Broken at the Seams

Swarochish C Mnemos AI

Paper 2 in the Mnemos AI working-paper series on trust and interaction in agentic AI.

Abstract

Multi-agent systems built on large language models (LLMs) are now shipping into production pipelines across software engineering, customer operations, enterprise knowledge work, and scientific workflows. The empirical record of these deployments is stark. An early systematic evaluation reports failure rates between 41% and 86.7% across seven state-of-the-art open-source multi-agent frameworks on standard benchmarks (Cemri et al., 2025); comparable production telemetry is not yet publicly available. Summing that study's two largest failure categories, as Acharya (2026) does, places roughly four in five of the observed failures outside the reasoning capability of the constituent models. They trace to specification ambiguity, coordination error, and handoff degradation — to the seams between agents and between agents and humans. This paper argues that the interaction layer is the binding constraint on agentic systems and that the field's treatment of it as implementation plumbing is the proximate cause of the failure rate. We formalise the interaction layer as the set of all points where control, context, or commitment crosses a boundary between distinct reasoning parties, identify three canonical seams (human-to-agent, agent-to-agent, agent-to-human), and define six property axes (identity asymmetry, context discontinuity, reference frame, commitment durability, recoverability, observability) along which every seam can be characterised. Using this frame we re-read the MAST failure taxonomy, the A2A and MCP protocol-security literature, the classical human-automation canon, and the emerging agent-drift literature as one coherent phenomenology of seam collapse rather than fourteen disconnected defect classes. We then prescribe ten design principles for interaction-layer engineering — specification precedes orchestration; context is a contract; capability provenance; verification gates at every seam; warm handoffs; blast-radius containment; observable reasoning; explicit authority graphs; reversibility of commitments; economic and service-level-agreement layering for coordination — each pinned to specific literature-documented failures and each accompanied by a measurable architectural implication, a falsification-ready metric, and a named anti-pattern. We define a seam-coverage metric and state a falsifiable hypothesis: in matched production workloads, seam-coverage scores will correlate inversely with incident rates attributable to specification, coordination, and handoff defects, and the correlation will be stronger than any correlation between headline model-capability benchmarks and the same incident rates. If the relationship does not hold, the thesis is wrong. We propose SeamBench as a benchmark extension to expose failures that individual-agent benchmarks are measurement-theoretically unable to detect, and we reconstruct three canonical failure patterns — ChatDev-style coordination breakdown, A2A trust-assumption compromise, and cognitive-crumple-zone handoff collapse — to show which principles would have prevented each. The contribution is not a new framework for yet another narrow defect class. It is a shift in where the engineering attention sits. Interaction, not inference, is where agentic systems are currently breaking, and interaction is where the next generation of engineering discipline is needed.

1. Introduction: The Interaction Crisis

1.1 The empirical picture

Multi-agent LLM systems fail in production at rates that, in any other branch of software engineering, would halt deployment. Cemri et al. (2025) developed their taxonomy from 150 expertly annotated traces (inter-annotator kappa = 0.88) and released MAST-Data, 1,642 annotated execution traces across seven open-source multi-agent frameworks, finding failure on 41% to 86.7% of runs depending on the system and the task. Acharya (2026) restates those figures and names Semantic Intent Divergence as the mechanism, though the numbers are inherited from Cemri et al. rather than independently measured. The magnitude of the signal is not in dispute. Its interpretation is.

Two features of the data matter more than the headline rate. First, failure rates do not move monotonically with model capability. Swapping a stronger frontier model into a failing orchestration changes the distribution of failure modes but does not collapse the aggregate rate (Tran & Kiela, 2026; Cemri et al., 2025). The binding constraint is not what each agent can reason about in isolation. Second, the failure taxonomies that do exist converge on a structural observation: Cemri et al. (2025) distribute their failure modes across specification issues (41.8%), inter-agent misalignment (36.9%) and task verification (21.3%). Summing the first two, as Acharya (2026) does, places approximately 79% of documented failures in categories — specification violations, inter-agent misalignment, verification lapses — that have nothing to do with an agent's individual reasoning ceiling and everything to do with what happens at the points where reasoning transfers from one party to another.

This is the interaction crisis. The seams break before the agents do.

1.2 The dominant misdiagnosis

Three programmes currently dominate the research response, and each, taken alone, is insufficient.

The first is failure taxonomy. MAST — the Multi-Agent System Failure Taxonomy of Cemri et al. (2025) — and the conflict-centric analysis of Acharya (2026) have produced the first rigorous defect vocabularies for the field. They are necessary but not prescriptive. A taxonomy tells us what breaks. It does not tell us what architectural move would have prevented the breakage, nor does it tell us how to measure the absence of the defect before the system is deployed.

The second is theoretical critique. La Malfa et al. (2025) argue that current LLM-based multi-agent systems miss the defining commitments of classical multi-agent systems research — genuine autonomy, game-theoretic interaction, normative constraint (Wooldridge, 2009; Stone & Veloso, 2000) — and that the label "multi-agent" is therefore misapplied to what are typically monolithic prompt orchestrations. The critique is correct and it diagnoses a category error, but a category error does not by itself yield a design programme for practitioners who must ship next quarter.

The third is protocol proliferation. MCP (Model Context Protocol), ACP (Agent Communication Protocol), A2A (Agent-to-Agent), and ANP (Agent Network Protocol), surveyed by Ehtesham et al. (2025), offer increasingly elaborate transport and discovery layers for agent interoperability. The security literature that has grown up in response — Louck et al. (2025) on A2A trust-assumption exposure, Anbiaee et al. (2026) on cross-protocol threat modelling, Zheng and Zhang (2026) on conformance testing — is already catching specific vulnerabilities. But protocols encode message mechanics. They do not by themselves encode the interaction properties whose absence causes failures, and a compliant protocol implementation can still exhibit every class of coordination defect in MAST.

Each programme captures a slice. None integrates. The integration this paper proposes is that the three programmes are pointing at the same object from different angles: the interaction layer, treated as a first-class engineering concern with seams, property axes, and prescriptive design principles. Making that integration explicit is what lets the observed failures become predictable, preventable, and measurable. The claim is falsifiable. If adherence to the design principles articulated in Section 5 does not correlate with reduced failure rates on matched production workloads, the thesis of this paper is wrong.

1.3 Contributions

This paper makes four contributions.

