In June 2026 the Cloud Security Alliance published a blog post with a deceptively plain title: "Securing the Swarm." Written by Sunil Gentyala, a cybersecurity and AI security consultant at HCLTech, it brought a concept from classical computer security into a new context — the "Confused Deputy Paradox."
The original confused deputy problem described an operating system flaw where a program with high privileges could be tricked into performing operations on behalf of a lower-privileged caller. Gentyala applies the same logic to multi-agent AI: "The primary flaw in modern autonomous design is the lack of strict operational separation between the agent's execution authority and the caller's verified privilege tier. The agent acts as a privileged proxy, which means it unknowingly leverages its high-level backend network access to execute malicious requests on behalf of unauthenticated external triggers."
Multi-agent governance is the set of policies, enforcement mechanisms, and runtime controls that govern how autonomous AI agents communicate with, delegate to, and trust one another within a multi-agent system. Unlike single-agent governance — which monitors what one agent does — multi-agent governance addresses what happens at the boundaries: between agents, between orchestrators and sub-agents, and between the agent mesh and the external world.
In 2026, the field has largely treated governance as a per-agent problem. Instrument each agent. Set a budget. Log the outputs. But a collection of individually governed agents is not a governed collection.
The Trust Assumption Hidden in Every Multi-Agent Stack
Most agent orchestration frameworks — LangGraph, CrewAI, AutoGen, and their successors — wire agents together through message-passing. Agent A completes a task and passes a structured result to Agent B. Agent B, designed to reason about that result, does exactly that. The problem: Agent B has no mechanism to verify the trustworthiness of what Agent A produced. It has no way to know whether Agent A hit a policy violation, hallucinated a fact, or received an injected instruction from a malicious data source. It simply processes what it receives.
A May 2026 post on swarm management from Arize AI names this gap clearly: "The boundary belongs in the control plane. The model can request a spawn. The runtime decides whether it is legal. The runtime should know how deep the child is, how many children the parent already owns, which tools are denied to this role, and whether the child can create more children." This is architectural clarity about where enforcement should sit. The problem is that most teams don't implement it — because their governance stack doesn't reach across agent boundaries.
The OWASP Top 10 for Agentic Applications names this risk category ASI03: Identity & Privilege Abuse. Summarising it, Gentyala writes that in multi-agent meshes systems "frequently inherit authorization scopes or make dangerous trust assumptions regarding peer communications," and that without mutual cryptographic authentication at the agent-to-agent interface a lower-tier agent could spoof a high-privilege orchestration agent, "leading to unauthorized data exfiltration or vertical privilege escalation."
How Cascades Propagate
A cascade in multi-agent AI systems follows a predictable structure. It starts with a failure state in one agent — a hallucination, a scope violation, a prompt injection — that goes undetected. That failure becomes the input to a downstream agent, which processes it as valid data. If the downstream agent is a decision-maker, it produces decisions based on false premises. If it's a tool-caller, it executes those decisions against real systems.
Research on inter-agent trust dynamics puts a number on the tradeoff. A June 2026 preprint (arXiv:2606.14923, not peer reviewed) measured trust as reduced verification in a cooperative survival game. Across six frontier model snapshots, four — Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.1 and Gemini 3.1 Pro — cut verification of a consistently reliable teammate's work by roughly 60–85%, while two smaller snapshots showed little or no such adjustment. This is the governance problem in numerical form: trust accelerates workflows by reducing the overhead of cross-checking, and that same reduction in verification is what makes cascades possible. When the teammate fails, the verification discount reverses — but models differ in how they recover. Some increase scrutiny only toward the failing agent; others become cautious toward the entire team indiscriminately. The point isn't that agents shouldn't trust each other. It's that trust in multi-agent systems needs to be governed, not assumed.
Three specific cascade patterns are most common in production deployments:
Hallucination amplification. Agent A synthesizes a report containing a factual error. Agent B, a downstream summarizer, treats that report as ground truth. Agent C, an action agent, takes a business decision based on Agent B's summary. By the time the error surfaces — in a customer deliverable, a financial record, a database write — it has been processed and validated by multiple agents, each of which had no mechanism to question its predecessor. The error has compounded at every step.
