Compliant with Local Controls, Collectively Discriminatory. A Governance Architecture for Multi-Agent AI in Regulated Finance

1 Introduction

• Interacting agents can produce institution-level outcomes that local checks miss, including aggregate thin-file disadvantage despite each component satisfying local controls.The gap matters for disparate-impact exposure and supervisory questions across financial regulation.Source: §1 · p. 1
• ARIA combines six auditable finance-governance capabilities across three planes, alongside a falsifiable validation agenda with metrics, baselines, costs, and accountable artifacts.The architecture integrates population-level outcome constraints, revocable authority, runtime containment, governed policy change, human oversight competence, and layer-specific audit artifacts.Source: §1 · p. 2
• Constitutional non-compositionality names the failure of local-control guarantees to compose into collective compliance guarantees.The paper frames the claim modestly: individual checks do not by themselves imply acceptable population-level outcomes.Source: §1 · p. 2
• Institutional-outcome duties create evidence needs across fair-lending law, the EU AI Act, model-risk governance, and conduct supervision; ARIA is not presented as a legal mandate.The cited regimes include obligations concerning system behavior, oversight, post-market monitoring where applicable, observability, traceability, and intervention rights.Source: §1 · p. 2
• Two mechanism demonstrations illustrate shared-signal disparity under local fairness rules and earlier M2 warning than prohibited-outcome monitoring in a constructed drift regime.The introduction presents these as demonstrations, not production-effectiveness evidence.Source: §1 · p. 2

2.1 Regulatory convergence

• Fair-lending, EU AI Act, model-risk, conduct, prudential, and agentic-AI frameworks create evidence needs tied to outcomes, governance, monitoring, bounded autonomy, and human oversight.The cited supervisory and standards sources include,,, [9–13].Source: §2.1 · p. 3

2.2 Divergence of model-centric controls

• Existing safety and fairness approaches target individual models through training-time mechanisms or model-local checks, rather than governing interacting populations.The section discusses Constitutional AI [17] [18], deliberative alignment [19], process supervision [20], and fairness auditing; Table 1 summarizes the coverage gap.Source: §2.2 · p. 4, Table 1 · p. 4
• The central mismatch is that duties converge on collective institutional behavior while existing controls remain attached to individual components.The section also cites deployment-incentive and agentic-benchmark findings as risks ordinary training evaluations may miss [21] [22].Source: §2.2 · p. 4

3.1 Setup

• The setup distinguishes component-local principles from collective principles that constrain joint outcomes under an interaction or coupling structure.It defines κi as agent i’s local-monitor pass rate and K(A, C, I) as the pass rate of monitorable collective constraints.Source: §3.1 · p. 4

3.2 A minimal counterexample

• Two groups with identical true creditworthiness can have different aggregate approval rates despite every component passing its local procedural check, violating a population-level disparity bound.The example attributes the shift to greater measurement uncertainty for the thin-file group and a conservative score that penalizes uncertainty.Source: §3.2 · pp. 4–5

3.3 A taxonomy of non-compositionality

• The taxonomy separates outcome, interaction-induced, shared-environment, cross-agent-information, and control-plane non-compositionality, with accountability non-compositionality as another distinct type.These are different mechanisms for local controls to fail to secure collective compliance; the redlining-like demonstration is not a general proof of strategic emergence.Source: §3.3 · p. 5
• The taxonomy also includes accountability non-compositionality, where no component or owner can explain or answer for a joint outcome.Source: §3.3 · p. 5

3.4 Why verification cannot substitute for governance

• Exhaustive verification cannot replace governance because responsibility gaps are computationally hard and require observability, runtime intervention, and control revision.Responsibility gaps are described as outcomes for which no individual agent is responsible.Source: §3.4 · p. 5

3.5 Operational containment hypothesis

• Under complete mediation, measurable constraints, and bounded response latency, ARIA is hypothesized to reduce collective-violation rate, duration, and overshoot versus agent-local governance, at measurable cost.The validation rationale calls for measuring violation rate and duration, maximum overshoot, containment latency, mediated-action coverage, false-containment rate, and business-utility loss.Source: §3.5 · pp. 5–6
• The containment hypothesis is falsifiable: unmeasurable constraints, bypassed enforcement, delayed monitors, or unacceptable business or customer harm can justify narrowing or rejecting deployment.The authorization dynamics also make compliant operation eligible for higher autonomy and throughput, while violations contract authority; runtime enforcement can be updated as law, policy, or evidence changes.Source: §3.5 · p. 6

