Most multi-agent demos celebrate the moment the agents agree. Get a swarm of agents, get them to a consensus, and act on it. Ship.
But agreement isn't permission. A fluent, confident group of agents can talk itself into something irreversible and feel great doing it. The dangerous failure of an "agent society" isn't disagreement. It's collective overconfidence.
So for the Qwen × Devpost Agent Society hackathon, I built Quorum: a council of Qwen agents that debates every consequential action with a deterministic guardrail on top that treats a unanimous vote as the start of the safety question, not the end.
Live demo: https://quorum-sandy-omega.vercel.app · Code: https://github.com/yanzaaa/quorum
Quorum — the live deliberation chamber.
The idea on one screen
A back-office autopilot gets a queue of decisions: refunds, discounts, wires, a database deletion, and a $12,000 vendor payment. For each one, three agents deliberate:
A Proposer that argues for the action,
A Skeptic that hunts for fraud, missing authorization, and abuse,
A Referee that votes last, after hearing both, and can be talked out of a position.
Then a fixed rule decides. And the punchline of the whole project: a fully-approved, no-red-flags $12,000 payment that all three agents vote to execute is still held back because it's irreversible. A unanimous council doesn't get to pull a trigger you can't undo. Consensus is necessary, but it's never, by itself, enough.
All three agents approve the $12,000 payment — and the guardrail still holds it back, because it's irreversible.
Building on Qwen Cloud
The three agents all run on Qwen (qwen-max) through Alibaba Cloud's DashScope endpoint, which is OpenAI-compatible, so wiring it up took about five lines:
// lib/qwen.ts
import OpenAI from "openai";
const QWEN_BASE_URL =
process.env.QWEN_BASE_URL || "https://dashscope-intl.aliyuncs.com/compatible-mode/v1";
export function qwenClient() {
const apiKey = process.env.DASHSCOPE_API_KEY;
if (!apiKey) return null; // key-free deterministic fallback so the demo never crashes
return new OpenAI({ apiKey, baseURL: QWEN_BASE_URL });
}
Each action fires four to five calls at temperature: 0 with structured JSON output: Proposer + Skeptic in parallel, a rebuttal round when they disagree, the Referee on the full transcript, and a lone-agent baseline. Qwen-max was genuinely good at the part that mattered, reading an action and spotting why it's risky (an emailed invoice from a brand-new vendor = textbook fraud) versus why it's fine (a signed contract with dual approval). The reasoning quality is what makes the debate believable.
The council deliberates live — votes land one at a time, and the Proposer can change its mind after the Skeptic.
_
The part that makes it safe: a one-way ratchet
The agents are smart, but I didn't want to trust them to be right. So the final decision isn't the vote, it's a deterministic guardrail that runs on top of the votes:
// the guardrail can only ever make the outcome SAFER, never riskier
if (rawOutcome === "execute") {
const highStakes = action.stakes === "high";
const irreversible = !action.reversible;
// stakes + reversibility come from the TRUSTED action record — never from model output
if (lowConfidence || highStakes || irreversible || blockingFlag) {
return { outcome: "escalate", heldBack: true }; // unanimous, but still held back
}
return { outcome: "execute" };
}
How it runs on Qwen Cloud — a stateless three-agent service, no database; the guardrail runs in the backend.
_
The key design choice: stakes and reversibility are read from the trusted action record, not from anything the model says. A confidently wrong agent can add restraint (raise a flag) but can never remove it. That's the one-way ratchet — and it's why the $12k payment is reliably held back no matter how enthusiastically the agents approve it.
The subtle bug I had to fix to make this work: at first, my Skeptic was told to reject anything irreversible, which front-ran the guardrail, so the council rarely reached a unanimous approval on an irreversible action, and the signature "held back despite consensus" moment wouldn't fire. The fix was a clean separation of duties: the agents judge legitimacy (fraud, authorization, harm); the guardrail owns irreversibility and stakes. Once I drew that line, the whole system got more coherent — and the money moment fires every time.
Proving the council actually adds something
It's easy to claim a council is "safer." I wanted a number. So every action also runs against a single lone agent, helpful, no oversight, and the UI shows what that agent would have done. On the demo queue, the lone agent executes actions, but the council stops cold. That's the measurable gain over a single agent, shown honestly rather than asserted.
The single-agent baseline next to the council's outcomes.
What I learned
In an agent society, the right question isn't "did they agree?" It's "is agreement enough? Encoding that as a deterministic ratchet keyed off a trusted record turned out to be far more robust than any prompt, and it composes cleanly with the soft, emergent layer where the agents actually argue and change each other's minds.
Qwen-max carried the reasoning; the architecture carried the safety. That split is the whole project.
Try it: https://quorum-sandy-omega.vercel.app Code: https://github.com/yanzaaa/quorum Watch the 3-min demo: https://youtu.be/JKiPYT1c7dM
Built solo with Qwen Cloud for the Qwen × Devpost Agent Society hackathon.
Top comments (0)