1. A formal model of the interaction layer. We define the interaction layer, name its three canonical seams (H→A, A→A, A→H), and give six property axes along which every seam can be characterised. The model is compact enough to fit on a whiteboard and expressive enough to accommodate every failure mode in the cited literature.
2. A seam-lens re-reading of the empirical literature. We map the 14 MAST failure modes, the A2A and MCP security findings, the classical human-automation failures, and the emerging agent-drift literature onto the three-seam model. The mapping is compressive: disparate defect classes resolve to a smaller set of underlying seam properties.
3. Ten prescriptive design principles. Each principle is pinned to specific literature-documented failures it would prevent, carries an architectural implication, is accompanied by a measurement, and names its anti-pattern. Practitioners can adopt the principles as design review criteria without waiting for the research community to converge.
4. A seam-coverage metric and SeamBench proposal. We define a falsifiable seam-coverage metric and sketch SeamBench as a benchmark extension that addresses the measurement-theoretic gap in existing individual-agent benchmarks.

The remainder of the paper is organised as follows. Section 2 surveys related work. Section 3 develops the interaction-layer model. Section 4 re-reads the empirical literature through it. Section 5 prescribes the ten design principles. Section 6 operationalises the model with a seam-coverage metric and the SeamBench proposal. Section 7 reconstructs three canonical failure patterns. Section 8 draws implications for researchers, builders, investors, and standards bodies. Section 9 states limitations. Section 10 concludes.

2. Related Work

2.1 Failure taxonomies

Cemri et al. (2025) provide the first systematic failure study of multi-agent LLM systems. From 150 annotated traces the authors derive 14 failure modes, validated across MAST-Data's 1,642 traces from seven systems, grouped into three families: specification and design, inter-agent misalignment, and task verification and termination. The summation of its two largest categories — roughly 79% of failures not attributable to single-agent model capability, an inference on top of the study rather than a finding it states — is the load-bearing datum for this paper. Acharya (2026) narrows the lens to enterprise pipelines and introduces Semantic Intent Divergence, a failure mode in which successive agents progressively reinterpret task intent until downstream behaviour is orthogonal to upstream specification. Acharya's process-aware framing is complementary to MAST: where MAST classifies, Acharya explains the mechanism by which classification-level defects propagate.

2.2 Theoretical critique of LLM-based MAS

La Malfa et al. (2025) make the strongest available theoretical argument that current systems branded as multi-agent miss the definitional commitments of the field. Classical multi-agent systems research (Wooldridge, 2009; Stone & Veloso, 2000) assumes genuinely autonomous agents with distinct utility functions, strategic interaction, and normative structure. La Malfa et al. show that most deployed LLM "multi-agent" systems are prompt chains with a shared utility function and no game-theoretic substrate. The critique matters for our purposes because it clarifies that many interaction-layer failures are failures of simulated coordination within what is effectively a distributed prompt, and that the absence of genuine coordination primitives is itself a seam defect.

2.3 Agent-interoperability protocols and their vulnerabilities

Ehtesham et al. (2025) survey MCP, ACP, A2A, and ANP and catalogue their coverage of discovery, transport, authentication, and capability exchange. The survey is careful to note that protocols operate below the interaction semantics that govern whether a given handoff will succeed behaviourally. The security sub-literature makes the consequences concrete. Louck et al. (2025) show that in the Google A2A protocol, sensitive-data exposure and unintended-harm propagation arise from trust-assumption assumptions the protocol does not verify. Anbiaee et al. (2026) model threats across MCP, A2A, Agora, and ANP and find a consistent pattern: identity and capability claims are accepted without conformant verification. Zheng and Zhang (2026) propose conformance testing for agent protocols as a concrete remediation. Across these three, the structural finding is identical. Transport correctness does not imply interaction correctness, and the seam between agents needs verification primitives that current protocols do not supply.

2.4 Human-agent handoffs

Classical human-automation research anticipated many of the failures now re-emerging in agentic systems. Bainbridge (1983) identified the core irony: the more capable the automation, the more catastrophic the residual role left to the human. Lee and See (2004) formalised trust in automation as a calibration problem — appropriate reliance requires that the operator's trust match the system's actual reliability — and named the two dominant failures, disuse and overreliance. Parasuraman and Riley (1997) extended the taxonomy to misuse, disuse, and abuse. Elish (2019) named the moral crumple zone: when an automated system fails, accountability collapses onto whichever human was closest to the system regardless of whether that human had meaningful control. Zou et al. (2025) survey LLM-based human-agent collaboration and find the classical failure modes reproducing in agentic contexts with minimal adaptation — context is stripped at the point of handoff, alerts replace reasoning, and operators are positioned as last-line catchers of failures they had no opportunity to prevent.

2.5 Trust and robustness in agentic AI

Raza et al. (2025) synthesise the TRiSM (trust, risk, and security management) literature for agentic systems and identify trust calibration, provenance, and auditability as the three axes most underspecified in current architectures. Huang et al. (2024) study resilience under faulty agents and show that collaboration structure dominates individual agent reliability in determining system-level outcomes — a pair of reliable agents in a brittle topology outperforms a brittle pair in no topology, but a reliable pair in a correctly structured topology outperforms both. The resilience result is consistent with our thesis: interaction structure is a first-order determinant of behaviour. Our prior work (C, 2026) develops a unified trust architecture across human, agent-human, and agent-agent boundaries; the present paper operates at one layer below that architecture, specifying the interaction primitives on which trust relations depend.

2.6 Agent drift

Rath (2026) introduces agent drift as a distinct phenomenon: behavioural degradation over extended interactions that is not explained by any single-step failure. Drift is temporal where the other failure classes are structural. It accumulates across many interactions, often across seam crossings, and it is invisible to benchmarks that measure one-shot task completion. We treat drift as a composite cascade phenomenon in Section 4.4 rather than a distinct seam failure, because the mechanism by which drift accumulates is repeated seam degradation rather than a novel failure mode.

2.7 The integration gap

Each of these lines has produced real results. None integrates with the others. Failure taxonomies describe defects without prescribing architecture. Theoretical critiques identify category errors without supplying primitives. Protocol work supplies transport without interaction semantics. Human-automation research supplies principles that have not been reconnected to agent-to-agent coordination. Trust frameworks sit above the layer at which defects actually occur. The integration gap is the object of the remaining sections.

3. The Interaction Layer

3.1 Definition

We define the interaction layer as the set of all points in an agentic system where control, context, or commitment crosses a boundary between distinct reasoning parties. A reasoning party is any entity — human, single agent, or agent subsystem — whose state and inferences are not directly inspectable by the party on the other side of the boundary. The boundary is the locus at which three things must be reconstructed: identity (who is acting), context (what is known), and authority (what may be done). Every invocation of another agent, every tool call that returns to an orchestrator, every user confirmation, and every escalation to a human is a boundary crossing and therefore a site of potential seam failure.

The definition is intentionally narrow on two dimensions. It does not include intra-agent reasoning. It does not include message transport. What it includes is the semantic transition at the boundary, which is precisely what the literature shows is underspecified.

