Several agents, one set of books.
A single agent doing one job is straightforward. The hard part is three of them working the same process — a procurement agent raising what an approvals agent releases and a finance agent matches — without any of them approving its own work, and with a person still holding the decision that matters.
One shared ledger·Handoffs are documents·Segregation enforced
Why most multi-agent setups do not survive contact.
The failures are structural rather than model failures. They come from agents that do not share a record, a permission model, or an order of precedence.
- 01
Each agent has its own copy of the truth
Three agents reading three extracts, reaching three defensible conclusions, and disagreeing in a way nobody can adjudicate.
- 02
Handoffs are messages, not records
One agent tells another something. There is no document, so there is no trail and no way to replay what happened.
- 03
Nobody defined precedence
Two agents act on the same document within a second of each other, and the outcome depends on which one got there first.
- 04
Segregation is assumed
The agent that raised the requisition is, by a chain of two handoffs, the one that ends up releasing it.
- 05
The human gate is decorative
A person is asked to approve something they cannot check, at a volume they cannot read, which is not a control.
What makes it work instead.
Every mechanism below already exists for your people. Agents are held to the same ones rather than to a parallel set written for them.
One ledger, not three contexts
Every agent reads the same live records with its own permissions applied. There is no per-agent extract to fall out of step.
Handoffs are documents
One agent's output is a requisition, a match, or a draft — a record with a state and an owner, which the next agent picks up from the queue.
A role each, like a job
Procurement, approvals, and finance are scoped separately, with their own tool permissions, exactly as you would scope three people.
Segregation across the chain
Enforced on the whole path, not per step — so no agent can end up releasing what it or its own upstream raised.
The queue, in one place
What every agent is working on, what is waiting on a person, and what is held, with the reason on each item rather than in a log.
Gates a person can actually use
Anything over a limit routes with the reasoning and the source documents attached, so approving takes seconds rather than an investigation.
What the chain may and may not do.
The limits here apply to the path rather than to any single agent, which is the distinction that makes a multi-agent process auditable.
- May read
- The records each agent's own role permits — never a shared, unscoped context
- May do
- Hand work to the next agent as a document, within each agent's own permissions
- May not do
- Close a loop it opened — segregation is tested across the whole chain, not per step
- Precedence
- One agent owns a document at a time; contention is resolved by rule, not by timing
- Ceilings
- Per agent and per chain, so three small limits cannot compose into a large one
- Human gate
- A named person, with the reasoning and source documents attached
- Trail
- Every handoff written to the audit trail on the document, replayable end to end
- Reversible
- Any agent in the chain returns to proposal mode without stopping the others
The modules underneath this.
A chain is only worth building where the steps genuinely span functions. These are the modules the common chains run across.
How to tell whether it worked.
The measures that matter are about the chain, not the agents. A chain of individually accurate agents can still produce a bad outcome.
- End-to-end completion
- Processes finishing without human intervention, measured across the whole chain rather than per step.
- Where it stops
- Which step sends work to a person most often, which is where the next fix belongs.
- Handback rate
- Work a person returns to the chain as wrong — the honest measure of whether the handoffs are sound.
- Chain cycle time
- From the trigger to the closed document, against the same process before the chain existed.
- Segregation exceptions
- Attempts blocked because an agent would have closed its own loop. This should be non-zero and reviewed.
- Gate response time
- How long items wait on a person, because a chain is only as fast as its slowest approval.
The programmes this normally arrives inside.
Next step