who authorized each access. Architects planning agent-to-agent integrations can adopt the three-layer lifecycle to reduce blast radius and speed forensic reconstruction.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreYes, But...
Intent verification is inherently probabilistic and can be evaded by clever paraphrasing, so it should be treated as an early-stop filter rather than a sole defense. The Delegation Authority Service is a central trust point; it needs hardened key management, replication, and monitoring because its compromise voids guarantees. Scope manifests and output schemas require ongoing maintenance and cannot fully detect misuse of permitted APIs or subtle biased content inside allowed output types. Context Drift
Methodology & More
A formal Delegation Chain Calculus models each agent handoff as a token that carries authority scope, an intent vector, policy constraints, parent linking, expiry, and a signature. Seven properties—authority narrowing, intent preservation, policy conjunction, forensic traceability, bounded cascade containment, scope-action conformance, and output-schema conformance—are defined and mechanically checked where deterministic. A Delegation Authority Service enforces the runtime protocol with three verification layers: keyword/context intent checks, enforcement of a tool manifest at call time, and post-execution output schema validation. A compliance mapping engine connects the model to 20 federal security controls and 10 risk categories so enforcement directly supports audits. Planning Pattern and three verification layers anchor the design and governance mappings; the approach aligns with broader compliance goals and consensus-based decision pattern. Evaluation used DelegationBench v4 (516 scenarios) plus formal model checking (2.7M states) and a live prototype. The three-layer lifecycle caught every attack in the benchmark with zero false positives; fine-tuning the language inference model on 190 example delegations greatly improved intent detection (1.7% → 88.3% TPR). Meta-results show each property is necessary, damage is bounded if any single property is evaded, and composed chains remain safe with write-impact notification. Practically, the approach yields traceability, bounded blast radii, and audit-ready tokens for federal multi-agent deployments—but it requires DAS hardening, manifest/schema maintenance, and future extensions for consent handling and deeper semantic content checks.
Avoid common pitfallsLearn what failures to watch for
Credibility Assessment:
Single-author ArXiv preprint with no affiliation or h-index provided. Lacks identifiable institutional or reputational signals -> unknown.