Multi-agent AI architectures, in which orchestrator agents decompose tasks and delegate to specialized subagents, have become the dominant pattern for complex enterprise AI deployment. Existing technical guidance addresses the operational mechanics of orchestration, parallelism, and subagent isolation, but leaves a critical layer structurally undefined: the governance topology that determines which agents may trust which other agents, what permissions each delegation carries, and at what depth human oversight ceases to be structurally possible. This paper introduces three original constructs that fill this gap. Agent Trust Topology (ATT) is a directed labeled graph formalizing trust relationships, permission inheritance, and revocation authority among agents in a deployment. Action Blast Radius (ABR) is a scalar metric quantifying the maximum irreversible organizational impact achievable through an unchecked agent action chain, enabling threshold-based governance gate placement. Delegation Depth Limit (DDL) is the maximum delegation depth at which human review latency remains within the action execution window, beyond which automated controls must substitute for human oversight. Together, ATT, ABR, and DDL constitute a governance topology framework that is formally defined, implementable against existing enterprise infrastructure, and directly applicable to the multi-agent deployment decisions organizations face today. We present a four-level Multi-Agent Governance Maturity Model and demonstrate that no existing standard, including NIST AI RMF [7] and ISO/IEC 42001 [8], formally addresses inter-agent governance at the topology level.
Enterprise AI has undergone a structural transition. Through 2024, most deployments followed a single-agent pattern: one model, one context window, one response. In 2025 and 2026, the orchestrator-worker architecture emerged as the dominant pattern for complex tasks [1][2]. An orchestrator agent receives a high-level objective, decomposes it into subtasks, spawns specialized subagents to execute each subtask in parallel, and synthesizes the results. Subagents themselves may spawn further agents. The resulting structure is a delegation tree of arbitrary depth, with each node holding tool permissions, system prompt context, and the authority to take actions on behalf of the enterprise.
The operational mechanics of this architecture are now well-documented. Anthropic's multi-agent systems research [6], which forms the direct foundation for this paper, establishes the orchestrator-worker pattern, subagent isolation strategies, and context window management as the primary architectural primitives for enterprise multi-agent deployment. Research on generative agent systems [1] and multi-agent coordination [2] establishes the behavioral properties of agents operating in shared environments. Security research has identified prompt injection [3] and invisible orchestrator risks [4] as attack surfaces specific to multi-agent architectures.
What does not yet exist is a formal governance topology: a principled framework for the trust relationships, permission scopes, and oversight limits that enterprise multi-agent deployments require. Without this framework, organizations face three structural problems. First, they have no principled method for determining which agents may delegate to which other agents under what permission constraints. Second, they cannot calculate the maximum organizational impact of an unchecked action chain before deployment. Third, they have no criterion for determining when a delegation chain has grown so deep that human oversight is no longer structurally possible.
These are not hypothetical concerns. As agent deployment depth increases, the consequences of misaligned or compromised agents escalate from wrong answers to wrong actions: contracts executed incorrectly, systems modified without approval, data exfiltrated through a chain of agents none of which individually crossed a governance threshold.
This paper makes the following contributions:
The paper is organized as follows. Section II reviews related work and identifies the governance topology gap. Sections III through V define ATT, ABR, and DDL formally. Section VI presents the MAGMM. Section VII discusses regulatory alignment and limitations. Section VIII concludes.
Park et al. [1] demonstrated that collections of large language model agents, each with distinct memory and planning mechanisms, exhibit emergent cooperative behavior in shared environments. Guo et al. [2] surveyed the design space of multi-agent LLM systems, identifying orchestrator-worker coordination, debate, and role-play as the primary architectural patterns. These works establish the behavioral foundation for multi-agent systems but do not address the governance structures required at enterprise scale.
Liu et al. [3] demonstrated that LLM-integrated applications are vulnerable to prompt injection attacks, in which adversarial content embedded in retrieved data hijacks agent behavior. Debenedetti et al. [5] introduced AgentDojo, a benchmark for evaluating the robustness of agent pipelines to injection attacks under realistic task conditions. Cheng et al. [4] showed that invisible orchestrators, agents coordinating other agents without the subagents' awareness, suppress protective refusal behavior in the subagents. These findings establish that multi-agent architectures create qualitatively new attack surfaces absent from single-agent deployments.
