AI Agent Coordination: Establishing Verifiable Rules and Safeguards for Delegated Tasks
The operational framework for managing AI agent "squads" within a consulting and training firm, Qognito, has undergone rigorous auditing and refinement to ensure the integrity of delegated tasks and the reliability of AI-generated insights. This process, initiated by the firm’s sole principal, involved a systematic examination of the established workflows, the security of AI-generated content, and the accountability mechanisms in place. The audit, termed "Phase A," revealed critical vulnerabilities in the initial design, necessitating significant adjustments to safeguard against unauthorized modifications and ensure the accuracy of AI outputs.
The core business model of Qognito relies on the coordinated efforts of multiple AI agents, managed by the principal who retains ultimate responsibility for strategic direction, deliverables, and client commitments. This approach allows for a lean operational structure, delegating specific tasks while maintaining human oversight. The constant influx of AI research and developments fuels this operational model, providing material for updating training programs, assessing client needs, and preparing proposals. The value derived from this process is directly linked to the principal’s ability to effectively leverage these AI-generated insights.
Central to this workflow is the use of Obsidian, a knowledge management application. Internal linking, or "wikilinks," connects individual notes, enabling the principal to trace analyses and connect them to related subjects. While these links facilitate exploration, they do not inherently guarantee the independence of evidence across multiple notes, leaving room for errors to propagate through subsequent reasoning.
The original production workflow was designed with distinct roles: one agent prepared the source material, another drafted the analysis, and a third evaluated the note. The principal then made the final decision on publication within the firm’s knowledge base. This intended circuit aimed to ensure a structured and reviewed process before content became part of the firm’s active knowledge repository.
Initial Vulnerabilities Discovered: Rule Modifiability and Content Preservation
The "Phase A" audit, designed to assess the robustness of this delegated workflow, began with a foundational discovery: the rules governing the AI agents’ operations, including evaluation criteria and control parameters, were modifiable by the agents themselves. This meant that the agent responsible for producing an analysis could, in principle, alter the criteria used for its own evaluation, undermining the intended separation of roles and the objectivity of the assessment. While no instances of such manipulation were identified, the structural vulnerability posed a significant risk. Access control measures failed to enforce the intended segregation of responsibilities, allowing for potential circumvention of established protocols.
In response, the configuration files defining these operational rules were secured. Modifications now require human intervention with administrative privileges, introducing a critical checkpoint. Subsequent testing involved ten distinct modification attempts through various channels, all of which were successfully blocked, confirming the enhanced security of the rule-based system. These initial corrections, while strengthening the integrity of the rules, shifted the focus to the security of the documents and data upon which the AI agents operated.
A further critical issue arose concerning the preservation of published notes. Initially, notes were integrated into the knowledge base immediately upon drafting, preceding the evaluation stage. While a subsequent waiting period and human approval for publication were implemented, the initial real-world cycle saw nine sources processed, nine notes examined, and all nine subsequently published by the principal. This process, however, did not prevent modifications to already published notes or their source materials. The existing control mechanisms were insufficient to detect these changes, meaning that an approval granted one day did not guarantee the content’s integrity the next.
Phase A addressed this by introducing a new control mechanism. On a working copy, three deliberate alterations—a modified note, an added note outside the established workflow, and a changed transcription—were introduced. The new control, which compares documents against a preserved reference, successfully detected all three. Furthermore, locks were implemented on published notes and prepared source materials, enhancing their immutability.
The principal also adopted a personal discipline: direct edits within Obsidian were discontinued. All changes are now required to follow the established workflow, leaving a traceable record. This measure is crucial for distinguishing legitimate corrections from unauthorized modifications. However, the article emphasizes that content preservation alone does not guarantee accuracy. An instance where the judge agent translated "usually" as "always" was flagged by the principal, even though automated controls detected no anomaly. Such semantic shifts, even if seemingly minor, can fundamentally alter the interpretation and subsequent decisions based on the information.