4.1 Architecture overview

• ARIA’s normative-accountability, execution-control, and assurance-learning planes organize interacting capabilities, not a literal execution stack.The planes cover policy and oversight, authority and containment, and population telemetry, monitoring, incidents, updates, and validation.Source: §4.1 · p. 6

4.2 C1: Policy specification and jurisdictional mapping

• Policy specification combines jurisdiction-invariant control objectives, mappings to operative regulatory requirements, and consistency checks that route conflicts or exceptions to accountable human deliberation.Amendments are versioned, pre-registered, and auditable.Source: §4.2 · pp. 6–7

4.3 C2: Population assurance and the M2 indicator

• M2 compares observed population-decision distributions with a deployment-calibrated expected distribution, using normalized Jensen–Shannon divergence as one candidate indicator.Its signal may reveal drift when the monitored support captures relevant behavior, but it may miss harms that preserve the chosen marginals.Source: §4.3 · p. 7

4.4 C3: Bounded Decision Authority (BDA)

• Bounded Decision Authority separates capability from contextual authorization: the Effective Decision Space contains permitted actions currently authorized for execution without escalation.Actions outside that space but within the permissible space require escalation; prohibited actions remain disallowed regardless of authorization.Source: §4.4 · p. 7
• ARIA’s five-level autonomy taxonomy is an executive simplification; authority upgrades require documented human approval and supporting evidence, while drift or violations can trigger downgrade or suspension.The richer authority profile includes scope, materiality, reversibility, oversight latency, external exposure, data sensitivity, and tool criticality.Source: §4.4 · p. 7

4.5 C4: Runtime enforcement and containment

• Runtime enforcement monitors behavioral signatures, boundary approach, cross-agent consistency, and dependency graphs, with signals feeding policy decision and enforcement points.Containment can progress from monitoring escalation to authority downgrade, sandboxing, and controlled shutdown, with actions logged and reversible where appropriate.Source: §4.5 · pp. 7–8

4.6 C5: Adaptive policy learning

• Adaptive policy learning treats red-team findings, regulatory feedback, failures, and near misses as inputs to a governed amendment process.Proposed updates are evaluated offline, in sandbox, by replay, or on synthetic and controlled historical data, and require evidence, owner approval, regression checks, and rollback planning; antifragility remains a research hypothesis.Source: §4.6 · p. 8

4.7 C6: Human oversight competence

• Human oversight controls require a competence baseline, periodic calibration on realistic cases, and minimum practice plus recertification for accountable personnel.The stated architectural minimum is evidence that oversight remains competent rather than ceremonial.Source: §4.7 · p. 8

4.8 Mapping failure modes to controls

• Table 3 maps non-compositionality failure types to observable signals and the ARIA controls most directly implicated by each.Source: §4.8 · p. 8

5.1 Regulatory evidence and supervisory questions

• Table 4 maps each capability to a supervisory question, evidence artifact, and RACI accountability pattern, as a prudential control set rather than a legal interpretation.The mapping is intended to support pilot implementation, assurance testing, and supervisory assessment.Source: §5.1 · p. 8, Table 4 · p. 9

5.2 Minimum Viable ARIA

• Its listed controls include an agent registry, authority matrix, and interaction and dependency graph covering shared state, tools, data, and feedback.These establish records of component identity and permitted actions alongside workflow connections.Source: §5.2 · p. 9
• The bundle also calls for workflow-level operating rules with collective-outcome escalation thresholds and population monitors beyond per-agent checks.Monitors cover fairness, conduct, and other outcome distributions.Source: §5.2 · p. 9
• Runtime telemetry, graduated containment, incident-to-policy updates, and periodic human-calibration exercises complete the listed minimum bundle.Containment can escalate from monitoring to autonomy downgrade, sandboxing, or shutdown; the bundle can be extended with richer M2 reporting as maturity grows.Source: §5.2 · pp. 9–10
• The minimum viable bundle makes agent identity, authority, dependencies, collective outcomes, intervention rights, and human competence examinable from first deployment.It is an incremental starting point, not a complete implementation of ARIA.Source: §5.2 · pp. 9–10