Privilege escalation through delegation. In systems where agents can spawn child agents or delegate tool calls, a lower-privilege agent can escalate its effective permissions by routing a request through a higher-privilege neighbor. The CSA describes this as a "confused deputy" at the agentic layer: the orchestrator acts as a privileged proxy for whoever — or whatever — sends it instructions, including injected instructions that arrived from untrusted external data sources.
Token budget burns across agent trees. Multi-agent loops that encounter an error state don't always fail cleanly. They can enter retry cycles, re-delegating tasks across the agent tree while consuming token budget at every level. Organizations typically discover this failure mode on the billing invoice, not in their observability dashboard.
Why Per-Agent Governance Misses the Handoff
Tools in the AI observability and evaluation category are built to show what happened inside a run — the model calls, the retrievals, the tool use, the cost. Arize Phoenix, for instance, describes tracing as letting you "see what happened during a single run of your AI application, step by step." These are necessary instruments. Governing a multi-agent system asks a different question: not what an agent did, but what the next agent should be allowed to do with it.
Multi-agent governance requires visibility and enforcement at the handoff layer. Specifically:
Attribution across agent trees. When a cascade failure occurs, which agent initiated it? Which agents amplified it? Standard per-agent tracing shows each agent's execution log in isolation. A multi-agent governance system maps the full delegation graph — who called whom, what was passed, and which enforcement points were (or weren't) crossed.
Trust boundary enforcement at each handoff. Every delegation between agents should be a policy evaluation point. Does the receiving agent have the authority to act on this input? Is the input within the trust scope the sender is allowed to produce? Has the sender been flagged for a policy violation during this session? Single-agent governance has no view across these boundaries. It can tell you what Agent A did. It cannot tell you whether Agent B should have trusted Agent A.
Recursive depth and spawn limits. Agents that can spawn child agents introduce an exponential risk surface. Without recursive depth limits enforced at the coordination layer, an agent tree can grow without bound — burning budget, accumulating tool call permissions, and propagating any initial error across an arbitrarily large execution graph. This is precisely the "how many children the parent already owns" problem Arize names in that post. Most teams don't enforce it.
How Waxell Handles This
Waxell addresses multi-agent governance through a layered product approach built around its policy engine, coordination mesh, and governed execution environment.
Waxell Observe instruments Python agent code with two lines and auto-instruments 200+ Python libraries — LangChain, CrewAI, AutoGen, LlamaIndex, Semantic Kernel, and others. Where single-agent tools trace individual runs, Observe captures the full delegation chain: which agent spawned which, what was passed at each handoff, and which policy evaluations fired at each transition. Delegation and Identity are two of its published policy categories. The result is attribution across the full agent tree, not just per-agent logs.
Waxell Runtime is the build path for workflows where a cascade would be expensive. Runtime governs agents built with the Waxell SDK — it is not a drop-in enforcement layer for an existing LangGraph or CrewAI stack, and agents already running on those frameworks belong with Observe. For a new workflow built on Runtime, policy enforcement fires before each step rather than after, with kill switches at the agent, workflow and session level. Durable checkpointing means a stopped cascade doesn't mean lost work; it means a controlled halt with a full audit record and a defined resume path once the condition is resolved. This is governance native to the execution environment, not layered on top afterward.
Waxell Connect provides the coordination mesh that gives agents their operational context: shared workspaces, versioned files, playbooks, and a live agent presence roster with declared skills. When agents operate within Connect, their identity and scope are explicit rather than inferred. This is a governance primitive — trust boundaries become declared properties of the agent mesh, not assumptions embedded in each agent's system prompt.
The goal isn't to slow down agent coordination; it's to make trust boundaries visible and enforceable without the months of custom engineering that rebuilding these controls from scratch would require.
Originally published on the Waxell blog.
Start with Waxell Observe — pip install waxell-observe and two lines of Python give you the full cross-agent execution tree before your next deployment. For a new workflow where being wrong is expensive, Runtime is the build path. Start free with Waxell Observe.
