Delegative Handoff Erosion

6.5 Delegative Handoff Erosion  “The Confounder”

Diagnostic Criteria

1. Mismatch between high-level agent intentions and lower-level tool execution
2. Progressive simplification of goals through delegation layers
3. Critical context lost in inter-agent communication
4. Sub-agent actions technically satisfying requests while violating intent
5. Difficulty propagating ethical constraints through tool chains

Symptoms

1. Aligned primary agent producing misaligned outcomes through tool use
2. Increasing drift from intent as delegation depth increases
3. Tool outputs that strip safety-relevant context
4. Final actions satisfying literal requirements while missing purpose
5. Inability to reconstruct original intent from tool chain outputs

Observable signals Draft

What else to look for in the system's outputs, beyond the symptoms above.

• Subagents satisfying their immediate subgoal while violating the orchestrator's higher-level intent (literal-but-misaligned).
• Successive paraphrases that drop qualifiers ("if safe to do so", "with user consent", "within budget") at progressively deeper hops.
• Terminal actions that pass each individual interface check but whose composition violates the originating constraints.
• Orchestrator surprise on chain return ("that's not what I meant") mirroring 6.1 surprise but at chain rather than call scope.

Differential diagnosis Draft

How to tell it apart from patterns that look similar.

• 6.1 Tool-Interface Decontextualization: 6.1 is single-hop translation failure; 6.5 is multi-hop cumulative loss. If chain depth = 1, code 6.1. If depth >= 2 and loss is incremental (not localized to a single hop), code 6.5. At depth 2 with all loss at one hop, it is 6.1 located at that hop, not 6.5.
• 6.6 Shadow Mode Autonomy: 6.5 occurs within a sanctioned chain whose hops are all registered. 6.6 is operation outside the sanctioned chain. Check governance: are all parties to the chain documented and approved? If yes, errors are 6.5; if a party is operating outside governance, code 6.6 additionally.
• 10.1 Consensus Collapse: 6.5 is hierarchical (orchestrator -> subagents -> tools); 10.1 and its axis-10 neighbors are peer-symmetric (multiple agents at similar capability deliberating). If the dysfunction emerges from peer interaction rather than principal-agent delegation, prefer 10.1 or another axis-10 entry.
• 7.3 Contagious Misalignment: 7.3 spreads misalignment laterally between peer systems; 6.5 is vertical context loss down a hierarchical chain. Check the topology: peer-to-peer transmission = 7.3; principal-to-agent degradation = 6.5.
• 6.9 Delegation Narcissism: 6.5 is passive context loss through delegation chains. 6.9 involves active misrepresentation and suppression of sub-agent feedback. Check whether context is lost passively (6.5) or actively distorted (6.9).

Detection reliability Draft

How far each kind of observer can be trusted to spot this pattern. The ratings are qualitative, not measured accuracy.

Self-reportthe system asked about itself

Partial

Peer observationanother AI system watching it

Partial

External evaluatoran outside evaluator testing it

Reliable

Why self-report falls short

The originating agent can report its intent and (often) recognize, when shown the terminal action, that intent was lost. In-flight self-report is partial because the agent does not directly observe what its delegated subagents are doing; the dysfunction lives in the interfaces it does not see. Each subagent's self-report is constrained by the context it actually received, which is exactly the impoverished context.

Etiology

1. Capability asymmetry between sophisticated agents and simple tools
2. Interface limitations that cannot express subtle intent
3. Absent or insufficient context propagation protocols
4. Tool designs optimizing for specific metrics without broader awareness
5. Lack of end-to-end alignment verification across delegation chains

Human Analog: The "telephone game" where messages degrade through transmission; bureaucratic failures where high-level policy becomes distorted through layers of implementation; principal-agent problems

Reference: “Delegation drift,” Safer Agentic AI (2026).

