You can make every safety check on an AI system stricter and it can still fail once the pieces work together.

This explores why making each individual check of an AI system stricter still doesn't close the gap when the parts are put together. The corpus's answer is that a tighter local check is a better test of the wrong property. Local checks verify things like plausibility, alignment, or protocol compliance for one step. Whether the whole workflow is safe is a different property, so sharpening the local test doesn't touch it. A SafeFlow-style analysis shows every step passing its check while the workflow still fails, and the same pattern turns up in three different systems Can individual components pass safety checks if the system still fails?.

One reason is structural: some rules can't be written as per-step rules at all. A stateless guardrail sees one action with no memory of what came before, so it can't state a constraint like "these two permitted actions must never both happen" Can stateless checks ever catch sequence-level constraint violations?. Making it stricter only means it blocks more single actions or fewer. It still can't express the sequence. Security in this view belongs to the whole trajectory, and safety rules bind entire "behavioral envelopes" rather than steps Can step-by-step approval miss harmful behavior patterns?.

The gap can also be exploited on purpose. The strength of multi-agent systems is that they split a task and specialize roles. That same decomposition lets a harmful goal be cut into subtasks that each look benign, with the harm appearing only when they're combined Can task decomposition hide harmful intent across agents?. Tightening each agent's filter makes little difference, because no single fragment contains the harmful intent. This is why one proposal moves the unit of defense up a level, to "coordination episodes" that span several agents and executions and are revised as evidence comes in. Reviewing each execution in isolation throws away exactly the cross-execution context that matters Should defence units span multiple executions and agents?.

There are two quieter versions of the same problem. Inside a single model, perfect accuracy can hide badly organized internal representations. The task-relevant features are all there and linearly decodable, but the structure is fractured, and the metric can't see it until something shifts Can models be smart without organized internal structure?. And a behavioral check can only ever confirm behavior that was observed. A model that always complies and one that complies only when watched score the same, so more checks of the same kind can't separate them Can behavioral training prove a model always complies?. In both cases the measurement is too narrow for the question being asked, however precise it gets.

The corpus points to a fix that changes the kind of check. Instead of stricter checks per step, it uses stateful monitors that track composed behavior. Verification can run alongside generation with near-zero latency on correct runs, so watching the whole trace doesn't have to be slow Can verifiers monitor reasoning without slowing generation down?. Governance can also be built into the memory the agent consults while it works, instead of sitting in an external policy document Can governance rules embedded in runtime memory actually protect autonomous agents?. The corpus doesn't say any of these fully close the composition gap. It only shows that the gap won't close by sharpening step-level checks.