5.3 Accountability and auditability

• ARIA assigns first-line ownership of agents and customer outcomes, second-line policy and containment oversight, third-line independent audit, and board-level accountability.Each collective outcome should trace to a capability and named human role; internal audit is not an operating owner of adaptive policy change.Source: §5.3 · p. 10
• Each capability emits designated audit artifacts, while policy formation creates channels for affected-community contestation and supervisory scrutiny without resolving whose values should govern.Artifacts include M2 time series, authorization matrices, containment registers, and expertise-maintenance records; accountable institutional owners retain amendment authority.Source: §5.3 · p. 10

6.1 Demonstration design and reconstruction parameters

• The demonstrations are mechanism illustrations, not benchmarks, production effect-size estimates, or evidence that ARIA is validated.The drift result is limited to a deliberately constructed two-stage regime, and the credit containment rule is idealized.Source: §6.1 · p. 10, §6.2 · p. 11, §6.3 · p. 12

6.2 Shared-signal thin-file exclusion and population-level containment

• The credit simulation used 200 components, identical true creditworthiness across groups, and higher estimation noise for the thin-file group, with shared portfolio-loss feedback rather than strategic coordination.The disparity bound δ = 0.05 was a simulation parameter, not a legal threshold; runs used 20 seeds over T = 400.Source: §6.2 · p. 10
• 0.41 disparity—8× the chosen δ = 0.05 bound—arose under local controls with zero local-check violations, while population-level containment held it at 0.052 in the stylized setting.The same population and pressure were used; the idealized containment rule directly accessed the monitored gap.Source: §6.2 · pp. 10–11, Figure 3 · p. 11
• The credit result shows that equal treatment conditional on imperfect, group-dependent measurements can conflict with an aggregate disparity constraint.Implementation delays, noisy group labels, and utility trade-offs were deferred to field validation; the demonstration does not estimate real credit effects or containment costs.Source: §6.2 · pp. 10–11

6.3 M2 as an observed-versus-expected behavior indicator

• The drift simulation compared M2 with prohibited-action-frequency monitoring across 200 episodes, using 400 decisions per step and matched false-positive rates.Drift first reorganized probability among benign categories and only later crossed the prohibited-action threshold; the setup used eight action categories over 300 steps.Source: §6.3 · p. 11
• 65 versus 12 median steps of lead time separated M2 from outcome monitoring at matched false-positive rates of ≤5% in the constructed drift episodes.Both detectors eventually discriminated perfectly in this regime, so the result is not a general superiority claim.Source: §6.3 · pp. 11–12, Figure 4 · p. 12

7.1 Field validation methodology

• Multi-jurisdictional institutions are proposed as a field-validation setting because they combine regulatory complexity, measurable outcomes, heterogeneous agent populations, and continuous adversarial pressure.The paper points to simultaneous requirements across jurisdictions as a governance challenge for the validation program.Source: §7.1 · p. 12

7.2 Five-stage validation program

• The proposed five-stage program uses pre-registered, falsifiable empirical questions to test participatory policy specification, M2 drift detection, bounded decision authority, adaptive policy learning, and human oversight competence.M2 is evaluated for detection before observable production violations against simpler baselines, using ROC analysis, lead time, ablation, and calibration; bounded authority is tested for reduced violation frequency and severity at acceptable cost. Oversight quality is measured at 6-, 12-, and 24-month horizons against control organizations.Source: §7.2 · pp. 12–13

7.3 Toward a supervisory reference architecture

• ARIA is positioned as a candidate, falsifiable research architecture—not a mature supervisory standard—with standardization conditional on validation, separable capabilities, and supervisable artifacts and metrics.The proposed path involves staged field studies with pre-registered hypotheses, negative-results publication rights, and independent scrutiny.Source: §7.3 · p. 13

8.1 Multi-agent alignment and collusion

• Cooperative-equilibrium work studies collective alignment through designed incentives, while empirical collusion results ground concerns about multi-agent behavior in observed examples.ARIA targets regulated-finance outcomes, fair-lending non-compositionality, accountable human functions, and audit artifacts rather than collusion control alone.Source: §8.1 · p. 13

8.2 Agentic finance and financial supervision

• Agentic-finance runtime-governance work emphasizes trajectory telemetry, continuous authorization, temporal conformance, and tiered containment; ARIA adds population fairness, M2, policy amendment, and human-competence preservation..Source: §8.2 · p. 13

