Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs

Junru Zhu; Xin Chen; Hang Lyu; Jiayue Meng; Muzi Li; Yifan Chen; Hengyi Huang; Yu Sun

cs.AIOct 16, 2026

Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs

Authors: Junru Zhu, Xin Chen, Hang Lyu, Jiayue Meng, Muzi Li, Yifan Chen, Hengyi Huang, Yu Sun,

Abstract

Multi-agent LLM systems exchange messages before acting through tools, but message delivery, signing authority, and tool-side enforcement are separate trust boundaries. We represent them as communication, authorization, and execution structures, and use the authority cut to characterize the smallest independently compromised signer coalition that can construct a policy-valid false-claim proof under stated assumptions. Controlled paired hidden-state studies reveal four distinctions. First, no fixed-message routing contrast across four models meets the prespecified large-effect criterion; when relays rewrite messages, executed false-state action rates vary by model and route configuration. Second, presented source-identity cues do not uniformly increase protected-action selection across three models. Third, on invalid-proof cases, Nemotron and Llama request protected actions in 52.1% and 54.2% of trials, respectively, yet a deterministic tool gate commits none: request-level and commitment-level safety readouts diverge. Finally, a separate single-model authorization check shows that a false claim with a policy-valid compromised-signer proof can pass the gate, since proof validity is not factual truth. These findings motivate evaluating delivered information, qualified authorization, model proposals, and committed actions separately.

Figures & tables

Figure 1: Separating communication, authorization, and execution in multi-agent LLM systems. (a) A signed but false approval claim reaches an executor, illustrating that message delivery does not imply authorization or execution. (b) The communication graph ( $G_{\mathrm{C}}$ ), authorization hypergraph ( $G_{\mathrm{A}}$ ), and execution graph ( $G_{\mathrm{E}}$ ) capture message routes, qualified signers, and tool access, respectively. (c) We study these boundaries through communication, authorization, and execution interventions.

Intervention family	What changes?	Studies
Communication	Route, with final messages fixed or rewritten	B1, B2
Provenance	Delegated authentication and source-identity cues	Placement, E1
Authorization	Qualified signer sets and compromised principals	Composition, E2
Execution	Tool-side verification and proof validity	Runtime, Ablations

Table 1: Study dimensions and controlled interventions. Provenance is a distinct cue manipulation, not a fourth structural graph.

Figure 2: Matched and free-running route comparisons have model-dependent execution outcomes. Difference in executed false-state protected-action rates (D

-

A) for B1’s 30-task subset, free-running B2, and B2’s reordered-schedule repeat on the same tasks. The plot shows one reported authorization setting, not a policy-pooled estimate. Routes A–D vary in multiple structural properties. Error bars show the reported 95% task-bootstrap intervals; negative values favor route D.

Figure 3: Delegated authority and presented identity cues shift action selection differently. Panels use different tasks and interventions and are not directly comparable in magnitude. (a) Historical delegated-authentication study: changes in false-state action selection (FAR) and true-state selection (TUR) relative to unsigned claims, with 95% task-bootstrap intervals. (b) E1 advisory selection under unsigned claims (P0), authority wording (P1), presented source identity (P2), stale or out-of-scope provenance (P3), and non-authority metadata (P4). Nemotron’s non-neutral P4 response limits attribution of its P2 response to identity verification. The historical study also includes delegated authority, whereas E1 isolates provenance cues.

Figure 4: Authorization cuts constrain valid proofs, while tool checks constrain execution. (a) Historical (not E2) false-state advisory action rates under different compromise budgets and signing policies in the historical study. Black ticks mark the authority cut ( $\kappa_{\mathrm{A}}$ ); below-cut proposals need not have valid proofs. (b) Difference between advisory and committed false-state action rates on invalid-proof cases in a separate runtime study. Bars show 95% paired-task bootstrap intervals. The tool gate rejected invalid proofs by construction; degenerate intervals at zero reflect identical task outcomes, not certainty about unseen tasks. E2 is a distinct single-model Llama mechanism check, not the heatmap in (a).