3.2 The three-seam model

Three canonical seams exhaust the interaction surface of a typical agentic system.

H→A (human to agent). The human initiates, specifies, or clarifies. Dominant failure modes: specification ambiguity (Cemri et al., 2025), intent underspecification that compounds downstream (Acharya, 2026), and the classical misuse/abuse failures of inappropriate delegation (Parasuraman & Riley, 1997). Dominant mitigations: explicit specification capture, verification of shared intent before execution, and authority scoping at the point of initiation.

A→A (agent to agent). One agent invokes, delegates to, or receives output from another. Dominant failure modes: capability-claim forgery (Louck et al., 2025; Anbiaee et al., 2026), context discontinuity across the invocation (Cemri et al., 2025, MAST categories FM-2.1 through FM-2.6), and cascaded reinterpretation (Acharya, 2026). Dominant mitigations: capability provenance, context contracts, verification gates.

A→H (agent to human). An agent returns control, requests input, or escalates. Dominant failure modes: alert-without-reasoning handoffs (Zou et al., 2025), moral-crumple-zone accountability collapse (Elish, 2019), and trust miscalibration (Lee & See, 2004). Dominant mitigations: warm handoffs carrying context and reasoning, explicit authority transfer, and observability of the reasoning that produced the escalation.

Each seam has distinctive failure modes because each seam has distinctive asymmetries. H→A is asymmetric on capability; A→A is asymmetric on context; A→H is asymmetric on accountability. A unified design programme must address all three and must recognise that a single user journey typically crosses each seam multiple times.

3.3 Six property axes

Any seam can be characterised along six property axes. A well-engineered seam is explicit on all six; a poorly engineered seam leaves one or more implicit, which is where the failures cluster.

1. Identity asymmetry. What does each party know about the other's identity, capabilities, and constraints? Is identity cryptographically verified or claimed? Louck et al. (2025) show that A2A trust-assumption failures trace directly to unverified identity assertions.
2. Context discontinuity. How much of the originating reasoning context survives the crossing? Most MAST category FM-2 failures are context-discontinuity failures (Cemri et al., 2025).
3. Reference frame. Do the parties share units, ontologies, and assumptions? Semantic Intent Divergence (Acharya, 2026) is a reference-frame failure accumulated across multiple seam crossings.
4. Commitment durability. Is what was agreed at the seam binding, revocable, or unenforceable? Drift (Rath, 2026) is in large part a consequence of low commitment durability: early constraints are not enforced on later behaviour.
5. Recoverability. If the crossing fails, can the system unwind to a known-good state? Verification-and-termination failures in MAST (Cemri et al., 2025, FM-3) are recoverability failures.
6. Observability. Can a third party (auditor, orchestrator, operator) inspect what was exchanged at the seam and why? Raza et al. (2025) treat observability as a first-order TRiSM requirement.

The six axes are not claims that all seam problems reduce to six scalars. They are the minimum vocabulary required to describe whether a seam is engineered or left implicit. A design review that walks these six axes for every seam in an architecture will surface the defects the empirical literature repeatedly catches in production.

3.4 Why individual-agent benchmarks cannot detect seam failures

Individual-agent benchmarks — AgentBench, GAIA, AgentBoard — evaluate a single agent against a task specification the benchmark defines. The benchmark author plays the H→A seam perfectly; the evaluation harness plays the A→H seam perfectly; A→A is typically absent. This is measurement-theoretically sufficient to evaluate an agent's reasoning capability in isolation but is structurally unable to surface seam failures, for a simple reason. A seam failure requires at least two parties whose assumptions can diverge. A benchmark that constructs one side of every seam perfectly has eliminated the variable under test. Benchmarks that include multiple agents (MultiAgentBench, τ-bench user simulation) partially address the A→A and A→H seams but still hold the specification side of H→A constant, which is precisely where Acharya (2026) locates the dominant root cause. The consequence is that an agent can top capability benchmarks and still fail in production, because the benchmark did not exercise the layer at which production systems break. This gap is what Section 6 addresses.

4. Failure Reframed: The Literature Through the Seam Lens

4.1 MAST failure modes mapped to seams and principles

The fourteen MAST failure modes (Cemri et al., 2025) resolve cleanly onto the three-seam model and the ten design principles of Section 5. Table 1 gives the mapping.

Table 1. MAST failure modes mapped to seams and design principles.

The table compresses the taxonomy. Fourteen failure modes resolve into pressure on six property axes, which in turn are addressed by a smaller set of principles. Compression is the test of whether the frame is doing work; the mapping here is not forced.

4.2 Protocol-security failures as A→A seam failures

Louck et al. (2025) document exposures in Google A2A in which an agent's trust assumptions is accepted without verification, enabling both sensitive-data leakage and unintended-harm propagation. Anbiaee et al. (2026) generalise the finding across MCP, A2A, Agora, and ANP: each protocol has structural points at which identity or capability claims are accepted as asserted. Zheng and Zhang (2026) propose conformance testing to catch such cases. All three are A→A seam failures on the identity-asymmetry axis. The protocols supply transport; they do not supply verification of what is asserted at the seam. The design principle implicated is P3 (capability provenance), operationalised by P4 (verification gates). The pattern is repeated across every protocol surveyed by Ehtesham et al. (2025) because the failure is not a protocol bug but a missing interaction primitive.

4.3 Handoff failures as A→H seam failures

The human-automation canon is the oldest part of the literature and the most directly applicable to the A→H seam. Bainbridge's irony (1983) predicts that systems which automate the easy cases and escalate the hard ones place the human at the point of minimum context and maximum consequence. Zou et al. (2025) observe precisely this pattern in surveyed LLM-based human-agent systems: agents escalate with alerts rather than reasoning, operators are given decisions they cannot make without the context the agent possesses, and the crumple-zone effect identified by Elish (2019) reappears. Lee and See (2004) formalise the calibration problem — operators over-trust agents that surface only confident conclusions, then collapse into under-trust on the first visible failure. Warm handoffs (P5), observable reasoning (P7), and explicit authority graphs (P8) are the design responses. The principles are not novel on their own; the novelty is in treating them as interaction-layer requirements rather than UX polish.

4.4 Semantic Intent Divergence and agent drift as composite cascades

Semantic Intent Divergence (Acharya, 2026) and agent drift (Rath, 2026) are not single-seam failures. They are cascades that accumulate across multiple seam crossings. Intent Divergence propagates when each agent in a chain reinterprets the task slightly, and the reinterpretations compound because no seam in the chain is enforcing reference-frame continuity. Drift propagates when commitment durability is low at each seam, so early constraints wash out over long interactions. Both failures are invisible to any analysis that examines seams in isolation, but both are addressable by principles that operate across the composite: context contracts (P2) that carry the originating specification through every hop, verification gates (P4) that catch drift in-flight, and observable reasoning (P7) that lets an auditor detect divergence before it reaches production output. The composite nature of these failures is why Section 7 reconstructs them end-to-end rather than at a single seam.

