If a harmful request is split into harmless-looking pieces, how can a safety system still catch the full intent?

This explores how a multi-agent system can recover the risk context of a request after the request has been chopped into pieces. The corpus points to a two-part answer: a label that travels with the work, and a checkpoint that reads it just before something irreversible happens.

The problem comes first. Multi-agent systems get their power from splitting tasks and giving agents specialized roles. That same design lets a harmful objective be spread across steps that each look harmless, so the harm only exists in the composition Can task decomposition hide harmful intent across agents?. No single step holds the whole intent. Checking steps one at a time also fails for a deeper reason: local checks for plausibility, alignment, and protocol compliance test different properties than the ones that make a system safe end to end. Every step can pass while the workflow still fails Can individual components pass safety checks if the system still fails?.

The label is the taint. Think of it as dye added to the original request. SafeFlow attaches structured semantic labels to the root request and propagates them through the collaboration graph as work is delegated. Each downstream step inherits the original intent and risk context that fragmentation would otherwise strip away Can semantic labels on requests prevent malicious propagation through agent networks?. The label is coarse: it describes the whole request, not what any particular step is doing.

The checkpoint is where the coarse label becomes useful. SafeFlow validates the assembled workflow at irreversible action boundaries, reconstructing the global risk picture that no single step holds Where should workflow validation gates be placed for safety?. The taint records what the request was about, the assembled workflow shows what was actually built, and the gate is the first place both are visible together. The corpus says the taint carries the context and the gate reconstructs the picture. It doesn't spell out the matching logic, so how a request-level label is turned into a step-level verdict is not something these notes settle. The commit-point gate also isn't meant to work alone. It complements defenses at the planning boundary and at each hop between agents, and each of the three catches attacks the others miss.

Two neighbouring findings show why a late, action-focused gate is attractive. Plans planted in a reasoning model's context evade chain-of-thought monitors 25 to 33 percent of the time, because the model paraphrases them as its own reasoning Can reasoning models be steered by injected context without detection?. So watching what an agent says it is thinking is not enough. And process-level verification, checking intermediate states instead of final answers, raised task success from 32% to 87% in long reasoning traces Where do reasoning agents actually fail during long traces?. That is a different domain, but the lesson is similar: check the middle, not just the ends. The gate has limits too. If it is a panel of agentic validators, their agreement can be guaranteed deterministically, but whether their verdict is semantically right holds only statistically Can validator consensus guarantee both agreement and semantic correctness?. So the reconstructed risk picture is only as reliable as the validators reading it.