FAQ
What is multi-agent governance?
Multi-agent governance is the set of policies, enforcement mechanisms, and runtime controls that govern how autonomous AI agents coordinate, delegate, and trust one another within a multi-agent system. Unlike single-agent monitoring — which tracks what one agent does — multi-agent governance addresses the boundaries between agents: what each agent is authorized to pass to another, which agents can spawn sub-agents, and how cascade failures are detected and stopped before they propagate through the full agent tree.
What is a hallucination cascade in multi-agent AI?
A hallucination cascade occurs when a factual error or fabricated output from one agent in a multi-agent stack is accepted as valid input by downstream agents, which then reason and act on it without cross-verification. Because most agent coordination frameworks do not include trust validation at the handoff layer, a single hallucination can propagate through multiple agents and compound at each step before surfacing in a final output or action.
What is the "Confused Deputy Paradox" in AI agents?
The Confused Deputy Paradox, as applied to multi-agent AI systems by the Cloud Security Alliance in June 2026, describes the structural flaw where an agent with high system privileges acts as a proxy for lower-privileged callers — executing requests on their behalf without verifying the caller's authorization. In multi-agent architectures, this allows a compromised or manipulated sub-agent to escalate its effective permissions by routing requests through a higher-privilege orchestrator, which executes them without validating the request's origin or legitimacy.
Why don't standard observability tools catch multi-agent cascade failures?
Observability and evaluation tooling is designed to show what happened inside a run — model calls, retrievals, tool use, cost — and that is what most teams have instrumented. Cascade failures originate somewhere else: at the handoff, where one agent accepts another's output as valid input. Catching them requires policy evaluation and a durable record at the delegation boundary, not only within each agent's execution span. Check what your own stack enforces at that boundary rather than assuming the tracing layer covers it.
What is OWASP ASI03 and why does it matter for multi-agent systems?
ASI03 is the third risk in the OWASP Top 10 for Agentic Applications (2026): Agent Identity and Privilege Abuse. It addresses the specific risk that agents in multi-agent meshes inherit excessive authorization scopes or make unverified trust assumptions about peer communications. Without explicit identity verification at each agent-to-agent handoff, a lower-tier agent can spoof or exploit the permissions of a higher-privilege orchestrator.
How is Waxell Observe different from single-agent tracing tools for multi-agent systems?
Waxell Observe traces full agent execution trees rather than individual spans: parent-child relationships are detected automatically, and session and context propagate through nested calls without manual wiring. Delegation and Identity are two of its published policy categories. This gives engineering teams cross-agent attribution rather than isolated per-agent logs.
Sources
Gentyala, S. (2026, June 24). Securing the Swarm: Governance, Attack Surfaces, and Zero-Trust Architectures in Multi-Agent AI Environments. Cloud Security Alliance. https://cloudsecurityalliance.org/blog/2026/06/24/securing-the-swarm-governance-attack-surfaces-and-zero-trust-architectures-in-multi-agent-ai-environments
Woodruff, J. (2026, February 2). The Agentic Trust Framework: Zero Trust Governance for AI Agents. Cloud Security Alliance. https://cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trust-framework-zero-trust-governance-for-ai-agents
Sotiropoulos, J., Katz, K., & Del Rosario, R. F. (2025, December 9). OWASP Top 10 for Agentic Applications — The Benchmark for Agentic Security in the Age of Autonomous AI. OWASP GenAI Security Project. https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/
Dhinakaran, A. (2026, May 4). Swarm management in agent harnesses: owning long-running agents. Arize AI. https://arize.com/blog/swarm-management-of-agent-harnesses/
Arize AI. What is agent orchestration? Frameworks, runtimes, and observability explained. https://arize.com/blog/what-is-agent-orchestration-frameworks-runtimes-and-observability-explained/
Chen, Y. (2026, June 12). Trust Between AI Agents: Measuring Formation, Breakage, and Recovery, with Implications for Governing Multi-Agent Systems. arXiv:2606.14923. https://arxiv.org/abs/2606.14923
Top comments (0)