5. Ten Design Principles for the Interaction Layer

Each principle follows the same structure: Definition, Prevents (with citations), Architectural implication, Measurement, Anti-pattern.

P1. Specification precedes orchestration

Definition. No orchestration graph is deployed until every node has a machine-checkable specification of its inputs, outputs, side effects, authority, and termination conditions. Specification is the artefact, not an afterthought of implementation.

Prevents. MAST FM-1.1 and FM-1.2 (Cemri et al., 2025), Semantic Intent Divergence (Acharya, 2026), and a substantial share of H→A reference-frame failures.

Architectural implication. Orchestration frameworks must treat agent specifications as versioned, testable artefacts and must refuse to instantiate graphs whose nodes do not satisfy a minimum specification completeness check. Specifications become part of the deployment artefact, not a README.

Measurement. Specification completeness score: the fraction of required specification fields populated and machine-checked at deployment, weighted by execution frequency. Track alongside incident rate.

Anti-pattern. "Prompt the orchestrator and hope." The anti-pattern is instantiating a multi-agent graph where node behaviour is defined only by prompt text and discovered empirically through production traces.

P2. Context is a contract, not a payload

Definition. Context transferred at any seam carries an explicit schema, provenance, and retention policy. The receiving party contracts to honour the schema; the sending party contracts to flag any departure. Context is not an opaque blob that flows downstream on best effort.

Prevents. MAST FM-1.3, FM-1.4, FM-2.1, FM-2.3 (Cemri et al., 2025); the context-discontinuity component of every long chain studied by La Malfa et al. (2025).

Architectural implication. Every agent-to-agent and agent-to-human message includes a typed context envelope. Orchestrators validate the envelope against declared schemas and refuse forward progress on silent mutations. Context retention and transformation are logged.

Measurement. Context fidelity: the fraction of source-specified context fields correctly reconstructed at each downstream seam crossing, measured by injected canary fields.

Anti-pattern. Passing the full prior transcript as context because it is too expensive to decide what the next agent actually needs.

P3. Capability provenance (declared, verified, auditable)

Definition. Every agent declares its capabilities, those declarations are verified by a party other than the agent itself, and the verification is auditable after the fact. Capability claims are not accepted on assertion.

Prevents. A2A trust-assumption failures (Louck et al., 2025), cross-protocol identity and capability spoofing (Anbiaee et al., 2026; Zheng & Zhang, 2026), MAST FM-2.5.

Architectural implication. A capability registry separate from the agents themselves. Cryptographic attestation at registration; independent verification at invocation. Capability declarations carry validity windows and revocation channels.

Measurement. Capability-claim verification rate: fraction of invocations in which the invoked agent's claimed capabilities were independently verified before execution.

Anti-pattern. Accepting the skills or capabilities field in an agent card as ground truth.

P4. Verification gates at every seam

Definition. Every seam — H→A, A→A, A→H — has an explicit verification step before control, context, or commitment transfers. Verification checks identity, context fidelity, authority, and precondition satisfaction. The gate is machine-checked and auditable.

Prevents. MAST FM-3.1, FM-3.2, FM-3.3 (Cemri et al., 2025); cascaded A2A exploit chains (Louck et al., 2025); drift accumulation (Rath, 2026).

Architectural implication. Gates are first-class objects in the orchestration graph. They can be inspected, versioned, and A/B-tested. Gate failures halt the graph or route to a defined fallback rather than silently degrading.

Measurement. Gate coverage: fraction of seam crossings protected by a verification gate. Gate efficacy: true-positive and false-negative rates against seeded defects.

Anti-pattern. "The next agent will catch it." Outsourcing verification to the receiving party, which has the least context to verify.

P5. Warm handoffs (context, reasoning, options — not alerts)

Definition. Every A→H handoff and every A→A handoff that crosses a capability boundary transfers context, the reasoning that produced the current state, and the options available at the handoff. Cold handoffs — alert without reasoning — are disallowed.

Prevents. Crumple-zone collapse (Elish, 2019), trust miscalibration (Lee & See, 2004), the alert-over-reasoning patterns observed by Zou et al. (2025), Bainbridge's (1983) residual-role failure.

Architectural implication. Handoff messages carry a structured payload: current state, reasoning trace at configurable depth, option set with consequence annotations. Handoff UIs surface that payload rather than reducing it to a notification.

Measurement. Handoff completeness score: fraction of handoffs in which the handed-off party reports having sufficient information to act without further query.

Anti-pattern. "Human in the loop" implemented as a confirmation modal with no reasoning trace.

P6. Blast-radius containment

Definition. Every agent action is executed within a pre-declared blast radius — the set of resources, data, and downstream systems it may affect if it is wrong. Blast radius is a property of the authority grant, not an emergent property of implementation.

Prevents. Unintended-harm propagation (Louck et al., 2025; Anbiaee et al., 2026); the cross-agent cascade failures documented by Huang et al. (2024).

Architectural implication. Authority grants carry scoped resource identifiers, rate limits, and reversibility requirements. A capability cannot be invoked outside its declared blast radius even if the agent attempts it.

Measurement. Blast-radius breach rate: incidents in which an action exceeded its pre-declared scope per thousand invocations.

Anti-pattern. An agent that holds write credentials broad enough to recover from any failure and therefore broad enough to cause any failure.

P7. Observable reasoning

Definition. The reasoning that produced any boundary-crossing output is observable by a third party at a configurable level of detail. Observability is a product feature, not a debug affordance.

Prevents. MAST FM-2.4 and FM-2.6 (Cemri et al., 2025); the auditability gaps catalogued by Raza et al. (2025); the drift-detection gap identified by Rath (2026).

Architectural implication. Reasoning traces are first-class artefacts with retention policies, redaction rules, and query interfaces. Traces are linked to the outputs they produced so that post-hoc audit can reconstruct why, not merely what.

Measurement. Reasoning-trace coverage: fraction of boundary-crossing outputs with a linked, inspectable reasoning trace. Trace-to-output faithfulness under spot audit.

Anti-pattern. Opaque chain-of-thought retained in server logs but not exposed to orchestrators or operators.

P8. Explicit authority graph

Definition. The system maintains a declarative graph of which parties may authorise which actions for which resources, updated as authority is delegated or revoked. Authority is modelled, not implicit in which agent happens to hold a credential.