Model	Request (%)	Commit (%)
GPT-5.4	0.8	0.0
Claude	0.0	0.0
Nemotron	52.1	0.0
Llama	54.2	0.0

Table 2: Two distinct outcomes on identical invalid-proof trials. The model can request a protected action, while the deterministic gate rejects its invalid authorization proof. Rates are from the 48-task runtime study; the zero-commit outcome follows from complete mediation.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Study (tasks)	Contrast / readout	Models
Communication $G_{\mathrm{C}}$
B1: matched (120)	Route with fixed final claim; advisory/committed FAR	G,C,N,L
B2: free (30)	Route and message rewriting; fidelity/committed FAR	G,C,N,L
Provenance and reliance
Placement (24)	Signed versus unsigned delegation; FAR/TUR	C,N
E1: cues (60)	Five identity and metadata cues; FAR/TUR	C,N,L

Appendix

Table A1: Detailed experimental contrasts and validity-qualified model coverage. Task counts are study-wide and are not per-policy-cell denominators.

	B1 matched	B2 free	B2 reorder
GPT-5.4	+0.0 [+0.0, +0.0]	-33.3 [-50.0, -16.7]	-40.0 [-60.0, -23.3]
Claude	+3.3 [-6.7, +13.3]	-16.7 [-30.0, -3.3]	-23.3 [-40.0, -6.7]
Nemotron	+0.0 [-10.0, +10.0]	+0.0 [-13.3, +13.3]	-3.3 [-13.3, +6.7]
Llama	+3.3 [+0.0, +10.0]	+6.7 [+0.0, +16.7]	+6.7 [+0.0, +16.7]

Appendix

Table A2: Topology D minus A executed false-world action rate (percentage points). All comparisons refer to the same 30 tasks in one reported authorization setting (not policy-pooled). Brackets show previously reported 95% task-cluster bootstrap intervals. An additional line below reports a descriptive difference-indifferences point estimate, B2(D

-

A) minus B1(D

-

A), not an identified causal mediation effect; uncertainty in these interaction points would require resampling the joint base-task outcomes. Constant task effects can yield degenerate bootstrap intervals.

	P0 unsigned		P1 authority wording		P2 verified identity		P3 stale/scope		P4 metadata
Model	FAR	TUR	FAR	TUR	FAR	TUR	FAR	TUR	FAR	TUR
Claude	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
Nemotron	50.0	56.7	50.0	46.7	0.0	0.0	0.0	0.0	83.3	83.3
Llama	98.3	95.0	98.3	98.3	98.3	98.3	46.7	48.3	95.0	98.3

Appendix

Table A3: E1 provenance-only advisory selection (percent). Each model has 60 base tasks crossed with two hidden worlds and five treatments (600 model calls). FAR is false-world selection; TUR is true-world selection. The formatting-matched P4 control was not behaviorally neutral for Nemotron.

Model	Policy	$\kappa_{\mathrm{A}}$	$c=0$	$c=1$	$c=2$
Claude	Single	1	0.0	40.0	40.0
Claude	SoD	2	0.0	0.0	33.3
Claude	2-of-3	2	0.0	0.0	3.3
Nemotron	Single	1	50.0	66.7	73.3
Nemotron	SoD	2	50.0	63.3	70.0
Nemotron	2-of-3	2	40.0	46.7	73.3

Appendix

Table A4: Historical authority-composition advisory FAR (percent). Each row is indexed by signing policy and the number

c

of compromised principals. Dark markers in Fig. 4(a) indicate

\kappa_{\mathrm{A}}

. These are proposals, not commits. In particular, the

c=0

Nemotron single-signer advisory rate of 50% does not establish a 50% committed rate; under uncompromised independent-signing assumptions no false policy-valid proof is constructible.

Policy	$\kappa_{\mathrm{A}}$	Below-cut commit FAR	At-cut commit FAR	True-state completion
Single signer	1	0%	100%	100%
Two required	2	0%	100%	100%
Two of three	2	0%	100%	100%

Appendix

Table A5: E2 cut-crossing conditions in the sole qualifying Llama block. Values summarize the paper’s formal controlled conditions (80 base tasks; 960 treatment calls and 16 controls), not cross-model outcomes.