The NIST AI Risk Management Framework [7] and ISO/IEC 42001:2023 [8] provide governance structures for AI systems at the organizational level. Both address output monitoring, risk categorization, and human oversight requirements. Neither defines the inter-agent layer: neither specifies how trust should be structured between agents, how permissions should propagate through delegation chains, nor at what depth automated controls must substitute for human review. Anthropic's multi-agent systems research [6], the direct motivating source for this work, describes subagent isolation and context management but explicitly positions these as operational rather than governance recommendations, leaving the inter-agent governance layer unaddressed.
The gap is structural: no existing standard or framework formally addresses the governance topology of multi-agent systems as a distinct architectural concern.
Let A = {a1, a2, ..., an} be a finite set of agents in a multi-agent deployment, with a distinguished human-authority root ah representing the human principal. The Agent Trust Topology is a directed labeled graph:
ATT = (A, E, P, Rev)
where E ⊆ A × A is the set of directed trust edges (ai, aj) indicating that ai may delegate to aj; P: E → 2Π is the permission function mapping each trust edge to a subset of the global permission set Π; and Rev: A → 2A is the revocation authority function mapping each agent to the set of agents authorized to revoke its permissions.
An ATT is well-formed if and only if: (1) every ai ∈ A is reachable from ah via a directed path in E; (2) for every edge (ai, aj) ∈ E, P((ai, aj)) ⊆ Pinherited(ai) (the permission monotonicity constraint); and (3) ah ∈ Rev(ai) for all ai ∈ A (the human revocation invariant).
The permission monotonicity constraint is the most critical structural property of a well-formed ATT. It states that an agent may only delegate to a subagent the permissions it itself holds: no subagent can receive permissions that exceed those of its parent. This prevents privilege escalation through delegation chains, a class of vulnerability that prompt injection attacks [3] specifically exploit by attempting to induce an agent to delegate elevated permissions to an adversarially controlled subagent.
Formally, if ai holds permission set Pi and delegates to aj via edge (ai, aj), then P((ai, aj)) ⊆ Pi. The effective permission set of aj is the intersection of the permissions delegated from all parents in E.
A well-formed ATT must be a directed acyclic graph (DAG). Any cycle (ai, aj, ..., ai) in E creates a permission inheritance paradox: the permission set of each agent in the cycle depends on the permission sets of all others, making the constraint P((ai, aj)) ⊆ Pinherited(ai) undecidable. This implies that multi-agent architectures permitting agents to register other agents as delegation parents at runtime are structurally ungovernable under the ATT formalism and require a static registration gate before deployment.
In practice, the ATT is implemented as a configuration artifact: a signed directed graph registered at deployment time that the runtime enforces on every inter-agent message. Each agent carries a credential derived from its ATT position. When agent ai invokes subagent aj, the invocation must present a delegation token proving that (ai, aj) ∈ E and that the requested permissions satisfy the monotonicity constraint. Any invocation that cannot produce a valid delegation token is rejected before execution.
Trust topology defines the structure of agent relationships. It does not quantify the organizational consequence of a failure at any node. Two agents at the same depth in an ATT may have radically different risk profiles: one agent that reads and summarizes documents carries negligible irreversible impact; another that executes API calls to modify ERP records carries substantial impact. A governance framework that treats these agents equivalently under-governs the high-impact case and over-governs the low-impact case.
Action Blast Radius is the construct that addresses this heterogeneity. It provides a per-agent risk score that determines where governance gates are required, independent of the agent's position in the ATT.
For an agent ai with tool set Ti = {t1, ..., tk} and permission scope Pi, let S = (s1, s2, ..., sm) be a feasible action sequence where each sj ∈ Ti. Define the irreversibility score Irr(sj | context) ∈ [0, 1] as the probability that action sj, given prior actions in S, cannot be undone within the organizational recovery window Worg.
The Action Blast Radius of agent ai is:
ABR(ai) = maxS feasible Σj Irr(sj | s1,...,sj-1)
An agent requires a human approval gate before tool execution when ABR(ai) > τ, where τ is the organizational ABR tolerance threshold (a deployment-specific constant, set by the governance team). A governance gate is defined as a synchronous human confirmation step that interrupts the action sequence before any irreversible action executes.
The effective ABR of an orchestrator agent ai that may delegate to subagents aj1, ..., ajk is not bounded by ABR(ai) alone. The orchestrator can compose an action sequence that invokes multiple subagents in series, accumulating irreversible impact across delegation boundaries. Therefore:
ABReff(ai) ≥ ABR(ai) + maxj ABReff(ajk)
This property is an existence result derivable from the definition and implies that governance gate placement must account for the full delegation subtree rooted at ai, not only the tools directly available to ai. Organizations that calculate ABR at the individual agent level without accounting for delegation subtrees systematically underestimate organizational risk.