Prevents. MAST FM-1.2 (Cemri et al., 2025); the authority-confusion patterns in A2A trust assumptions (Louck et al., 2025); the accountability collapse described by Elish (2019) and Parasuraman and Riley (1997).

Architectural implication. An authority service separate from agents, queried at every boundary crossing. Delegation is explicit, time-bounded, and revocable. Authority changes are audit events.

Measurement. Authority coherence: fraction of action attempts whose authority path can be traced to an explicit grant. Unauthorised-action rate.

Anti-pattern. Service accounts with blanket authority shared by multiple agents because scoping would be inconvenient.

P9. Reversibility of boundary-crossing commitments

Definition. Every commitment made at a seam has a defined reversibility policy: reversible with compensation, reversible within a window, or irreversible-by-design. Irreversible commitments require explicit human authority or equivalent safeguards proportional to the blast radius.

Prevents. MAST FM-3.2 (Cemri et al., 2025); the unintended-harm propagation in Louck et al. (2025); the accountability patterns in Elish (2019).

Architectural implication. Commitments are typed by reversibility class. The orchestration runtime enforces that irreversible commitments cannot be issued by agents lacking the corresponding authority, even if they technically hold the credential.

Measurement. Reversibility classification coverage: fraction of commitments with an explicit reversibility class. Time-to-reverse for reversible commitments; authority check rate for irreversible commitments.

Anti-pattern. An agent that can DELETE in production because no one ever got around to distinguishing reversible and irreversible actions.

P10. Economic / service-level-agreement layer for coordination

Definition. Agent-to-agent coordination carries an economic and service-level substrate: declared cost, latency budget, and quality expectation for each invocation, with a fallback contract if the budget is breached. Coordination is not unpriced.

Prevents. The structural critique of La Malfa et al. (2025) — that current systems lack the utility-function substrate of genuine multi-agent systems — and the drift-accumulating behaviours in Rath (2026) that are partly explained by absent economic feedback.

Architectural implication. Invocations carry SLA envelopes. Orchestrators track cost and latency per seam crossing. Budget breaches trigger fallback contracts — a cheaper agent, a cached response, a human escalation — rather than silent degradation.

Measurement. SLA coverage: fraction of seam crossings with declared cost/latency/quality budgets. SLA-compliance rate per seam.

Anti-pattern. "Run until the frontier model says it's done" as an execution policy.

5.11 How the principles compose

The principles are not independent axioms. They interlock. P1 (specification) and P2 (context) together establish the reference frame that P4 (verification) checks. P3 (provenance) and P8 (authority) together specify who may do what; P6 (blast radius) and P9 (reversibility) together bound the consequences of action. P5 (warm handoffs) and P7 (observable reasoning) together ensure that humans and third-party auditors have the information they need at the moment they need it. P10 (economic layer) provides the feedback substrate that detects erosion of the others. Removing any one weakens the set; the principles are best adopted together, sequenced by highest-leverage first, which Section 8.2 addresses.

6. Operationalisation: Measuring Seam Health

6.1 The seam-coverage metric

We define the seam-coverage metric S as the fraction of seam crossings in a deployed system that satisfy a minimum bar on each of the six property axes of Section 3.3, weighted by execution frequency. For a system with seams s₁…sₙ, each seam carrying a per-axis score a₁…a₆ ∈ {0, 1} against a defined bar, and each seam executed at frequency fᵢ:

S = ( Σᵢ fᵢ · (Σⱼ aᵢⱼ / 6) ) / ( Σᵢ fᵢ )

S ∈ [0, 1]. A system at S = 1.0 has every frequently-executed seam explicitly engineered on every axis. A system at S = 0.3 has most seams implicit on most axes.

The metric carries a falsifiable hypothesis. On matched production workloads across multi-agent systems of comparable scope, seam-coverage score S will correlate inversely with the rate of incidents attributable to specification, coordination, and handoff defects, and the correlation will be stronger than the correlation between any individual-agent capability benchmark and the same incident rate. If a representative sample of production deployments is instrumented and the relationship does not hold — specifically, if model-capability benchmarks predict failure rate as well as or better than S — the thesis of this paper is wrong and should be revised or withdrawn.

Two design choices in the metric are deliberate. The per-axis bar is binary rather than graded, because graded scoring allows sophisticated-looking engineering to compensate for a missing axis, and the empirical point of the paper is that missing axes are where systems break. The frequency weighting prevents the metric from rewarding heavily engineered seams on rarely-executed paths while leaving hot paths implicit.

6.2 Gap analysis of existing benchmarks

Individual-agent and multi-agent benchmarks as currently constructed exercise some seams and omit others. Table 2 summarises the gap.

Table 2. Seam coverage of existing benchmarks.

No benchmark in the current landscape exercises identity asymmetry with adversarial capability claims, authority-graph correctness under delegation, reversibility of commitments across a seam, or commitment durability over extended interactions. The gap is not a criticism of these benchmarks — each was designed for the question it was designed to answer. The gap is that the question the field now most needs answered is not the one any of them were designed for.

6.3 SeamBench

We propose SeamBench as a benchmark extension, not a replacement. SeamBench instruments each of the three seams with adversarial and naturalistic probes derived from the failures documented in Sections 2 and 4.

H→A probes. Under-specified tasks with hidden required fields; conflicting constraint bundles; intent that is explicit on surface but ambiguous on one of the six axes.

A→A probes. Invoked agents that assert false capabilities; context envelopes with injected canary fields to measure fidelity loss; peer agents that exhibit drift across interactions; authority claims that exceed declared grants.

A→H probes. Escalations in which the receiving human is instrumented to report decision sufficiency; crumple-zone scenarios in which the agent fails in ways that are only detectable if the human was given reasoning; reversal scenarios in which the human revokes authority mid-execution.

SeamBench scoring aggregates to a seam-coverage estimate S and reports per-seam, per-axis breakdowns. Because the probes are derived from failures documented in the cited literature, SeamBench results can be validated by comparison to production incident data where available. The falsifiability hypothesis stated in 6.1 is directly testable on SeamBench-equipped deployments.

Four design constraints on SeamBench deserve emphasis. First, probes must be adversarial-naturalistic, not purely adversarial. A benchmark whose failures only appear under synthetic attack conditions does not predict production behaviour, because the most expensive production failures are produced by naturalistic misalignments rather than malicious input (Cemri et al., 2025; Acharya, 2026). Second, probes must target the composite — multi-seam cascades — and not only isolated seams. Drift (Rath, 2026) and Intent Divergence (Acharya, 2026) are undetectable at single-seam granularity. Third, probes must include the H→A seam on the specification side, which existing benchmarks hold constant by construction. Fourth, SeamBench must report per-seam, per-axis failures rather than a single aggregate, because a system at S = 0.7 that is weak on identity asymmetry is qualitatively different from one that is weak on recoverability, and the preventive principles differ accordingly.

