Abstract

AI agents now work in teams. Planners hand tasks to sub-agents, agents call other agents across providers, tools call tools, and committees of AI evaluators approve risky actions. Each participant can be authenticated and individually authorised, yet the combination goes wrong:

  • Two agents with valid permission change the same record and together produce a result nobody approved.
  • A delegated sub-agent at another provider keeps capabilities after the original authority narrowed or expired, or quietly widens its scope.
  • Parallel branches of a task each spend the full budget.
  • A quorum’s signatures are collected over slightly different proposals, from a stale membership list, or from “independent” evaluators run by one operator or fed the same poisoned input.
  • A majority overrides a mandatory veto.
  • A prompt-injected agent asks another agent to do what it was never allowed to do.

Authentication, delegation tokens, voting and consensus each prove something, but none proves current authority to produce this particular effect.

This disclosure keeps every consequential act of a multi-agent system non-effective until a protected Finality Sink verifies each property at the right boundary. It covers six mechanisms:

  1. Protected cross-agent effect-conflict arbitration, using declared effect footprints and atomic reservations.
  2. Cross-provider delegation lineage that is authenticated, bound to receiver, generation and revocation state, and can only narrow effect scope.
  3. Version-bound reservations with semantic conflict checks for concurrent effects.
  4. Operation-bound quorum certificates, in which eligible, current members sign the same canonical act.
  5. Transitive delegation across nested tool chains, with branch-conserved budgets so parallel branches cannot multiply authority.
  6. Independent evaluation quorums that discount shared control or shared inputs and honour authenticated veto policy.

The sink reconstructs the actual pending operation and atomically checks source lineage, attenuated scope, quorum, reservation, resource version, revocation and budget before consuming single-use enablement. Revocation propagates to all delegation descendants. Uncertain outcomes are reconciled rather than retried blindly.

The disclosure includes key points for examiners with search terms, architecture and decision-gate drawings for each embodiment, reference structures and algorithms, ten implementation variations, ten threat models, twenty-four proposed validation tests, and IETF and EU AI Act mappings.

Industry relevance (AI-generated): the patterns apply to publicly described environments, including:

  • Apple iOS, iPadOS, macOS, Siri, Shortcuts and App Intents
  • Google Android, Gemini, Binder, Intents and Google Cloud agent platforms
  • Samsung Bixby; Microsoft Windows, Azure, agent orchestration and Copilot; Amazon Alexa
  • OpenAI Agents SDK, Responses API and Codex; Anthropic Claude, Claude Code and managed agents
  • Meta Muse/Sentinel; NVIDIA OpenShell, BlueField and Sentry; Qualcomm Snapdragon, Arm and Huawei platforms
  • banking and payment automation; enterprise SaaS, CRM, ERP and procurement
  • robotics and industrial controllers; telecom network management

Names identify engineering problem classes only. No vulnerability, implementation, copying or infringement is alleged, and no endorsement is implied. This material is AI-generated and must be cross-checked against the original PCT filings and primary sources before drawing any conclusion.

This technical disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026 (WO 2026/150382), which claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026 (WO 2026/115520). The source text corresponds to Embodiments 1, 7, 11, 13, 28 and 29 at pages 248–294, 723–786, 994–1062, 1140–1220, 2318–2397 and 2398–2479 of the 3,567-page specification published on Zenodo (https://zenodo.org/records/23657985). Those page numbers refer to that specification, not to the PCT page count. It is expanded here from Internet-Draft draft-das-multi-agent-authority-control-00, dated 26 October 2026 (Part 5 of a 12-part series). Diagrams, schemas, implementation variations, threat classifications and proposed tests are newly authored explanations, not claimed as filed content or experimental results. Related family applications can be cross-checked on WIPO PATENTSCOPE. Licensed under CC BY-NC 4.0. The author is open to acquihire or strategic collaboration.

Keywords

multi-agent system security; agent-to-agent delegation; A2A; delegation chain; scope attenuation; capability attenuation; confused deputy; command laundering; cross-provider agents; concurrent writes; write conflict; optimistic concurrency; resource version; reservation; semantic conflict; quorum certificate; threshold signature; Byzantine fault tolerance; Sybil attack; collusion; LLM-as-judge; evaluator independence; veto; budget conservation; nested tool chain; revocation propagation; OAuth token exchange; GNAP; execution finality; Finality Sink; EU AI Act.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS