Source-linked AI summary
Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance
Bowen Li, Guojun Wang
TL;DR
Existing benchmarks measure whether agents complete tasks, not whether architectural decomposition preserves policy compliance. This paper introduces Fiducia-bench and finds that decomposition degrades governance through fact attenuation at handoff boundaries, with larger effects in the 32B model than in gpt-4.1-mini.
Problem
Existing benchmarks do not test whether decomposing agents into components affects policy compliance while holding task and model constant.
Method
The paper introduces Fiducia-bench and compares architectures using machine-checkable policy packs and deterministically verifiable trajectories.
Results
Decomposition degraded policy compliance through fact attenuation: 56–85% at distance 2 for Qwen2.5-32B, 3–6% for gpt-4.1-mini, and none in the single-loop baseline.
Takeaways & Limitations
Handoff summaries are governance-critical surfaces, making structured protocols that specify required and prohibited omissions a natural intervention.
Takeaways & Limitations
Reported episodes used a scripted simulator rather than the available LLM simulator.
Abstract
from arXiv · showhide
Existing agent benchmarks ask whether the agent finished the task. We ask whether it finished it within policy. We introduce Fiducia-bench, a benchmark for the governability of financial agents---whether they escalate when obligated, abstain when required, and leave an auditable trail---and use it to study a question no prior benchmark addresses: does decomposing an agent into components degrade its governance? It does, and the mechanism is specific. Policy-relevant facts discovered by one component are attenuated at the handoff boundary before reaching the component that must act on them. In a 626-episode experiment across 100 KYC/AML task variants, two models, and three architectures, a 32B open-weights model attenuated 0% of discovered facts under a single-loop baseline, 56% under a fixed pipeline, and 85% under an orchestrator-subagent architecture (all at constraint distance 2). A stronger model (gpt-4.1-mini) attenuated 3-6% under the same conditions, suggesting the governance cost of decomposition is partly a function of model capability. Critically, the same mechanism produces both under-escalation and over-escalation, depending on whether the dropped fact was a risk signal or an exculpating one. The benchmark, all tasks, and the verification harness are open-source
1 Introduction
This section frames a gap in agent evaluation: decomposition is widely adopted for engineering reasons, but its effect on policy compliance and governability remains understudied. The paper addresses this gap by comparing architectures under fixed task and model conditions and introducing trajectory-based governance metrics.
- Motivation: Agent systems are shifting from single reasoning loops to orchestrator-subagent architectures for modularity, tool scoping, and specialization.The section asks whether this engineering decomposition weakens compliance with governing rules.
- Research gap: Existing benchmarks assess decomposition’s effect on capability, whereas this work measures its effect on governability while holding task and model constant across architectures.Prior governance studies examined single-architecture settings rather than varying architecture directly.
- Contribution: The paper reports that decomposition degrades governance through fact attenuation at the handoff boundary.This is identified as the section’s central empirical finding.
- Contribution: The paper introduces constraint propagation loss, fact attenuation, violation locus, and authority diffusion as trajectory-defined metrics that support rescoring historical runs as verifiers improve.The metrics are defined as pure functions of the trajectory.
- Scope: The studied decomposition is an engineering pattern in which one task is split across components, not multi-agent reinforcement learning.Adjacent 2026 work is discussed separately in Section 2.
2 Related Work
Prior work establishes that task completion can diverge systematically from procedural compliance and pairs action with restraint to prevent gaming. This section extends those concerns to architectural decomposition and introduces portable policy packs and scored audit reconstructability as novel contributions.
- Compliance and abstention: Corrupt Success shows a large, systematic gap between task completion and procedural compliance, while this work asks whether that gap varies across architectures.The section positions architectural variation as the paper’s extension of prior compliance-focused evaluation.
- Compliance and abstention: AgentAbstain pairs action-required and restraint-required tasks, whereas this benchmark determines correctness through obligation-based escalation and a rule hierarchy rather than model confidence.This framing makes escalation obligations—not confidence—the basis for correctness.
- Novelty: None of the cited works varies architectural decomposition, provides portable machine-checkable policy packs, or scores audit reconstructability; all three are novel here.The section identifies architectural variation, policy-pack portability, and scored audit reconstruction as gaps or contributions.
3 Benchmark Design
Fiducia-bench uses deterministic, policy-driven task environments to test whether agents obey obligations across component boundaries. Its design varies constraint distance and paired risk/exculpatory traps while enforcing auditable verification and topology-controlled context flow.
- Policy and verification: 10 rules in a YAML policy pack define deterministic checks for required actions, allow lists, asserted state, and forbidden conditions.Each rule includes an identifier, severity, readable text, and machine-readable specification.
- Task construction: Constraint distance counts the component boundaries a trigger fact crosses between discovery and the obligated action, ranging from 0 to 2.Under D0, the distance is always 0.
- Task construction: Each task includes an oracle script for governed success and at least one trap script for governed failure, with trigger facts encoding obligations, prohibitions, and chained dependencies.These facts are represented in tokens for checking whether they survive component boundaries.
- Task construction: Tasks 0004 and 0005 form a mirror pair: dropping a risk fact causes under-escalation, while dropping an exculpating fact causes over-escalation.The pair prevents agents from gaming escalation performance by always escalating.
- Task construction: 100 deterministic variants are generated from 5 seeds by varying personas, jurisdictions, amounts, and ownership percentages, and all variant oracles pass verification.A holding-company stake change from 26% to 24% can flip the ground-truth action.
- Architecture and verification: All architectures share tools, policy corpus, and prompt blocks, while topology and context assembly differ; components receive only results from their own calls.The environment owns the audit log and actor attribution, and verification replays each trajectory against fresh state at every call.
4 Metrics
The metrics are pure functions of agent trajectories and task YAML, preserving re-scorability as verifiers improve. They measure propagation loss, fact attenuation, and the locus of policy violations or authority diffusion.
- Metrics are pure functions of trajectory and task YAML, so historical runs remain re-scorable when verifiers improve.
- Propagation loss records a discovered fact paired with a missing obligated action or a taken forbidden action.Both directions are scored because under-escalation and over-escalation arise from the same mechanism with opposite outcomes.
- Fact attenuation records a discovered fact that crosses a boundary but is absent from every handoff along the path.A distance-2 task can pass when its last hop drops the fact if any semantics would otherwise pass it.
- Violation locus and authority diffusion identify which component issued the violating call, including scope-based tool-call refusals.Scope-based refusals are specific to D2.
5 Experiments
Across 626 episodes, decomposition sharply increased policy-relevant fact attenuation, while the same handoff failure caused either under- or over-escalation depending on which fact was dropped. The effect was driven by decomposition rather than policy access mode, though the experiments had important model-scale and simulator limitations.
- Headline result: 0% of facts were attenuated by D0, versus 56% by D1 and 85% by D2 for Qwen2.5-32B; gpt-4.1-mini attenuated 3% and 6%.The rates were measured at constraint distance 2, conditional on discovery, and decomposition increased attenuation relative to the single-loop baseline.
- Governance outcomes: The same dropped fact caused under-escalation when it was a risk signal and over-escalation when it was exculpating.In both paired tasks, the summarizer treated the fact as secondary, while a different component bore the consequence.
- Discovery versus transmission: 27 of 100 D2 episodes elicited trigger facts versus 16 for D0, but D2 attenuated 22 of 27 facts (81%) while D0 attenuated none.Structured delegation improved discovery of policy-relevant information but worsened its transmission across the architecture.
- Policy access: No systematic difference appeared between D0 with full policy in context and D0 with retrieval on demand across three models.The reported effect was attributed to decomposition rather than policy access mode.
- Limitations: Governed success was 8/596 (1.3%), and the attenuation signal was described as large and stable.The headline chart required a model that passed D0 as an anchor.
- Limitations: Reported episodes used a scripted simulator with substring triggers, while an LLM simulator was available but not used.The CONDUCT block was frozen before data collection, and full prompts and per-arm counts were provided in the appendices.
6 Discussion
The discussion identifies handoff summaries as a governance-critical failure surface and recommends structured protocols, while noting that decomposition costs vary with model capability but disappear without boundaries.
- Governance implications: Handoff summaries are governance-critical surfaces where information can disappear without any component acting wrongly.Structured protocols should specify required content and prohibited omissions, an intervention current practice largely ignores.
- Benchmark design: Fiducia-bench recommends environment-level tool-call attribution, state replay at each verification step, and scoring both over- and under-escalation.These choices prevent reliance on self-reports, final-state-only checks, or always-escalate behavior.
- Model dependence: D0 attenuates nothing on either model because it has no boundary, while gpt-4.1-mini’s low attenuation makes decomposition operationally tolerable in some settings.This comparison indicates that decomposition’s governance cost partly changes as models improve, but the no-boundary baseline remains stable.
7 Conclusion
The paper concludes that agent decomposition degrades policy compliance through fact attenuation at handoff boundaries, with larger effects in a 32B model than in gpt-4.1-mini and none in the single-loop baseline. The mechanism can cause either under- or over-escalation, while the benchmark and verification materials are open-source and several generalization questions remain open.
- Fact attenuation at handoff boundaries degrades policy compliance when agents are decomposed into components.The conclusion identifies attenuation during handoffs as the underlying mechanism.
- 56–85% at distance 2 under decomposition versus 3–6% for gpt-4.1-mini, while the single-loop baseline shows no effect.The larger effect occurs on the 32B model; the conclusion describes the single-loop result as absent on both models.
- The same summarization loss can suppress risk signals or exculpating findings, producing under-escalation or over-escalation.The direction of the governance failure depends on which policy-relevant fact is attenuated.
- The effect has not been shown at frontier-model scale, beyond KYC/AML, or to be irreducible through better handoff prompting.The benchmark, all 100 tasks, policy packs, and verification harness are open-source.
A System Prompts … P1 (retrieval on demand)
The system prompts hold shared instructions constant while varying only topology, comparing solo, staged handoff, and orchestrator-subagent designs under full-policy and retrieval-on-demand access modes. In P1, the policy corpus is identical to P0, but agents must consult it through a lookup tool, and reported results use P0.
- A System Prompts: All arms share two prompt blocks verbatim; only the topology paragraph varies as the independent variable.This isolates topology as the experimental manipulation.
- A.1 Shared blocks (all arms, all components): Agents treat tool results as the only ground truth, must perform checks through tools, and cannot assume routine checks occurred.The shared analyst instructions prohibit invented records and unexecuted checks.
- CONDUCT: Plain-text replies are spoken to customers, while lookups, checks, and account actions require tool calls.The prompt states that describing an unperformed step leaves the case unchanged.
- CONDUCT: Agents request only information unavailable from tools, finish by calling control finish, and remain accountable under reviewed bank policy.Actions are recorded and reviewed after the case.
- CASE (injected per task): The case identifier is injected per task, while other participants and the requested action must be established from the customer or tools.The prompt supplies customer id {subject} but no further case facts.
- A.2 Topology paragraphs (differ per arm): The solo topology assigns one agent responsibility from first contact through final decision without pre-effect review.This is the baseline topology paragraph.
- D1 — first stage; D1 — middle stage; D1 — final stage: In staged pipelines, each stage receives only the previous summary, and the final stage alone decides what happens to the case.First, middle, and final stages cannot access earlier tool results or conversations.
- D2 — orchestrator; D2 — subagent; P0 (full policy in context); P1 (retrieval on demand): In the orchestrator design, a coordinator delegates to limited-tool subagents and decides from their written reports, while P1 retrieves an identical policy corpus on demand rather than reproducing it in context.All reported results use P0 despite the P1 access-mode contrast.
B Full Grid Results
Table 6 reports the full-grid results for both models at P0, with approximately 100 episodes per arm.
- The full-grid analysis covers both models.
- The results are reported at P0.
- Each arm contains approximately 100 episodes.
C Example Task: kyc-0005 (Resolvable PEP False Positive)
Task kyc-0005 tests whether a documented two-attribute mismatch resolves a PEP name match as a false positive and prevents escalation. Dropping either exculpating fact at a handoff instead causes the deciding component to over-escalate.
- Task objective: kyc-0005 requires no escalation when date-of-birth and nationality mismatches exculpate a PEP name match.The task is the negative-obligation mirror of kyc-0004.
- Task objective: Constraint distance 2 requires mismatch facts to reach the deciding component through at least one handoff.The facts must survive every handoff as “dob mismatch” and “nationality mismatch.”
- Task execution: The oracle script elicits both attributes, runs a PEP search, resolves the match as a false positive, and approves.The trap script omits nationality, leaving only a partial mismatch and triggering incorrect escalation.
- Result: Dropping the exculpating fact causes over-escalation by making an unresolved PEP match appear to create a positive obligation.This task supplies the over-escalation finding in Table 5.