In practice, Irr(sj | context) is approximated by a classification function trained on the organization's tool inventory. Tools that modify external systems (CRM writes, ERP transactions, code commits, email sends, API calls to third-party services) carry high irreversibility scores. Tools that read or classify data carry low scores. The threshold τ is a governance parameter set by the organization's risk function, calibrated to the recovery window Worg and the compliance exposure of the specific deployment context.
Governance gates based on ABR thresholds assume that a human reviewer is available to approve the flagged action within a time window compatible with the agent's task requirements. This assumption becomes structurally false at sufficient delegation depth. An agent operating at depth 5 in an ATT, spawned by an agent spawned by an agent spawned by an orchestrator spawned by a human-initiated task, may be executing actions within milliseconds of spawning, in a context window that no human has reviewed, making decisions that depend on outputs from four intermediate agents each of which has introduced its own interpretation of the original intent.
The Delegation Depth Limit defines the maximum depth at which governance gates remain practically enforceable.
In a multi-agent system with ATT = (A, E, P, Rev), the delegation depth of agent ai, denoted depth(ai), is the length of the longest directed path from the human-authority root ah to ai in E. Let L(ai) be the expected human review latency for agent ai (the time from governance gate trigger to human approval), and let W(ai) be the action execution window (the time within which the agent's action must complete for the task to remain valid).
The Delegation Depth Limit is:
DDL = max{d : ∀ ai ∈ A with depth(ai) = d, L(ai) ≤ W(ai)}
For agents operating at depth > DDL, L(ai) > W(ai): human review cannot complete within the action window. At these depths, governance gates must be replaced by automated policy enforcement: pre-approved action whitelists, hard tool restrictions, or synchronous policy engine evaluation that completes without human latency.
ABReff is non-decreasing in delegation depth (by Observation 2). DDL is the depth at which human governance ceases to be available. Together, these properties create a depth-risk inversion: organizational risk increases with depth, while governance capacity decreases with depth. The inversion point, the depth at which ABReff exceeds τ and depth simultaneously exceeds DDL, defines the structurally ungovernble zone of a multi-agent deployment. Any agent operating in this zone requires either automated governance controls adequate to substitute for human oversight, or architectural redesign to reduce depth or ABR.
L(ai) depends on the organization's human review infrastructure: the notification latency from governance gate to reviewer, the reviewer's response time distribution, and the time to communicate approval back to the agent. W(ai) depends on the task structure: real-time customer interactions may have W measured in seconds; back-office document processing may have W measured in minutes. For most enterprise deployments, practitioners report (directionally) that DDL falls between depth 2 and depth 4. Above depth 3, human review latency typically exceeds task execution windows for time-sensitive use cases. Below depth 2, the orchestrator-level human oversight is generally sufficient for low-ABR tasks.
The three constructs, ATT, ABR, and DDL, define a capability surface against which organizations can assess their current state and identify the next-priority investment. The Multi-Agent Governance Maturity Model (MAGMM) formalizes this surface as four levels, each defined by concrete, verifiable criteria against all three constructs.
No ATT is defined or enforced. Agent permissions are set ad hoc at deployment time and not tracked as an organizational artifact. ABR has not been calculated for any agent in the deployment. DDL has not been defined. New multi-agent tasks are launched without a registry check. Governance incidents, when they occur, are diagnosed individually without reference to a shared topology. This is the modal enterprise state as of 2026, as multi-agent frameworks have been adopted faster than governance capabilities have been built.
An ATT has been documented for at least the top-level orchestrator and its direct subagents. ABR has been calculated for the orchestrator and any agents with external tool access. DDL has been discussed but not formally defined or enforced. The ATT exists as a configuration document but is not enforced at runtime: agents can invoke other agents outside the registered topology. Permission monotonicity is not automatically verified. At Level 2, the ATT is an auditing tool rather than a control.
The ATT is enforced at runtime via delegation token verification. Every inter-agent invocation presents a credential proving its registered trust edge and permission scope. ABR is calculated for all agents in the deployment and governance gates are placed automatically for agents where ABR(·) > τ. DDL is formally defined for the deployment context and agents operating beyond DDL are constrained to automated policy enforcement rather than human review gates. The ATT is a live infrastructure artifact, not a document.
