Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems

arXiv:2610.00371v1 Announce Type: cross Abstract: Multi-agent systems derive their capabilities from sharing evidence, delegating tasks, and combining information across agents. The same process creates a safety problem: contributions that are admissible in isolation can jointly enable a prohibited use. Blocking every sensitive action avoids disclosure but defeats the purpose of collaboration. We introduce authorization-paired evaluation, which makes blocking prohibited uses and completing required authorized uses a joint success criterion, and FlowReview, a framework connecting object resolution, permission ranking, and deterministic enforcement. In controlled composition experiments, reviewing combined artifacts reduces the denied-commit rate from 86.0% to zero with no loss of authorized supply. Our findings show that preserving information and lineage alone does not ensure correct permission attribution. Object identity and permission must remain connected to execution through components whose outputs can be verified. Together, these findings establish a system-level requirement for multi-agent safety: govern composed information flows while preserving the authorized capabilities that make collaboration useful.

Related

• Seven Security Challenges That Must be Solved in Cross-domain Multi-agent LLM Systems
• Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
• From Agent Traces to Trust: Evidence Tracing and Execution Provenance in LLM Agents
• Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems
• Agent Memory Is a Surface for Endogenous Authorization Laundering

Source: arXiv cs.AI | 2026-10-02