Keeping AI agents within their assigned authority

Teams of AI agents often divide responsibilities: one plans, another retrieves evidence, another verifies, and another executes. But assigning roles does not ensure that agents respect them throughout a conversation. A verifier might start directing work, or a retriever might turn a policy passage into a decision it was never authorized to make.

Maisha Maliha, Vishal Pramanik and Sumit Kumar Jha call this problem role drift. Their November 2026 arXiv preprint, which is marked as accepted at EMNLP 2026, introduces Agent Trajectory Control, or ATC. It checks and revises proposed messages before other agents receive them.

Checking authority, not just usefulness

The central distinction is between a contribution’s content and its authorization. A statement can be factually correct yet violate the producing agent’s responsibilities. ATC makes those responsibilities explicit through role descriptions, examples, permitted interaction functions, and contracts specifying required and prohibited behaviors.

A fixed encoder maps each proposed output, together with conversational context, into a numerical representation of its behavior. ATC then combines four signals: deviation from the assigned role, overlap with other agents’ roles, impermissible speech acts, and logical contract violations. Together, these form a role-drift score.

For example, a verifier’s proposal to assign tasks could be revised into a statement about checking whether a proposed plan satisfies the constraints. The intended useful contribution remains, but its function changes from planning to verification.

The controller computes a corrected numerical target that stays within the assigned role’s representation while discouraging overlap with other roles. It then guides a model to revise the message and checks the result again. Full ATC performs correction at every turn; a separately evaluated gated version regenerates only proposals whose drift score exceeds a threshold.

Because this process operates on messages, it does not require access to the generating model’s internal activations. However, the auxiliary encoder, classifiers and role contracts remain necessary components.

Reported gains across three benchmarks

The researchers evaluated ATC on enterprise workflows, general multi-agent collaboration, and software issue resolution using EntCollabBench, MultiAgentBench and SWE-bench Verified. Main experiments used ten agents sharing one model, ten agents using different model families, and twelve agents spanning at least five families. Reported results are averages over three seeds.

Comparisons included role prompting, explicit role labels, agent memory, activation-editing methods, a fixed role-specialized workflow, and a single-agent system. The paper reports matched prompts, context and retrieval budgets, tool access, turn limits and stopping criteria, although actual computational usage differed.

In the twelve-agent heterogeneous setting, ATC achieved enterprise workflow task success of 76.4, compared with 66.8 for SOP-Role, the strongest baseline on that task. Its MultiAgentBench score was 71.1 versus 61.5, while its SWE-bench Verified resolved issue rate was 44.2 versus 36.4.

On the enterprise benchmark, role consistency rose from 78.2% with SOP-Role to 93.5% with ATC. The controller also performed better in stress tests that asked agents to take over another role, routed results through an unauthorized agent, or revised an earlier decision. These are reported benchmark findings, not evidence that every deployment will improve similarly.

Boundaries have costs and limits

Removing individual components reduced performance, with the largest drop following removal of the role-subspace term. The experiments also favored softly discouraging role overlap rather than forbidding it outright: different roles legitimately share activities such as reasoning, clarification and evidence use.

Correction added overhead. In the twelve-agent enterprise setting, ATC averaged 132,800 generated tokens and 32.4 seconds per episode, compared with 126,200 tokens and 28.5 seconds for SOP-Role. Gated correction offered lower-cost operating points with reduced performance.

The mathematical guarantee is narrow: it concerns the numerical correction objective, not a guaranteed decrease in every violation after text regeneration. Role consistency was assessed through a fixed rubric and automated judging, which the authors acknowledge may introduce bias. Incomplete role definitions can also miss violations or suppress useful contributions.

Most importantly, staying within a role does not make an answer true, unbiased or safe. ATC addresses authority confusion within a team; it does not replace factual verification, human oversight or other safeguards.