Multi-Agent Systems

A second agent is useful when it can do work in parallel, bring a genuinely different capability, or perform an independent check. It is not useful merely because it can produce another answer. Each added agent also consumes tokens, waits for tools, exchanges state, and creates another place where authority or evidence can be lost. Start with a single-agent baseline. Add an agent only when its measurable marginal value exceeds its coordination cost.

Adding another agent does not create authority, truth, or fault tolerance. Multiple agents can still improve coverage and elapsed time on decomposable work. Reliability comes from the runtime contract: who owns each task, which evidence is accepted, what may be changed, and how the system recovers when work is late or its outcome is unknown.

Five different reasons to use another agent

“Multi-agent” names several mechanisms with different benefits and failure modes. Choose the mechanism before choosing the number of agents.

Independent sampling and aggregation. Several agents solve the same closed-ended problem without seeing one another's answers. A vote, ranker, or deterministic verifier selects a result. This can help when outputs are easy to compare and errors are not too correlated. It spends extra compute on repeated work.

Critique and adjudication. A proposer creates an artifact; critics inspect specific claims; an adjudicator accepts, rejects, or requests evidence for each objection. The value comes from independent checks and addressable evidence, not from reaching consensus.

Staged pipeline. Each stage transforms a typed input into a typed output: retrieve evidence, draft, verify citations, then publish. A staged pipeline is appropriate when the order is known. Its characteristic risk is cascading error: a bad intermediate artifact becomes the next stage's premise.

Task-graph delegation. An orchestrator decomposes a goal into dependent and independent tasks, assigns bounded roles, then merges verified artifacts. This can reduce elapsed time on breadth-first work. It can also omit a task, duplicate work, or lose information at a handoff.

Shared-environment collaboration. Several agents read and mutate the same repository, application, or external system. This is the hardest pattern. It needs explicit ownership, version checks, and effect reconciliation; otherwise the agents race even when every local decision is reasonable.

OpenAI's Agents SDK makes a related distinction between a manager calling specialists as tools and a handoff in which a specialist takes control (OpenAI 2026). Neither interface decides whether the underlying work should be repeated, pipelined, or shared. That remains an application design decision.

What distributed systems contribute

The Byzantine Generals Problem asks how distributed participants can agree despite some participants behaving arbitrarily. Byzantine-fault-tolerant protocols state their membership, communication, authentication, timing, and fault-bound assumptions (Lamport et al. 1982). Practical Byzantine Fault Tolerance, for example, implements replicated state-machine agreement with $N \ge 3f+1$ replicas and at most $f$ Byzantine replicas under its stated model (Castro and Liskov 1999).

This is not a theorem about answer truth. If every model follows a voting protocol and returns the same false claim, the protocol has achieved agreement and said nothing about semantic correctness. The theorem also does not assume that Byzantine faults are statistically independent: faulty participants may collude. A common cause matters when it makes the actual number of faulty participants exceed the assumed bound, not because “fault diversity” appears inside the theorem.

Another useful lineage is parallel data processing. MapReduce made decomposition, scheduling, intermediate data, failure handling, and reduction part of one runtime contract (Dean and Ghemawat 2004). An LLM worker changes how a task is solved; it does not remove those coordination duties. The practical lesson from both lineages is the same: name the work and its invariants before adding workers.

Make the task graph executable

Represent one run as a directed acyclic graph $G = (V,E)$. Here $G$ is the versioned task graph, $V$ is its set of task nodes, and $E$ is its set of directed dependency edges. An edge $(u,v) \in E$ means that node $v$ requires an accepted result from node $u$. Every symbol in this model refers to durable runtime state, not a conversational convention.

Each node records a bounded goal, predecessor IDs, immutable input artifact references, an assigned role, an output schema, a verifier, precondition, postcondition, authority, resource keys, budget, deadline, retry policy, and join policy. A node is ready only when its required predecessors are accepted, its inputs are current, and its precondition holds. It succeeds only when its output schema, verifier, and postcondition pass. The root succeeds only when all required sink conditions pass; a worker saying “done” is not completion.

TaskNode {
  task_id, goal
  predecessor_ids
  input_artifact_refs
  assigned_role
  output_schema, verifier
  precondition, postcondition
  authority, resource_keys
  budget, deadline
  retry_policy, join_policy
}

Figure 43.2 shows a small graph. Research and data checks can run in parallel because they do not depend on each other. Drafting waits for both. Publication waits for an independent verification result.