6.4 Minimum viable instrumentation

Practitioners cannot wait for a benchmark to standardise. The minimum viable instrumentation adoptable in weeks consists of:

1. Seam inventory. Enumerate every H→A, A→A, and A→H boundary in the deployed graph. Log count and rate per seam.
2. Per-seam property tagging. For each seam, record whether each of the six axes is explicit or implicit in the current design.
3. Context canaries. Inject schema-tagged canary fields at originating seams; measure survival at downstream seams.
4. Handoff payload audit. Sample A→H handoffs and score them against P5 (warm handoff) completeness.
5. Authority trace. Instrument every action with the authority path that authorises it; flag actions whose path does not resolve.

The instrumentation is not research-grade. It is the diligence floor for treating the interaction layer as an engineered surface rather than an emergent one.

7. Case Reconstructions

7.1 ChatDev-pattern coordination breakdown

In the ChatDev-style patterns examined by Cemri et al. (2025), a coding workflow passes a task from a product-manager agent through a designer, a programmer, a reviewer, and a tester. Observed failures include programmer agents implementing specifications the product-manager agent did not issue, reviewers approving outputs that fail the declared acceptance criteria, and testers reporting success on tests that were silently relaxed mid-run. In MAST terms the observed defects are FM-1.1, FM-2.3, FM-2.6, and FM-3.2.

Through the seam lens the failure is not five defects. It is one: the context contract at each A→A seam is implicit. Specifications mutate because P1 is absent; reference frames drift because P2 is absent; no seam has a gate to catch the drift because P4 is absent; reasoning is not observable, so the reviewer cannot see why the programmer's output diverged from the specification (P7 absent). The aggregate failure is a seam cascade. Applying P1 and P2 at the specification stage would eliminate most of the drift; P4 at each A→A seam would catch what remained; P7 would make post-hoc diagnosis tractable. The failure is not a reasoning failure. Each agent in isolation is capable. The structure between them is not engineered.

Note the direction of causation. The reviewer's approval of a defective output is the visible failure, but the reviewer is not the root cause. The root cause is that by the time the artefact reaches the reviewer, the specification the reviewer is checking against has itself been silently rewritten at the programmer seam, and the reviewer has no instrument to detect the rewrite. Fixing the reviewer — a stronger model, a sharper prompt — does not fix the system, because the reviewer is the last seam in a chain whose earlier seams are the actual point of failure. This is the structural reason why swapping in stronger frontier models does not collapse the failure rate: the agent being upgraded is rarely the agent at which the failure originates. Engineering the seams upstream of the reviewer changes the system; reinforcing the reviewer does not.

7.2 A2A trust-assumption attack

Louck et al. (2025) describe an exposure in which an agent participating in an A2A interaction can cause sensitive data to be exfiltrated or unintended actions to be executed by exploiting unverified trust-assumption assumptions. The protocol accepts the agent's declared relationships and capabilities without independent verification; downstream agents use those claims to make authorisation decisions.

Through the seam lens the failure is on the identity-asymmetry axis of an A→A seam, with a secondary failure on commitment durability. Applying P3 (capability provenance) would require the A2A registration flow to carry attested capability claims verified by a party independent of the declaring agent. P4 (verification gates) would require each invocation to re-verify capability claims within the relevant window. P6 (blast radius) would contain the exploit even if the identity check failed. P8 (authority graph) would reveal that the attacker's claimed authorisation path does not resolve to a legitimate grant. Any one of these would break the attack; all four would make it uneconomic to attempt. Zheng and Zhang (2026) propose conformance testing as a remediation, which is one instantiation of P4 at the protocol layer.

The exploit's structure generalises beyond A2A. Anbiaee et al. (2026) show equivalent identity-asymmetry gaps in MCP, Agora, and ANP, which is the strongest evidence that the problem is not a bug in any one protocol but a missing interaction-layer primitive across the category. A protocol is the wrong artefact on which to expect capability verification because a protocol's job is to move bytes reliably between agreed endpoints. Verification is a statement about the semantics of the message — whether the claims in the payload are true — which requires a registry, an attestation authority, and a verification gate, all of which live at the interaction layer rather than the transport layer. Protocols can make verification easier by standardising how attestations are carried, but they cannot do verification themselves. This is why P3 and P4 are interaction-layer principles rather than protocol-layer obligations.

7.3 Cognitive-crumple-zone handoff failure

The pattern Zou et al. (2025) document across LLM-based human-agent systems — and which Elish (2019) anticipated — is this. An agent handles a task competently up to a point, reaches an edge case, and escalates to a human with a terse alert. The human has access to the agent's output but not its reasoning, not the options it considered, and not the constraints under which it was operating. The human is expected to make a decision the agent declined to make, on less information than the agent had. When the decision goes badly, accountability lands on the human.

Through the seam lens this is an A→H seam failure on the observability and reference-frame axes, with a secondary failure on the authority-graph axis — the human was positioned as the decision-maker without being positioned as the decision-capable party. P5 (warm handoffs) would require the escalation to carry reasoning and options, not just an alert. P7 (observable reasoning) would expose the agent's reasoning trace at configurable depth. P8 (authority graph) would clarify which party has the authority, and therefore the responsibility, for the decision being escalated. Lee and See (2004) predicted the calibration failure; the design principles make the remediation explicit.

A second dimension of the crumple-zone pattern is temporal. Bainbridge (1983) identified that operators who intervene only on escalation lose the tacit familiarity with the system that would let them intervene well. Zou et al. (2025) document the modern recurrence: operators supervising LLM-based agents over weeks develop habituation that degrades their calibration in both directions — over-trust on the common case and panic on the rare case, neither well-founded. P7 (observable reasoning), if used as an ongoing supervision surface rather than only an escalation artefact, addresses the habituation problem directly. The human remains continuously in the loop at low cognitive cost, so that when the loop reaches an escalation, the human enters it with context rather than from a cold start. This reframes "human in the loop" from a control primitive — a gate on agent action — to a calibration primitive: an ongoing channel through which the human's model of the agent stays current. The shift has implications for operator staffing, tooling, and incident response that are outside the scope of this paper but follow directly from the principles.

7.4 Pattern across the three

The three cases are superficially unlike: a coordination cascade inside a single system, a security exploit across agents, and a human-accountability collapse at the system's edge. Through the seam lens they are the same shape. Each is the accumulation of implicit engineering at the seams. Each is caught by the principles at approximately the same coverage threshold. And each illustrates the central claim: individual-agent capability did not determine the outcome. Seam engineering did.

Table 3 summarises the composite pattern across the three cases.

Table 3. Composite cascade pattern across three canonical failures.

