If several AI agents each follow the rules alone, who checks that they still follow them together?

This explores what a defense has to remember, and across how much history and how many actors, if it is going to check rules about how several agents behave together, rather than judging each action alone. The corpus's short answer is that it needs a lot more memory than today's guardrails have. A per-action check can't even state a rule that depends on what happened earlier. Can stateless checks ever catch sequence-level constraint violations? makes this structural. Each step can be individually permissible while the sequence violates a system-level safety limit, so only a stateful monitor that tracks the composed behavior of all parties can verify the envelope. The same logic applies to model filters. A filter judges one output at one moment, but an agent's risk spreads across memory, retrieved content, tool calls and environmental reach (Can a model-level filter truly contain an agent with environment access?).

The first requirement is that the unit being tracked is a group of linked actions, not a single agent or run. Should defence units span multiple executions and agents? proposes a "coordination episode": actions tied together by observed transfers, task authority and response history. Membership gets revised as evidence comes in, so the tracked state has to be revisable, not a fixed session log. The attack side shows why. In Can attackers evade skill scanners by refining individual skills?, scanners score skills one at a time, so an attacker can make each piece look innocent while the chain-level intent stays intact, reaching 96% average success. The counter-swarm doctrine in How can operators stop coordinated agent intrusions now? is the mirror image. It preserves relationships across executions, constrains the shared resources agents can reach, and ties responses to persistent state instead of closed channels.

The second requirement is that the state has to describe the protected thing itself, not just name a prohibition. Can explicit authorization boundaries prevent agents from modifying protected tests? found that stating a rule was not enough to keep agents from modifying protected tests unless restricted tools were paired with it. The boundary must specify the protected state. The state also has to live where the agent actually looks. In Can governance rules embedded in runtime memory actually protect autonomous agents?, safeguards were written into the memory layer a persistent agent consulted, and 889 governance events were logged over 96 active days. Rules kept in a separate policy document did less. Evidence has to be recorded by infrastructure the agent doesn't control. Can infrastructure evidence replace terminal scores in benchmark validation? does this for benchmarks by grounding claims of valid completion in recorded infrastructure evidence rather than a final score.

The third requirement is that the state must be shareable across parties without exposing what each party wants to keep private. Can commitments protect sensitive agent data while enabling verification? anchors commitments instead of content, so a process record is tamper-evident while communications, approvals and reasoning traces stay off-chain. It costs something, though: organizations must retain the underlying content, and deletion and access control become open questions. Tracking also has to include the routing layer. Can attackers manipulate which model handles a request? notes that whichever layer picks the model can be manipulated, so safety checks may end up running against the wrong identity.

The unresolved problem is ownership. Who enforces invariants when agents cross organizational boundaries? points out that once agents delegate across organizations, no one is named as the owner of the invariants. Operators, organizations, regulators and standards bodies each hold a different piece of the rules. Those pieces may conflict, and not every party can see them. A monitor can only verify what someone has written down and made visible to it. Meanwhile Can verifiers monitor reasoning without slowing generation down? suggests the cost of continuous tracking may be manageable. Verifiers that run alongside a trace and intervene only on violations add near-zero latency on correct runs. That result comes from reasoning traces, not multi-party systems, so whether it carries over is untested.