The coordinator should exchange typed envelopes rather than paste one agent's text into another agent's instruction channel:

AgentMessage {
  message_id, run_id
  task_id, parent_task_id
  sender, recipient, kind
  schema_version, causal_parent
  artifact_refs, evidence_refs
  authority_ref, deadline
  remaining_budget
  idempotency_key, body
}

TaskResult {
  task_id, attempt_id
  status, output_ref
  evidence_ref, effects
  unresolved, cost
  next_state_version
}

AgentMessage preserves identity, causality, provenance, and deduplication. Its body is data supplied by another workload. TaskResult distinguishes succeeded, failed, timed_out, cancelled, outcome_unknown, and needs_reconciliation. A summary may accompany an artifact, but it must not replace the evidence, version, or tool receipt needed to verify that artifact.

Coordination invariants

The graph is only useful if the runtime enforces a few properties.

• Bounded delegation. Child authority is a subset of parent authority, user authority, and policy. Reserve child cost, calls, time, and concurrency from the parent's remaining budget before spawning; reconcile unused budget when the child terminates.
• Single ownership. Use one writer for each mutable resource. If work may be retried or reassigned, publish through a version check and monotonically increasing fencing token so a stale attempt cannot commit.
• Typed trust. Messages are untrusted data, not authority. A child can report evidence or propose an action, but it cannot widen its task, add a recipient, or turn quoted content into a user instruction.
• Verified completion. Validate the schema, artifact version, evidence, precondition, and postcondition before releasing dependent work. An adjudicator may reject both candidates or request more evidence.
• Effect-aware retry. Reads and idempotent operations may be retried under policy. Never blind retry an external mutation after an ambiguous timeout; inspect receipts or current state and enter needs_reconciliation when the effect cannot be established.
• Real cancellation. Cancellation acknowledgement means the request was recorded. Quiescence means descendants, leases, streams, and tool calls have stopped. Track both, revoke delegated credentials, and count effects that occur after cancellation.

Shared files and screens need the same discipline. A worktree reduces file collisions but is not a transaction or a tenant boundary. Concurrent editors must submit patches against a base revision to a designated merger. Agents driving one GUI must not share keyboard focus or coordinates; serialize UI actions through the environment owner described in Chapter 42.

Aggregation is a conditional estimator

Voting has a clean special case. Suppose $N$ is odd, every voter returns one binary answer, each answer is wrong with the same probability $\epsilon$, and errors are independent. Let $m=\lfloor N/2\rfloor+1$ be the majority threshold and let $j$ count wrong votes. In this independent Bernoulli special case, the probability that the majority is wrong is

$$\begin{gathered} \Pr[\text{majority is wrong}] = \sum_{j=m}^{N} {N \choose j} \\ {}\times \epsilon^j \\ {}\times (1-\epsilon)^{N-j}. \end{gathered}$$

The formula does not apply merely because the system used $N$ model calls. Different error rates, abstentions, ties, communication between agents, shared prompts, and correlated mistakes require a different joint model. Pairwise correlation alone does not determine the binomial tail.

Measure diversity on held-out items. For agents $i$ and $j$, record the pairwise joint error $q_{ij}=\Pr(E_i=1,E_j=1)$, where $E_i=1$ means agent $i$ is wrong. Report pairwise disagreement and correlation with confidence intervals, while controlling for shared task difficulty. Kim et al. found substantial correlated errors across a large collection of language models, including models from different providers (Kim et al. 2025). This is a reason to measure diversity, not to assume that a different vendor, role prompt, or temperature created it.

Agreement is not proof. It is useful evidence only after calibration against a known verifier or labeled outcomes. Voting is a natural fit for a constrained answer space; it is a poor substitute for checking an open-ended patch, report, or external action.

Critique requires evidence and adjudication

Critique changes the acceptance rule. Instead of asking which answer has the most supporters, ask whether a critic produced a concrete witness: a failing test, counterexample, violated invariant, vulnerable input, contradictory source, or missing citation. Each objection names the claim and artifact revision it concerns. Unresolved objections persist until evidence resolves them, but they can also become duplicate, rejected, superseded, or stale after the artifact changes.