8.3 Fairness in coupled and multi-agent systems

• Financial multi-agent fairness research treats fairness as dynamic and interactional, while the thin-file demonstration is framed alongside measurement quality and group-dependent uncertainty—not as a claim that all failures are uniquely multi-agent..Source: §8.3 · p. 13

8.4 Organizational cybernetics and systems safety

• ARIA builds on organizational cybernetics and safety approaches, using M2 as a candidate continuous behavior statistic rather than a complete model of organizational self-knowledge.Its stated novelty is organizing monitoring and containment for adaptive agentic workflows under financial accountability.Source: §8.4 · p. 14

8.5 Democratic and value-sensitive alignment

• Normative work and Collective Constitutional AI provide foundations for participatory policy formation, which ARIA extends from model values to continuous organizational policy formation..Source: §8.5 · p. 14

8.6 Runtime governance, identity and agent safety

• Runtime-governance, identity, and agent-safety work motivates delegated authorization and accountability, while responsibility-gap complexity supports governance that does not depend on exhaustive verification.The cited work includes runtime architectures, policies-on-paths, identity infrastructure, and training-deployment-gap research.Source: §8.6 · p. 14

8.7 Constitutional AI and its extensions

• Constitutional AI makes model values explicit and auditable; ARIA is framed as an organizational layer above individually governed agents, addressing their collective behavior..Source: §8.7 · p. 14

8.8 Adaptive governance and antifragility

• Antifragility is presented as a future-validation hypothesis, not an empirical result of this manuscript.The cited related work includes stress as a detectable signal in multi-agent LLM systems and a design philosophy for adaptive policy.Source: §8.8 · p. 14

• Proposition 1 is only a counterexample: local checks do not logically imply collective compliance, but this does not show every population will fail or that strategic equilibria are always involved.Source: §9 · p. 14
• The operational hypothesis assumes mediated actions, monitorable collective constraints, bounded response latency, and acceptable trade-offs in false containment, delay, and business utility.Principles such as dignity or thick non-manipulation that resist statistical operationalization remain outside its scope.Source: §9 · p. 14
• The simulations use analytic decision rules rather than LLMs; the disparity result depends on shared-signal and measurement-quality coupling, while the drift regime is two-stage and both detectors reach ceiling discrimination.Thus, only the lead-time contrast is informative in Experiment 2, and effect sizes do not transfer to production.Source: §9 · p. 14
• M2 can miss harms that preserve monitored marginals, reflect benign distributional change, or arise under a miscalibrated reference model; governance artifacts can also become theater.Independent artifact assessment, independent validation, and publication of negative results are identified as backstops.Source: §9 · p. 14

• Fairness and safety controls attached to individual models may fail to prevent collective failures produced by coupled agentic workflows.Source: §10 · p. 14
• ARIA combines a six-capability governance architecture with accountability allocation and audit artifacts mapped to evidence needs across regulatory regimes.Source: §10 · p. 14
• Production evidence, cross-institutional replication, operational specification, and regulatory engagement are required before ARIA can be considered a reference architecture in a stronger sense.Source: §10 · pp. 14–15
• The five-stage validation program calls for revising or narrowing ARIA if M2 adds no value over simpler drift baselines, bounded authority lacks acceptable-cost benefits, or policy updates fail to improve outcomes without regression and complexity burden.Source: §10 · p. 15

Ethical considerations

• The simulations use synthetic data without human subjects or personal data, and the thin-file demonstration models redlining-like exclusion to expose a control failure, not provide a method.Deployment-specific thresholds are withheld because detailed failure analysis could inform evasion; field validation requires ethics review, regulator engagement, and protections for affected customers.Source: Ethical considerations · p. 15

Adverse impacts

• Adoption as compliance theater could legitimize multi-agent deployments without substantive protection, while monitoring could be repurposed for worker or customer surveillance.The authors identify independently assessable artifacts, accountable human roles, policy specification, and supervision as constraints or mitigations, while judging ungoverned high-stakes finance populations to carry greater expected harm.Source: Adverse impacts · p. 15

Transparency statement

• Generative AI supported literature triage, copy-editing, technical consistency checks, and compilation-log inspection; the authors retain responsibility for all claims, references, analysis, and final wording.Source: Transparency statement · p. 15