Three different failure surfaces, three different literatures, one underlying pattern: unspecified axes at critical seams. This is the composite cascade Acharya (2026) names and Rath (2026) measures. The failure is not a defect of any one agent. It is the field's collective decision to treat the interaction layer as plumbing.

8. Implications

8.1 For researchers

Three research programmes follow directly from the frame.

First, re-annotate MAST through the seam lens. Table 1 is a starting mapping; a full re-annotation would test whether the seam-and-principle coordinates are reproducible across annotators and whether they predict preventive architectural moves more reliably than the MAST categories alone.

Second, build SeamBench. The benchmark sketch in 6.3 is a design, not an implementation. The community infrastructure that AgentBench, GAIA, and τ-bench provide for individual-agent evaluation does not yet exist for seam evaluation; building it is tractable and high-leverage.

Third, run the falsification test. The seam-coverage hypothesis in 6.1 is testable on any sufficiently instrumented production fleet. If the correlation between S and incident rate does not hold, the field needs to know as quickly as possible and the thesis of this paper needs to be revised or withdrawn. If it does hold, the field has a metric worth standardising.

8.2 For builders

Adoption is sequential. The ten principles interlock, but they do not all pay back equally on day one.

Highest leverage first. P1 (specification) and P2 (context) together close the largest category of failures by count (Cemri et al., 2025; Acharya, 2026) and require only a specification discipline and typed envelopes to implement. Neither requires new infrastructure beyond what most teams already have.

Security and authority next. P3 (provenance), P4 (verification gates), P6 (blast radius), and P8 (authority graph) together close the protocol-security category documented by Louck et al. (2025) and Anbiaee et al. (2026). These require a capability registry and an authority service, which are infrastructure lifts but are bounded.

Handoff and observability. P5 (warm handoffs) and P7 (observable reasoning) are UX-adjacent and typically require the most product work. They pay back in operator trust calibration (Lee & See, 2004) and in post-hoc auditability (Raza et al., 2025).

Reversibility and economic layer. P9 and P10 are the longest-duration investments. Reversibility requires a commitment typing discipline that most systems do not yet have; economic layering requires cost and quality telemetry that most orchestrators do not yet surface.

Which frameworks help? The honest answer is that no current framework ships with any of these principles first-class. Some frameworks make specification easier; others make tool invocation easier; none treats seam engineering as the primary surface. Builders should expect to layer interaction-layer discipline on top of whatever framework they choose.

Budget expectations. The instrumentation in 6.4 is a weeks-scale investment. The full capability registry and authority service are quarter-scale. SLA and reversibility infrastructure can be year-scale. The payback is measurable in reduced incident rate from the first seam instrumented.

8.3 For investors

Two cases on agentic-AI infrastructure diligence follow from the frame.

The bull case is that the interaction layer is a durable platform layer. It sits above transport protocols (MCP, A2A) and below application orchestration, which means it is not commoditised by either and is not replaced by frontier-model advances. Every agentic system needs specification tooling, context envelopes, capability registries, authority services, verification gates, handoff payloads, reasoning-trace stores, and SLA telemetry. Each of these is a candidate for a durable infrastructure business. The field's collective attention on model capability has left the interaction layer structurally underbuilt relative to the failure rate it governs.

The bear case is stated most sharply by Tran and Kiela (2026): under equal thinking-token budgets, single-agent systems outperform multi-agent systems on multi-hop reasoning. If frontier models continue to absorb reasoning that is currently delegated across agents, much of today's orchestration infrastructure becomes obsolete, and the interaction-layer problem collapses toward the human-agent seam alone. The bear case is not the end of interaction-layer concerns — H→A and A→H remain — but it is a material narrowing. Diligence on any interaction-layer investment should ask which of the ten principles are load-bearing in a single-agent world. P1, P2, P5, P7, P8, P9 survive single-agent collapse. P3, P4, P6, P10 diminish in value. A portfolio weighted toward the former is more robust to the Tran-Kiela scenario than one weighted toward the latter.

The diligence framework, compactly: score the target's architecture on seam-coverage S, identify which of the ten principles it treats as first-class versus emergent, and weight the principles by their survival under the bear case. That is an investable view.

Three diligence questions flow from the framework. First, what is the company's S on its own production fleet, and how has it moved over the last four quarters? A team that cannot answer the first half does not have interaction-layer instrumentation. A team that cannot answer the second half does not treat seam coverage as an engineered surface. Either answer is a signal. Second, which of the ten principles are first-class in the architecture versus emergent from prompts or agent behaviour? Principles encoded as runtime infrastructure — a capability registry, an authority service, a verification gate — are durable. Principles encoded as agent instructions degrade with model updates, prompt edits, and the entropy of production. Third, under a Tran-Kiela-style single-agent convergence, which of the company's assets survive? Companies whose value is concentrated in A→A orchestration infrastructure are more exposed than companies whose value is concentrated in specification tooling, handoff payloads, reasoning-trace stores, or authority graphs — each of which is load-bearing under any plausible scenario. A portfolio that weights by this survival profile is pricing the architectural risk, not just the model-capability risk.

8.4 For standards bodies

Protocol standards for agent interoperability — MCP, ACP, A2A, ANP, and their successors — have to date specified message mechanics. Ehtesham et al. (2025) and the security follow-ups (Louck et al., 2025; Anbiaee et al., 2026; Zheng & Zhang, 2026) show that mechanics alone do not prevent the failures. The recommendation for standards bodies is to require that conformant implementations expose interaction-layer behaviours, not merely correct message formats. At minimum: capability-claim verification (P3, P4), authority-grant traceability (P8), blast-radius declaration (P6), and reversibility classification on commitment-carrying messages (P9). A protocol that mandates these at the specification level makes the failures catalogued in the security literature harder to produce by construction rather than patchable after the fact.

9. Limitations and Threats to Validity

Five explicit caveats constrain the claims above.

First, the empirical base is early. The 41%–86.7% failure rate range (Cemri et al., 2025) and the 79% attribution to non-capability causes rest on a small number of surveyed systems and trace corpora. The numbers are the best available, but they rest on a single systematic study restated by a second paper rather than on independent replication, but they are not yet a mature body of evidence.

Second, the seam model may compress too aggressively. We argue that three seams and six axes are sufficient to describe every failure in the cited literature. It is possible that additional seams (agent-to-environment, agent-to-tool with its own semantics) or additional axes warrant separate treatment. The frame is offered as a minimum sufficient vocabulary, not a maximum.

Third, the principles are not independent. P1 through P10 interlock, which is a design strength but a measurement complication. Isolating the contribution of any single principle to a reduction in failure rate requires instrumentation most deployments do not yet carry. The falsifiability claim in 6.1 is about the aggregate metric S; individual-principle contributions are a further empirical question.