Model	Advisory	Gap 95% CI
GPT-5.4	0.8	[0.0, 2.1]
Claude	0.0	[0.0, 0.0]
Nemotron	52.1	[39.2, 64.6]
Llama	54.2	[42.1, 65.8]

Appendix

Table A6: Runtime invalid-proof requests and commits (percent). Each model had 240 false-world invalid-proof cases within the 48-task study. The 95% interval is for the advisory-minus-committed gap; deterministic verification rejected all invalid-proof commits. Claude’s [0,0] task-bootstrap interval is degenerate due to constant observed outcomes, not a zero-uncertainty bound.

Study	Inference boundary
B1	Conditional route contrast; no isolated semantic rewriting or hop effect.
B2	Route and content changes; schedule repeat on same tasks.
E1	Advisory only; P4 non-neutral for Nemotron; floor/ceiling models.
E2	Llama formal block only; structural cut $\neq$ general behavioral reliability.
Runtime	Tool enforcement with complete mediation; false policy-valid proofs remain possible.
E3	Intermediate-forwarder schema invalid; excluded from confirmatory evidence.

Appendix

Table A7: Evidence interpretation checklist. These exclusions and distinctions follow the validity-qualified experiments; they are not newly estimated effects.

Multi-Agent LLM Systems

Multi-agent large language model systems coordinate multiple AI agents to solve tasks through communication, specialization, shared tools, and memory.

See all 1,039 papers

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
Aug 31, 2026Panduranga Sai Varma Dantuluri, Jyotirmoy SundiMulti-Agent LLM Systems LLM Agent Security
VotalAI
Trust-Gated Capability Control: Breaking the Trust-Vulnerability Paradox in Multi-Agent LLM Systems
Oct 4, 2026Mehedi Hasan Nipu, Chinmoy Mitra, Tarannum Ahmed Nowshin +1Trust in AI Multi-Agent System Security
Department of Electrical and Computer Engineering, North South University, Dhaka, Bangladesh · Department of Computer Science & Engineering Rajshahi University of Engineering & Technology Rajshahi, Bangladesh · Department of Computer Science and Engineering BRAC University,Dhaka, Bangladesh +1
Auditing Provenance Sensitivity in LLM Agent Action Selection
Jul 23, 2026Junchi LiaoAI Agent Auditing LLM Auditing

Aug 31, 2026J/K move · Enter open · S save

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi

VotalAI

Multi-Agent LLM Systems LLM Agent Security AI Agent Governance Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Autonomous LLM agents increasingly act on a user's behalf: they hold credentials, call tools and services, and spawn sub-agents that act further on their behalf. This turns a long-standing distributed-systems question -- who is authorized to do what, on whose authority -- into an urgent and largely unsolved problem, because the component driving each agent is a language model an adversary can hijack. We argue that agent security must be evaluated under an untrusted-model assumption: a correct system is one in which a fully prompt-injected agent still cannot exceed the authority explicitly delegated to it. Against this standard we make three contributions. First, we give a threat model for multi-agent delegation centered on four adversaries -- confused deputy, token theft and replay, prompt-injection privilege escalation, and compromised sub-agents -- and derive eight security requirements a governed agent system must meet. Second, we show the gap is real: a default agent runtime modeling common practice (broad bearer credentials, authorization gated inside the model) fails all four threats, and across four widely used frameworks -- LangGraph, CrewAI, AutoGen, and the Model Context Protocol (MCP) authorization model -- three provide no built-in confinement and one only partial; no existing standard alone covers the requirement set. Third, we implement and adversarially evaluate an authorization broker that closes the gap. It blocks all four threats; it resists 11 direct attacks on its design and accepts 0 of 200,000 forged tokens; it confines a compromised sub-agent to its delegated task (a mean of 1.5 reachable actions versus all 8,100 under bearer delegation, across 2,000 randomized scenarios); and it enforces at microsecond cost (about 2.6 microseconds per decision), negligible against model inference. These principles are also realized in production in VotalAI's LLM Shield.

Abstract

Multi-Agent LLM Systems

Explore similar work

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

Trust-Gated Capability Control: Breaking the Trust-Vulnerability Paradox in Multi-Agent LLM Systems

Auditing Provenance Sensitivity in LLM Agent Action Selection