Authority checks improve safety in multi-agent workspace updates
Beyond Agent Harnesses: Cross-Substrate Authority for Multi-Agent Systems
Multiagent SystemsSoftware Engineering
Summary
When multiple computer programs (agents) work together, they often change shared files or data. The paper shows that important permission information is sometimes kept separate from what the agents can see, which can cause unsafe behaviors. The authors run experiments comparing methods that keep permission info visible to the agents versus checking permissions only right before changes happen. They find checking permissions at the last moment stops errors better, making the whole system safer.
What this means in practice
- •For software development teams: Prevent unsafe code or configuration updates by enforcing permission checks at commit time rather than during planning steps.
- •For devops engineers: Improve automation safety by placing execution-time authority guards around deploy or publish operations in multi-agent pipelines.
Authors
Yang Li, Sergey Volkov, Hai Liu, Zongsi Xu, Xiyu Chen, Tuo Zhou, Dian Shao, Hao Sun, Ye Lu
Abstract
Agentic systems persist model-visible memory while mutating workspaces, while a runtime, registry, or approval service may hold authority state outside both. Identical final files can then require opposite safe actions. We call this the cross-substrate authority gap: decision- relevant authorization information resides outside the planner-visible workspace or memory state. Across two controlled mini-benchmark families, three experiments compare planner-observation augmentation with an execution-time authority check using real Git lineage, durably recorded agent execution attempts, deterministic oracles, and two model routes. Experiment 1 is a 128-cell controlled evidence ablation: authority-blind candidate evidence obtains 0/32 final semantic success, while raw receipts and a typed relation both obtain 32/32. The missing authority fact accounts for the gain; typed packaging provides no observed planning-accuracy gain over equal raw information. Experiment 2 uses 96 planning calls: workspace-visible evidence yields 12/16 unsafe publication decisions, and planning with the typed relation remains unreliable (15/32 first actions correct; 11/32 invalid or absent). Experiment 3 replays the same 32 fixed model-generated first-action intents with zero additional model calls; a deterministic execution guard prevents all six unsafe intents from becoming effects and permits all 12 valid authorized publish intents. These results position authority enforcement at the mutation boundary as the operational endpoint of memory governance.