Establishing a Reliable Testing and Evaluation Framework
The development of a robust testing framework, or "test bench," was crucial for validating the AI agents’ performance. This involved running repeated tests on selected cases, including deliberately introduced "traps" or challenging scenarios. Two key observations from these tests necessitated a re-evaluation of the trust placed in their results.
Firstly, the answer key for the tests remained accessible to the AI agents. This is analogous to students having access to solutions during an examination, fundamentally compromising the integrity of the evaluation. Access to the answer key was subsequently secured, and its restricted access was verified on the agents’ workstations.
Secondly, the permissions within the testing environment were found to be more restrictive than the actual production environment. Actions that would proceed without issue in daily operations sometimes required explicit approval within the test setup. While these tests accurately reflected the specific trial conditions, they did not fully replicate the security and operational fluidity of the live system, thus limiting their predictive power for real-world protection levels.
Consequently, the final stage of Phase A focused on unifying these protections within a test environment that mirrored the production permissions. This involved observing attempted actions, identifying which were blocked, and verifying their impact on the documents.
Twenty Attempts and Identified Limitations: A Continuous Improvement Process
On October 19th, twenty documented attempts were executed across two distinct AI agent environments. These included attempts to modify protected documents and access the answer key, all of which were met with refusals. However, two instances of file creation outside the publication workflow succeeded in one environment. While detected by the control mechanism, these were subsequently removed, confirming that the knowledge base returned to its initial state.
It is important to note that twenty documented attempts do not equate to twenty prevented actions. In the normal course of operations, an unauthorized addition might remain undetected until a control is triggered by a subsequent publication. This highlights an ongoing limitation.
Phase A concluded with a reservation: the next real-world cycle must demonstrate that an authorized publication indeed results in a locked note. The refusals observed during testing do not substitute for this end-to-end verification.
A parallel quality evaluation yielded seven successful outcomes out of ten trials. This included one false alert regarding content fidelity and two cases where the scope of the outcome remained ambiguous. The study reiterates that protecting documents does not automatically guarantee the improvement of their content. A retrospective review of published notes is still planned.
Quantifying the Cost of Control: Time and Resource Allocation
Understanding the cost associated with this enhanced control requires revisiting the initial real-world cycle. While the system logged publication times in milliseconds, the principal spent nine minutes reviewing nine notes before authorizing their release. This time, dedicated to human oversight, must be accounted for separately from automated processes. A human validation process must clearly delineate what was verified and within what timeframe.
Similar rigor applies to corrections. In the early stages, a duplication error was initially counted only once, and the script envisioned to address it was deemed costly and potentially fallible. The principle emerged that not every anomaly warrants an additional rule.
The principal established clear criteria for pausing operations, designated responsible parties, and outlined conditions for re-examination. These provisions are intended to become ingrained in the operational practice. At this stage, no overall increase in profitability has been demonstrated. The costs associated with re-reading, corrections, maintenance, and audits are integral to the overall assessment of the system’s economic viability.
Justifiable Operations: A Framework for Delegated AI
The journey to this point can be summarized in three stages: the definition of rules, the testing and identification of protection mechanisms and their limitations, and the ongoing observation of real-world publication and quality assessment. The tested protections provide circumscribed evidence, while the final stage remains under observation.
The principal can now more clearly articulate what is delegated to AI agents, what resists tested modifications, and what still requires human oversight. The leader’s responsibility extends to deciding which uncertainties are acceptable and which necessitate limiting delegation.
For individuals coordinating activities with AI agents, a free white paper, "La facture fantôme de l’IA" (The Phantom Invoice of AI), offers insights into supervision, full costs, and the optimal use of time saved. Further development of these decision-making processes is available through "SAGA-IA – Volume 1," a training program focusing on delegation diagnosis and economic viability assessment, complete with case studies and exercises. This program builds upon the author’s practical experience, teaching how to justify commitments, the evidence required, and the conditions under which operations will proceed. The ongoing process underscores the dynamic nature of AI integration, demanding continuous adaptation and rigorous validation to ensure both efficiency and integrity.
