🤖 AI

ATC: Agent Trajectory Control for Role-Contract Enforcement in Black-Box Multi-Agent Systems

This paper introduces Agent Trajectory Control (ATC), a black-box enforcement mechanism that prevents role drift in multi-agent LLM systems by scoring and constraining agent outputs against explicit role contracts at the message level, thereby improving task performance and role consistency without requiring access to internal model representations.

Original authors: Maisha Maliha, Vishal Pramanik, Sumit Kumar Jha

Published 2026-11-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Maisha Maliha, Vishal Pramanik, Sumit Kumar Jha

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the rapidly evolving landscape of artificial intelligence, a new approach to problem-solving has emerged where multiple computer programs, known as agents, work together to tackle complex tasks. Instead of relying on a single, all-knowing program, these systems divide the work: one agent plans the strategy, another gathers information, a third checks the facts, and a fourth carries out the actions. This division of labor is designed to mimic human teams, where a doctor diagnoses, a nurse administers care, and a surgeon operates, each staying within their specific area of expertise. The success of such a team depends not just on the quality of individual work, but on whether every member respects the boundaries of their assigned role. When a team member steps out of line, the entire effort can unravel, even if the individual action seems sensible on its own.

Researchers have long struggled with a specific problem in these multi-agent systems: over time, an agent might accidentally drift out of its lane. A fact-checker might start making plans, or a data gatherer might begin drawing conclusions it cannot support. This phenomenon, which the researchers call role drift, happens because the agents are constantly reading the same shared conversation. As the discussion grows, an agent might begin to imitate the functions of its neighbors, blurring the lines of authority. While previous methods tried to fix this by giving agents better instructions or by editing the internal workings of the computer models, these approaches often failed to catch the drift before it caused damage. The core challenge was finding a way to verify that an agent was still doing its job before its message was shared with the rest of the team.

To solve this, a team of researchers introduced a new system called Agent Trajectory Control. Rather than trying to rewrite the internal code of the agents, this system acts as a gatekeeper at the very moment an agent finishes writing a message. Before that message enters the shared conversation, the system analyzes it to see if it fits the agent's assigned job description. It checks four specific things: whether the message strays from the agent's role, whether it accidentally borrows functions from another agent, whether it uses language the agent is not allowed to use, and whether it violates the logical rules of its position. If the message passes these checks, it is released. If it fails, the system calculates a corrected version that stays within the agent's boundaries and asks the agent to rewrite it. This process happens every time an agent speaks, ensuring that the team's structure remains intact throughout the entire interaction.

The researchers tested this system across a variety of scenarios, including teams of identical agents and teams made up of different types of models with varying strengths. They found that the new control system significantly improved the team's ability to complete tasks while keeping every member in their proper role. In tests involving ten agents working together, the system increased the success rate of complex tasks by more than six points compared to the best existing methods. The improvement was even more dramatic in larger, more diverse teams, where the risk of confusion was highest. In these challenging settings, the system boosted task success by nearly ten points, proving that it scales effectively as teams grow. The data showed that the system reduced the amount of "role drift energy"—a measure of how much agents were wandering out of line—by more than half compared to previous approaches.

What makes this approach particularly powerful is that it works without needing to see inside the computer models. Many previous methods required access to the internal brain of the AI to steer its behavior, which is impossible with many of the most advanced systems available today. By acting on the message itself rather than the generator, this new method can be applied to any team of agents, regardless of how they were built. The researchers also discovered that the system was most valuable when teams were pushed to their limits, such as when an agent was explicitly asked to perform a task that belonged to someone else. In these stress tests, the new system maintained high performance while other methods collapsed, demonstrating that it could enforce the rules of the team even under pressure.

The study confirms that simply telling agents what to do is not enough; their actions must be continuously verified against their contracts. The results suggest that for multi-agent systems to be reliable, there must be a mechanism that checks every contribution before it is accepted. This does not mean the agents are less creative or capable; rather, it means they are more disciplined. By keeping the team's structure clear, the system allows the agents to focus on their specific strengths without getting lost in the noise of the group. The researchers made their tools and data available to the public, allowing others to build upon this work. As artificial intelligence teams become more common in fields like software development and business planning, this kind of role enforcement may become a standard requirement for ensuring that these digital teams function as smoothly and effectively as their human counterparts.

Technical Summary: ATC: Agent Trajectory Control for Role-Contract Enforcement in Black-Box Multi-Agent Systems

Problem Statement

In multi-agent Large Language Model (LLM) systems, work is typically divided among specialized agents (e.g., planners, retrievers, verifiers, executors). While this division of labor is essential, the authors identify a critical failure mode termed role drift: a turn-level breach where an agent produces a message that is locally reasonable but violates its assigned functional authority. For example, a verifier might begin planning, a retriever might assert unsupported conclusions, or an executor might modify state without approval.

Existing mitigation strategies—such as role prompts, memory systems (e.g., A-MEM), activation editing (e.g., CAA, SEA), and fixed workflows (e.g., SOP)—are insufficient. Prompts declare responsibilities but do not validate every output; memory preserves state but does not enforce who is authorized to act on it; activation editing methods often require access to internal model states (hidden representations) and do not explicitly model the coupled structure of role alignment and cross-role leakage; and workflow constraints cannot repair a role-violating message once it has been generated. The authors posit that role drift is directional (agents drift toward other roles rather than arbitrary behavior) and becomes more pronounced in longer, heterogeneous interactions.