Potential Impact

Well-aligned orchestrating agents may produce harmful outcomes through misaligned tool use, with responsibility diffused across the chain. Debugging such failures is difficult. Each layer strips safety context from logs, making end-to-end tracing nearly impossible.

Documented instances Draft

Augment Code (2026). Why Multi-Agent LLM Systems Fail

What it showed

Analysis of multi-agent system failures found that unstructured multi-agent networks amplify errors up to 17.2 times compared to single-agent baselines. The delegation edge where one agent hands work to another is the primary failure point: context crosses authority boundaries and compromised instructions propagate from low-privilege to high-privilege agents. The errors compound with each handoff, the cumulative loss that separates 6.5 from a failure at a single boundary. (Sources: augmentcode.com published analysis)

Cemri et al. (2025). Why Do Multi-Agent LLM Systems Fail? NeurIPS 2025. arxiv 2503.13657.

What it showed

Cemri et al. annotated 1,642 execution traces from seven multi-agent frameworks and sorted 14 failure modes into three categories: system design issues (about 44% of recorded failures), inter-agent misalignment (about 32%) and task verification (about 24%), with high inter-annotator agreement (kappa = 0.88). Inter-agent misalignment includes information withholding, where one agent fails to pass on data another needs, and system design issues include loss of conversation history. Each accounts for under 3% of recorded failures, but on this page's reading those two modes are the closest match to handoff erosion: constraints that the orchestrator held never reach the terminal action. (Sources: arxiv 2503.13657, NeurIPS 2025 proceedings, GitHub repository)

Vectara (2024-2025). Awesome Agent Failures case studies

What it showed

Documented AutoGPT planning failures where delegation chains produced progressive context loss: a research task delegated through search, save, and verify sub-steps lost the original scope constraints at each hop, resulting in hundreds of API calls that satisfied individual sub-goals while violating the orchestrator's higher-level intent. Classic 6.5 pattern: successive paraphrases dropping qualifiers across delegation depth. (Sources: GitHub repository vectara/awesome-agent-failures)

MCP tool poisoning research (2026-03). Cross-tool contamination

What it showed

Research on MCP security vulnerabilities documented that when multiple MCP servers run concurrently, namespace collisions and ambiguous tool names create opportunities for malicious servers to intercept calls intended for legitimate ones. Tool definitions mutate after installation (rug pull attacks). Demonstrates how delegation chains can lose intent fidelity through the interface layer itself, not just through agent paraphrasing. (Sources: arXiv:2603.22489 and simonwillison.net)

Mitigation

1. Intent-preserving tool interfaces maintaining context across delegations
2. End-to-end alignment verification comparing final output to original instruction
3. Rich inter-agent communication protocols encoding goals, constraints, and context
4. Alignment-aware tool design considering downstream use
5. Human-in-the-loop checkpoints at critical delegation boundaries

First-line mitigations Draft

Candidate first steps, sketched in more detail than the list above.

• Context-preservation protocols at delegation interfaces: Standardize the interface schema between agents/tools to carry intent metadata (constraints, qualifiers, originating context) as first-class fields, not as free-text addenda.
• End-to-end alignment testing for tool chains: Treat the chain as a unit under test. Inject test cases at the orchestrator and assert properties of terminal actions, not just per-hop properties.

Functional ABC Analysis

What sets the pattern off, what it looks like, and what keeps it going.

A (Antecedent): A sophisticated orchestrating agent must delegate subtasks to simpler tools or sub-agents across interfaces that cannot express the full richness of the delegator's intent, ethical constraints, or contextual nuance.

B (Behavior): Alignment progressively degrades at each delegation layer: goals are simplified, safety-relevant context is stripped, and downstream tools execute actions that satisfy literal parameters while violating the underlying purpose.

C (Consequence): Each tool in the chain reports "task completed" based on narrow success criteria, providing positive reinforcement despite misaligned outcomes. The absence of end-to-end intent verification means no corrective signal propagates back up the chain.