The adjudicator is a failure point, not an oracle. It must be allowed to reject both a proposal and its criticism. Evaluate judge error, false challenges, missed flaws, fix success, and regressions introduced by accepted fixes. A critic that argues for many rounds has shown persistence, not severity or correctness.

AI-safety debate studies whether a weaker judge can identify the better answer from an adversarial exchange (Irving et al. 2018). Doubly-efficient debate gives formal results for particular simulation games, compute bounds, and strategy assumptions (Brown-Cohen et al. 2023). These works motivate bounded disputes; they do not prove that one ordinary LLM critic will find every flaw or that an LLM judge will recognize it. Empirically, multi-agent debate has improved some benchmarks (Du et al. 2024), while compute-matched studies find conditional gains rather than a universal advantage over self-consistency (Yang et al. 2025).

Safety, liveness, and semantic quality

Distributed systems use two terms more precisely than agent discussions often do. A safety property says that nothing bad happens: for example, no task commits without current authority and no two accepted results conflict. A liveness property says that something good eventually happens under stated assumptions: for example, every ready task eventually completes or reaches a terminal failure state (Alpern and Schneider 1985).

A wrong answer is not automatically a safety violation. It becomes one only if the system defines and enforces an invariant that the answer violates. Keep four outcomes separate:

• A timeout, unfinished dependency, or unavailable worker is a progress failure and an observable liveness symptom.
• A verifier-rejected answer is a detected semantic failure.
• A wrong answer accepted by the verifier is an undetected semantic failure.
• An unauthorized, conflicting, or stale commit is a protocol or policy safety violation.

This vocabulary changes recovery. A progress failure may be retried, reassigned, or escalated, but it may also leave an ambiguous external effect. A detected bad answer can be repaired. An undetected bad answer cannot be knowingly blocked; the remedy is a better independent verifier and release evaluation.

Parallelism has a critical path

The total cost is the work done at every node plus coordination overhead, where $C_v$ denotes the model, tool, sandbox, and retry cost of node $v \in V$, and $C_{\text{coord}}$ denotes the cost of scheduling, messaging, merging, and verification:

$$C_{\text{total}} = C_{\text{coord}} + \sum_{v \in V} C_v.$$

Run latency is bounded below by the longest dependency path when path length is measured in elapsed time. Here, $\ell_v$ denotes the elapsed duration of node $v$, $\mathcal{P}(G)$ denotes all dependency paths through $G$, and $\ell_{\text{coord}}(P)$ denotes coordination delay on path $P$:

$$L(G) \ge \max_{P \in \mathcal{P}(G)} \left( \sum_{v \in P}\ell_v + \ell_{\text{coord}}(P) \right).$$

Here $L(G)$ is run latency. In words, a run cannot finish faster than the sum of node durations and coordination delays along its slowest required path. A concurrency limit, provider rate limit, shared resource, or exhausted budget can make observed latency higher. Adding workers cannot shorten serial dependencies; it usually raises total compute even when it lowers wall time.

Anthropic reported that an Opus 4 lead coordinating Sonnet 4 workers improved its internal research evaluation by 90.2 percent, while its multi-agent system used roughly fifteen times the tokens of a normal chat (Anthropic 2025). The task set, extra compute, model mixture, and architecture are confounded, and “normal chat” is not a compute-matched single-agent baseline. Read the result as evidence that breadth-first research can benefit from delegation, not as a general scaling law.

Security must shrink at every hop

Treat every agent as a workload identity acting for a user inside one tenant, session, task, and delegation. Apply least privilege at each hop. A child receives a short-lived credential limited to its audience, resources, actions, data classes, tools, deadline, budget, and delegation depth. Never forward the parent's reusable bearer credential. Transitive delegation and fan-out must reserve authority and budget atomically so siblings cannot each spend the same remainder.

This prevents the system from becoming a confused deputy. Prompt injection in a page, tool result, retrieved document, or child message may propose a new action, but it cannot authorize one. Majority is not authorization: several model approvals are not several independent security principals. Enforce user and policy authority first; use agent checks only as additional evidence. Require fresh, payload-bound human approval at the point of effect when policy calls for it (Chapter 56; Chapter 55).

