Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems

"Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems" (arXiv:2610.00371) introduces a framework to prevent collaborative multi-agent systems from combining admissible individual contributions into prohibited joint outcomes. The paper proposes authorization-paired evaluation, a metric that treats blocking prohibited uses and completing required authorized uses as a joint success criterion, ensuring that safety controls do not disable the system's core collaborative capabilities.

To implement this, the authors developed FlowReview, a framework connecting object resolution, permission ranking, and deterministic enforcement. Their controlled experiments demonstrated that reviewing combined artifacts globally reduces the denied-commit rate from 86.0% to zero while maintaining full authorized supply, proving that preserving information lineage alone is insufficient without explicit permission binding to execution.

This material addresses a core governance problem in collaborative multi-agent systems: how to prevent harmful or unauthorized joint outcomes without resorting to coarse-grained disabling of agents or capabilities. In many MAS settings, individual agent actions may be locally reasonable, but their combination can violate policy—e.g., by enabling unauthorized data access, unsafe actuation, or prohibited workflow completion. The proposed approach, authorization-paired evaluation, couples candidate contributions with authorization checks so that the system can reason about whether a proposed multi-agent outcome is admissible as a whole, rather than merely auditing isolated actions.

Its key contribution is a control paradigm that distinguishes denial from disabling: the system can reject a specific prohibited combination while still allowing agents to make admissible contributions in other contexts. This supports finer-grained safety, security, and policy enforcement in distributed or LLM-based agent architectures, where rigid blacklists or capability removals can be overly disruptive and may fail to capture emergent compositional risks. By framing authorization as a paired evaluation of joint proposals, the work provides a more scalable path toward accountable collaboration among heterogeneous agents.

This matters because practical multi-agent systems increasingly operate in high-stakes or policy-sensitive environments, where the risk is not only what any one agent can do, but what the group can jointly accomplish. A mechanism that blocks prohibited outcomes while preserving useful, authorized collaboration helps avoid the tradeoff between safety and system utility. It also aligns with broader needs for auditable, composable governance in agentic AI, distributed robotics, and workflow automation, where control must be precise, context-sensitive, and resistant to overblocking.