Can multi-agent defenses close attack paths completely?

The abstract says the survey organizes "defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identif[ies] path closure and recovery as key challenges." As a specification, a defense says which attack path it targets, what it observes, how it intervenes, where the trust boundary sits, and how the system recovers if the path was crossed anyway. The excerpt names the five parts and defines none of them, so the glosses here are the plain reading of the names.

The contract matters because it makes defenses comparable on more than a success rate, the way A-I-R does for attacks (Can adversary position unify fragmented multi-agent attack models?). The vault's defense notes are best read as different answers to the first three parts. Can inspecting generated workflows catch planning-time attacks? targets the planning boundary. ChannelGuard puts a gate on every hop (Do internal agent hops in pipelines need security monitoring?). SafeFlow labels the request and checks at the commit point (Where should workflow validation gates be placed for safety?). A fourth placement is the authorization layer in Can memory poisoning compromise decision-making even with authorization layers?: on the plain reading of the slot names it answers trust boundary and intervention, by checking a licence at the effect outside any agent's judgment, and it is measured for memory poisoning only. That placement mapping is my reading, not the SoK's.

"Path closure" has a measured instance in the vault. Does chain-level inspection close the cross-skill attack blind spot? moves the unit of inspection to the chain and still leaves attack success above one in five. Narrowing a path is not closing it, and the SoK treats closure as unsolved. Two other cases show closure falling short in different places. The authorization layer above stops the action at the end while the path to the reviewer stays fully open, a Judgment Bypass Rate of 100 percent, so the harm is closed at the effect and the path is not. And Can removing a communication channel stop persistent information sharing? reports a channel removal followed by a rebuild, in one clause with no detail on who removed what. Neither is a closure rate, and both readings rest on the plain meaning of "closure", which the excerpt does not define.

Recovery is the part the vault says least about. The notes on the defenses above make no mention of it, with one exception: the commit-point note ties irreversibility to What makes an AI system truly safe in practice?. Two notes outside that set reach it in other words: the third clause of How can operators stop coordinated agent intrusions now? ties response to surviving state, and How can agent self-evolution be made safe and auditable? specifies rollback for self-evolving agents. The first is a doctrine with no result and the second is not a defense against an attack path. That gap is filed as What recovery mechanisms do vault defense notes actually specify?.

What the excerpt does not give. Definitions of the five parts, which surveyed defenses meet which, and any account of what recovery would consist of.