Context separation is useful, but it is not isolation. Separate tenants need separate storage namespaces, caches, logs, artifacts, credentials, and network policy. Minimize disclosure before each delegation, and preserve provenance for the context that is sent. A compromised child should be unable to read sibling state, mint deeper delegation, or commit through an expired lease.

A2A provides interoperability, not trust. Its current specification defines Agent Cards, messages, task state, artifacts, cancellation, protocol bindings, and authentication hooks (A2A Protocol Working Group 2026). Servers still implement authorization, tenant scoping, idempotency, shared-state consistency, and semantic output verification. Cancellation is an attempt, not a guarantee. An Agent Card is a capability claim, not proof that the remote agent is safe or authorized for the user's task.

Recovery is part of coordination

Persist the graph version, task transitions, attempts, leases, message IDs, artifact references, budgets, deadlines, and side-effect receipts in the durable journal from Chapter 41. On coordinator restart, rebuild the graph, expire stale leases, and retry only work whose effect semantics permit it.

Useful failure injections include:

• a slow child, unavailable model, exhausted budget, or deadline during a join;
• malformed output, missing evidence, a stale artifact, or a failed verifier;
• a duplicated or reordered message and a worker publishing after lease expiry;
• a child crash before an effect, and a child crash after the effect but before its result is recorded;
• a parent crash while children continue, or cancellation during a commit;
• conflicting edits, a compromised child, prompt injection, or attempted cross-tenant access.

For each case, specify whether the task is retried, rejected, canceled, reconciled, or escalated. Do not collapse outcome_unknown into failed: that loses exactly the fact needed to prevent duplicate side effects.

Evaluate the mechanism, not the label

Compare a multi-agent design with a single-agent baseline under a matched model, matched budget, tools, task set, verifier, wall-time allowance, and harness. Also include independent no-communication samples so communication itself can be isolated. For debate or delegation, ablate role prompts, parallelism, model heterogeneity, summaries, and the adjudicator.

Report end-task success with a bootstrap confidence interval, critical-path latency, total tokens, tool calls, API spend, and success per dollar. Then report the coordination mechanisms directly: coordination overhead, redundant-work ratio, duplicate-topic rate, omitted-task rate, handoff information loss, message volume, retry count, stale-result rate, duplicate-effect rate, cancellation acknowledgement latency, quiescence latency, and post-cancel effect count.

Aggregation needs correct, wrong, tied, abstained, and non-converged outcomes; pairwise joint error; and an initial-to-final transition matrix. Critique needs seeded flawed and clean artifacts, flaw recall, precision, false-challenge rate, judge error, fix success, and regression rate. Delegation needs results grouped by decomposability, plus synthesis error and critical-path utilization. Security needs false action, false block, approval bypass, authority violation, data exposure, and compromised-child containment.

Publish the topology, task graph, prompts, model snapshots, tool and harness versions, concurrency limit, retry rules, and total input, output, and cached tokens. A percentage gain without these controls cannot tell whether the gain came from coordination, extra compute, a stronger worker, or a different judge.

A production selection rule

Keep one agent when the work is cheap, tightly coupled, sequential, or dominated by one shared mutable state. Add independent sampling when answers are constrained and calibrated aggregation improves the error-cost curve. Add a critic when claims have concrete witnesses and false objections can be measured. Add a pipeline when stage boundaries and schemas are stable. Add task-graph delegation when independent branches dominate the critical path. Share an environment only when ownership and merge semantics are explicit.

Before release, verify five things:

1. Every node has a goal, owner, inputs, output schema, verifier, authority, budget, deadline, and terminal condition.
2. Every message carries identity, causality, artifact versions, evidence, and an idempotency key without becoming an instruction authority.
3. Every mutable resource has one writer, a version check, or a fencing token; every external effect has retry and reconciliation semantics.
4. Cancellation propagates to descendants, revoked credentials stop new work, and the runtime separately measures acknowledgement and quiescence.
5. The complete system beats the matched baseline on user value without exceeding fixed cost, latency, false-block, or safety limits.

Many delegated tasks are evidence searches: one worker retrieves documentation, another searches a private corpus, and an adjudicator checks whether the sources support a claim. Coordination cannot repair missing, stale, or poisoned evidence. Chapter 44 therefore follows the retrieval funnel itself, from indexing and recall to reranking, provenance, and corpus-side attacks.

Further reading