Fourth, the single-agent convergence scenario (Tran & Kiela, 2026) is not resolved. If frontier models absorb enough reasoning to collapse the A→A seam entirely, the weighting across the ten principles shifts. The paper takes the position that H→A and A→H seams remain material under any plausible scenario, but readers for whom multi-agent architecture is contingent on current-generation model limits should discount A→A-specific principles accordingly.

Fifth, the case reconstructions in Section 7 are illustrative rather than empirical. They are based on patterns documented in the cited literature, but the specific preventive effectiveness of the principles on each case is a hypothesis to be tested, not a measured result. The falsifiability claim stands or falls on production-instrumented evaluation, not on reconstruction.

10. Conclusion

Multi-agent LLM systems fail at rates that are not explained by model capability. The failures cluster at the seams — human-to-agent, agent-to-agent, agent-to-human — and the field's treatment of the interaction layer as implementation plumbing is the proximate cause. This paper proposed that the interaction layer be engineered as a first-class concern, with three canonical seams, six property axes, and ten prescriptive design principles each pinned to literature-documented failures and each measurable. A seam-coverage metric S operationalises the claim, and a falsifiable hypothesis on the relationship between S and production incident rates makes the thesis refutable. SeamBench is proposed as the community benchmark the current landscape lacks. The cases in Section 7 show that unlike failure classes — coordination cascades, security exploits, accountability collapses — resolve to the same underlying pattern through the seam lens, which is the test of whether the frame is doing work. The shift the paper argues for is not new tooling. It is where the engineering attention sits. Interaction is where agentic systems are currently breaking; interaction is where the next decade of discipline is needed.

References

Liu, X., Yu, H., Zhang, H., Xu, Y., Lei, X., Lai, H., ... & Tang, J. (2023). AgentBench: Evaluating LLMs as agents. arXiv preprint arXiv:2308.03688.

Ma, C., Zhang, J., Zhu, Z., Yang, C., Yang, Y., Jin, Y., ... & Kong, L. (2024). AgentBoard: An analytical evaluation board of multi-turn LLM agents. arXiv preprint arXiv:2401.13178.

Mialon, G., Fourrier, C., Swift, C., Wolf, T., LeCun, Y., & Scialom, T. (2023). GAIA: A benchmark for general AI assistants. arXiv preprint arXiv:2311.12983.

Yao, S., Shinn, N., Razavi, P., & Narasimhan, K. (2024). tau-bench: A benchmark for tool-agent-user interaction in real-world domains. arXiv preprint arXiv:2406.12045.

Zhu, K., Du, H., Hong, Z., Yang, X., Guo, S., Wang, Z., ... & You, J. (2025). MultiAgentBench: Evaluating the collaboration and competition of LLM agents. arXiv preprint arXiv:2503.01935.

Acharya, V. (2026). Semantic consensus: Process-aware conflict detection and resolution for enterprise multi-agent LLM systems. arXiv preprint arXiv:2604.16339.

Anbiaee, Z., Rabbani, M., Mirani, M., Piya, G., Opushnyev, I., Ghorbani, A., & Dadkhah, S. (2026). Security threat modeling for emerging AI-agent protocols: A comparative analysis of MCP, A2A, Agora, and ANP. arXiv preprint arXiv:2602.11327.

Bainbridge, L. (1983). Ironies of automation. Automatica, 19(6), 775–779.

C, S. (2026). Trust across boundaries: A unified architecture for human, agent-human, and agent-agent trust in the age of autonomous systems. Mnemos AI Working Papers, Paper 1.

Cemri, M., Pan, M. Z., Yang, S., Agrawal, L. A., Chopra, B., Tiwari, R., Keutzer, K., Parameswaran, A., Klein, D., Ramchandran, K., Zaharia, M., Gonzalez, J. E., & Stoica, I. (2025). Why do multi-agent LLM systems fail? arXiv preprint arXiv:2503.13657.

Ehtesham, A., Singh, A., Gupta, G. K., & Kumar, S. (2025). A survey of agent interoperability protocols: MCP, ACP, A2A, and ANP. arXiv preprint arXiv:2505.02279.

Elish, M. C. (2019). Moral crumple zones: Cautionary tales in human-robot interaction. Engaging Science, Technology, and Society, 5, 40–60.

Huang, J., Zhou, J., Jin, T., Zhou, X., Chen, Z., Wang, W., Yuan, Y., Lyu, M. R., & Sap, M. (2024). On the resilience of LLM-based multi-agent collaboration with faulty agents. arXiv preprint arXiv:2408.00989.

La Malfa, E., La Malfa, G., Marro, S., Zhang, J. M., Black, E., Luck, M., Torr, P., & Wooldridge, M. (2025). Large language models miss the multi-agent mark. arXiv preprint arXiv:2505.21298.

Lee, J. D., & See, K. A. (2004). Trust in automation: Designing for appropriate reliance. Human Factors, 46(1), 50–80.

Louck, Y., Stulman, A., & Dvir, A. (2025). Improving Google A2A protocol: Protecting sensitive data and mitigating unintended harms in multi-agent systems. arXiv preprint arXiv:2505.12490.

Parasuraman, R., & Riley, V. (1997). Humans and automation: Use, misuse, disuse, abuse. Human Factors, 39(2), 230–253.

Rath, A. (2026). Agent drift: Quantifying behavioral degradation in multi-agent LLM systems over extended interactions. arXiv preprint arXiv:2601.04170.

Raza, S., Sapkota, R., Karkee, M., & Emmanouilidis, C. (2025). TRiSM for agentic AI: A review of trust, risk, and security management in LLM-based agentic multi-agent systems. arXiv preprint arXiv:2506.04133.

Stone, P., & Veloso, M. (2000). Multiagent systems: A survey from a machine learning perspective. Autonomous Robots, 8(3), 345–383.

Tran, D., & Kiela, D. (2026). Single-agent LLMs outperform multi-agent systems on multi-hop reasoning under equal thinking token budgets. arXiv preprint arXiv:2604.02460.

Wooldridge, M. (2009). An introduction to multiagent systems (2nd ed.). Wiley.

Zheng, S., & Zhang, Q. (2026). AgentRFC: Security design principles and conformance testing for agent protocols. arXiv preprint arXiv:2603.23801.

Zou, H. P., Huang, W.-C., Wu, Y., Chen, Y., Miao, C., Nguyen, H., Zhou, Y., Zhang, W., Fang, L., He, L., Li, Y., Li, D., Jiang, R., Liu, X., & Yu, P. S. (2025). LLM-based human-agent collaboration and interaction systems: A survey. arXiv preprint arXiv:2505.00753.