Multi-agent systems have a common flaw: one agent finishes half its work and passes off a messy half-done job to the next. The next agent can’t understand what the previous one intended, doesn’t dare ask for clarification, and has to guess blindly. If it guesses wrong, all subsequent work is for nothing.

Google DeepMind recently published a paper with a straightforward approach: stop treating delegation as a conversational handoff, treat it as signing a contract.


The paper, titled *Intelligent AI Delegation*, is authored by Nenad Tomasevski, Mattia Franklin and Simon Osindero. Its core framework has four key steps:

**1. Contract-First Task Decomposition**

Complex goals are recursively broken down until every sub-task can be matched with a deterministic verification mechanism — such as automated unit tests or formal AST signatures. After decomposition, each sub-task has clear acceptance criteria, eliminating any ambiguous handoffs.

**2. Dynamic Privilege Attenuation**

Sub-agents no longer receive full system permissions, and are only granted the minimum tool access required to complete their current contract. This means even if an agent gets injected with malicious instructions, it cannot reach core system assets.

**3. Dynamic Cognitive Friction**

Sub-agents are allowed to question the main agent’s assumptions and request clarification, instead of blindly executing instructions that seem off. This acts as a brake on the system, preventing errors from propagating all the way down the chain.

**4. Transitive Accountability & Recursive Verification**

In multi-hop delegation chains, every orchestrator must verify the encrypted milestone receipt from the next agent before releasing the system state. If something goes wrong at any step, it is immediately exposed, preventing errors from snowballing.

The paper’s authors hypothesize that this verifiable contract-based delegation can eliminate error accumulation in multi-agent networks. When responding to online users, the authors confirmed that the below data comes from real-world testing on their own production infrastructure: for the 15-step repository refactoring task, completion rate rose from 42.6% to 88.4%, while token overhead fell by 61.2%.

These numbers are certainly impressive, but some have pointed out a key prerequisite: the verification mechanism must cover every single sub-task. If a step does not have a corresponding test or check, the contract cannot be finalized and the system will still get stuck.

Other users have also noted that the dynamic privilege attenuation component can be implemented as a standalone feature right now. Issuing each sub-agent a scoped token that expires when the task is completed blocks most prompt injection attack paths, and this doesn’t require the full framework to be rolled out to work.

At the end of the day, scaling autonomous agents isn’t just about stuffing more LLM workers into a shared chat room. What actually delivers results is using formal methods to constrain permissions, isolate context, and make every delegation verifiable.

Paper link: https://x.com/i/article/2088025394175762432

——

One quick note: the 88.4% and 61.2% figures do not come from the paper itself, they are results that marfin ran on his own. The paper itself presents the theoretical framework, don’t mix the two up.