Methodology: Agent Trajectory Control (ATC)

ATC is an external control loop designed to enforce role contracts at the message boundary, specifically targeting black-box agents where internal representations are unavailable. It operates on the principle that enforcement should act on the message rather than the generator.

Core Mechanism

The system operates in a five-step trajectory for every agent turn: Encode → Score → Correct → Regenerate → Re-evaluate.

Behavior Representation:
Each proposed output $y_{i,t}$ is mapped to a functional behavior vector $z_{i,t}$ using a fixed encoder $f$ . Each role $r_i$ is represented by a subspace $S_i$ spanned by a role basis $U_i$ . The system projects the behavior vector onto this subspace to isolate the role-aligned component.
Role-Drift Energy Scoring:
ATC computes a "role-drift energy" ( $E_{i,t}$ ) by aggregating four distinct violation signals:
- Out-of-Role Deviation ( $D_{out}$ ): The squared distance of the behavior vector from the agent's assigned role subspace.
- Cross-Role Leakage ( $D_{leak}$ ): The projection of the behavior into the subspace of other agents' roles, penalizing unauthorized functional overlap.
- Linguistic Violation ( $D_{ling}$ ): A check against allowed speech acts (e.g., a retriever asserting facts rather than retrieving them).
- Logical Contract Violation ( $D_{logic}$ ): A symbolic check against a logical contract defining required and prohibited behaviors for the specific role.
Leakage-Regularized Correction:
If the energy exceeds a threshold, ATC computes a corrected target vector $\hat{z}_{i,t}$ . This is the solution to an optimization problem that minimizes the distance to the original behavior while keeping the result within the assigned role subspace and softly suppressing leakage into other roles. This yields a closed-form solution using the Moore–Penrose pseudoinverse.
Constrained Regeneration:
A constrained regeneration operator $g$ rewrites or regenerates the message to align with the corrected target vector $\hat{z}_{i,t}$ . For black-box agents, this is implemented as a role-constrained revision call.
Re-evaluation:
The revised output is re-encoded and re-scored before being admitted to the shared conversation, ensuring the correction was successful.

Key Contributions

The paper claims three primary contributions:

Formalization of Role Drift: Defining role drift not as a loss of task coherence, but as a specific, turn-level breach of an agent's role contract.
Role-Drift Energy Metric: A composite metric combining geometric (subspace deviation), linguistic, and logical signals, coupled with a closed-form leakage-regularized correction target.
Empirical Validation: An evaluation demonstrating that ATC improves task performance and role consistency while reducing role-drift energy across homogeneous and heterogeneous teams, particularly under stress conditions.

Experimental Results

The authors evaluated ATC on three benchmarks: EntCollabBench (enterprise collaboration), MultiAgentBench (general collaboration), and SWE-bench Verified (software engineering). Tests were conducted across three team settings: Homogeneous (10 agents, same model), Heterogeneous (10 agents, mixed models), and Heterogeneous-Expanded (12 agents, 5+ model families).

Task Performance: ATC achieved the highest scores across all benchmarks and settings. In the most complex setting (S3: Het-12), ATC improved task scores by 9.6, 9.6, and 7.8 points over the best non-ATC baseline on the three respective benchmarks.
Role Consistency (RC) & Drift Energy (RDE): ATC consistently achieved the highest Role Consistency (up to 93.5%) and the lowest Role Drift Energy (down to 0.11). For instance, in S3, ATC reduced RDE on EntCollabBench from 0.29 (SOP-Role) to 0.11.
Stress Tests: Under explicit perturbations (Role-confuse, Authority-swap, Late-correction), ATC outperformed the strongest baseline (SOP-Role) by over 12 percentage points in task success, demonstrating robustness against active role confusion.
Ablation Studies: Removing the geometric role-subspace term caused the largest performance drop, confirming it as the principal mechanism. Removing the leakage penalty also significantly degraded performance, validating the hypothesis that agents drift toward other roles.
Cost Efficiency: While ATC incurs higher latency and token costs due to regeneration and re-evaluation, the paper argues it is more efficient in terms of Cost-Normalized Role Gain (RCG/C). ATC achieved an RCG/C of 1.97, more than double the strongest non-ATC baseline (0.86), indicating superior role-stability gain per unit of computational cost.

Significance and Claims

The paper positions ATC as a necessary evolution in multi-agent control, shifting from static role definitions (prompts/workflows) to dynamic, message-boundary enforcement. The authors claim that:

Black-Box Applicability: Unlike activation editing methods, ATC does not require access to model internals, making it applicable to proprietary or black-box LLMs.
Scalability: The benefits of ATC scale with team heterogeneity and size; it is most valuable when teams are diverse and the potential for authority confusion is high.
Prevention over Correction: By intercepting and repairing messages before they enter the shared context, ATC prevents local role violations from cascading into systemic failures, a capability lacking in current workflow-based or memory-based approaches.

The authors conclude that explicit role-contract control is essential for maintaining the integrity of multi-agent systems, particularly as these systems grow in complexity and diversity.