Abstract
Abstract (Part 1 of 27)
Safe Multi-Agent Planning: Agree, Freeze, Then Get Independent Approval Before Acting
Cross-organization autonomous agents and agentic AI systems must negotiate joint plans across independent administrative domains, yet conventional multi-agent orchestration and messaging leave the jointly evaluated state unstable. Messages remain in flight, delegated workers and tool-use callbacks retry, gateways continue to accept traffic, and agents can alter parameters while an external reviewer or safety evaluator examines an earlier version. As a result, a verifier may approve Plan X while the agents are already acting on Plan Y. Authenticated transport and standard access-control mechanisms protect individual messages but do not establish a stable evaluation boundary, nor does a digital signature, plan commitment, or freeze request itself authorize a protected external effect.
This embodiment (Part 1 of a 27-part series; full details at https://zenodo.org/records/23940766) presents a protected multi-agent negotiation, joint-plan commitment, and independent evaluator-governed continuation system for agentic AI. Agents operating under separate organizational authorities exchange typed offers and counter-offers exclusively through covered negotiation gateways that authenticate origins, record causal event identifiers, and maintain durable delivery classifications. A plan compiler produces a canonical, machine-readable joint plan bound to an accepted transcript root. Both agents independently co-sign the identical plan digest under current session, phase, epoch, and policy generations. The resulting joint commitment is recorded as a non-effective state: agreement alone authorizes neither further unrestricted negotiation nor any external operation or tool invocation.
A distributed freeze controller then issues plan-bound freeze instructions. Each domain’s gateway atomically transitions to a restricted admission state (fail-closed), classifies already-admitted messages and deferred operations (accepted, authoritatively canceled, quarantined, or explicitly unresolved), and produces a signed local freeze acknowledgment only when the claimed restrictions are effective. A cross-domain freeze certificate is formed only after independent verification of consistent acknowledgments, matching plan and transcript roots, and coverage of the declared paths. Unresolved material activity keeps the session in a hold or uncertain state. The verified freeze certificate, joint commitment, and evidence snapshot are handed to a logically independent evaluator through a scoped intake interface. The evaluator’s structured decision remains non-effective; it does not unlock agent gateways or confer resource credentials. Any subsequent communication or protected effect requires a separately authorized, generation-bound next-step permission that is re-validated at the relevant local Finality Sink against the actual pending operation and current resource conditions under a zero-trust model.
The architecture separates agreement on a proposed plan, proof that both domains enforce a stable state for the covered paths, independent consequence assessment, and authority for an actual protected action. Valid joint commitment or freeze certificate never constitutes authorization to execute. The system fails closed on uncertainty, restart, partition, or policy change, providing auditable evidence for AI governance, multi-agent safety, and cross-organizational agent collaboration while ensuring that cooperative planning cannot silently become unilateral effectuation.
Keywords: multi-agent systems, agentic AI, autonomous agents, AI safety, AI governance, fail-closed systems, zero-trust agents, cross-organizational collaboration, joint commitment, distributed freeze, evaluation handoff, tool-use security, execution finality, protected communication gateways, independent evaluator, non-effective commitment, capability-based authorization, multi-party agent protocols.
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "How Agents from Different Companies Can Plan Together Without One Side Running Ahead - Part 1 of 27", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12740