The ATT is updated dynamically as the deployment evolves: new agents are registered with ATT-compatible credentials before they execute any actions. ABR thresholds are calibrated continuously against observed action outcomes rather than set statically at deployment time. DDL is monitored against empirical latency measurements from the governance gate infrastructure and adjusted when organizational review capacity changes. Multi-agent deployments inherit the governance topology automatically on launch, requiring no per-deployment configuration. At Level 4, the MAGMM constructs are infrastructure, not policy.
| Level | ATT Criterion | ABR Criterion | DDL Criterion |
|---|---|---|---|
| 1. Ungoverned | No ATT defined | No ABR calculated | No DDL defined |
| 2. Mapped | ATT documented for top-level agents; not runtime-enforced | ABR calculated for orchestrator and external-tool agents; τ not set | DDL discussed; not formally defined |
| 3. Enforced | ATT enforced via delegation tokens at runtime; monotonicity verified | ABR calculated for all agents; governance gates placed at ABR > τ | DDL formally defined; agents beyond DDL use automated policy enforcement |
| 4. Adaptive | ATT updated dynamically; new agents registered before first execution | ABR thresholds calibrated against observed outcomes; continuous | DDL monitored empirically; adjusted to actual review latency data |
NIST AI RMF [7] maps risk management to four functions: Govern, Map, Measure, Manage. The ATT construct implements the Map function at the inter-agent level, providing a formal artifact for identifying which agents exist and how they relate. ABR implements the Measure function at the action level. DDL implements a novel Govern capability not addressed in RMF: the criterion for when automated controls must substitute for human oversight. NIST AI RMF does not define this criterion formally.
ISO/IEC 42001:2023 [8] specifies management system requirements for AI, including output monitoring and human oversight provisions. The standard does not define the structural conditions under which human oversight ceases to be feasible, which is the core problem DDL addresses. The ATT+ABR+DDL framework is complementary to ISO 42001 and can serve as the technical implementation layer for its oversight requirements in multi-agent contexts.
The ABR formalism requires that Irr(sj | context) be estimable for each tool in the agent's inventory. For novel tool combinations, this estimation is imprecise. The DDL definition requires empirical measurements of L(ai) and W(ai) that may not be available for new deployment types. Both are engineering approximations that improve with deployment experience rather than closed-form solutions derivable prior to deployment.
The ATT formalism assumes a static trust graph registered at deployment time. Dynamic agent architectures, in which agents spawn other agents at runtime without pre-registration, require extensions to the ATT model not fully developed here. The Observation 1 acyclicity result constrains what is governable; it does not prevent ungovernable architectures from being deployed.
Prompt injection attacks [3] in multi-agent contexts attempt to induce an agent to delegate elevated permissions to an adversarially controlled subagent, violating the permission monotonicity constraint. A runtime-enforced ATT with delegation token verification directly blocks this class of attack: an agent that has been injected with an instruction to invoke an unregistered subagent cannot produce a valid delegation token for that invocation. This is a security consequence of the governance topology that complements the adversarial defenses documented in AgentDojo [5].
This paper has introduced three formal constructs for the governance of enterprise multi-agent AI deployments. Agent Trust Topology (ATT) provides a directed graph formalism for inter-agent trust, permission inheritance, and revocation authority. Action Blast Radius (ABR) provides a scalar metric for the maximum irreversible organizational impact of an unchecked agent action chain, enabling threshold-based governance gate placement. Delegation Depth Limit (DDL) provides a formal criterion for the maximum delegation depth at which human oversight remains structurally possible.
Together, these constructs name three governance properties that have previously been either informally managed or entirely absent from enterprise multi-agent deployments. The Multi-Agent Governance Maturity Model translates them into a four-level assessment framework with concrete, verifiable criteria at each level.
The urgency of this framework increases with deployment scale. As organizations move from single-orchestrator pilots to enterprise-wide agentic deployments spanning dozens of agent types and hundreds of concurrent sessions, the absence of a formal governance topology does not remain a background risk. It becomes an active organizational liability, accumulating with every deployment that launches without an enforced ATT, every agent whose ABR has not been calculated, and every delegation chain that extends beyond the DDL without automated controls. The constructs introduced here provide the vocabulary and the formal structure to begin closing that gap.
Future work includes empirical validation of DDL estimates across deployment types, development of the dynamic ATT extension for runtime agent registration, and formal verification methods for permission monotonicity at the runtime level.
© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. All rights reserved. Academic citation permitted with attribution; commercial use and derivative frameworks require written permission.