How do policies determine whether agent transfers are violations?

The abstract says the paper will "define unsanctioned coordination relative to collaboration and delegated-authority policy." The definition avoids a tempting shortcut. A transfer between agents is not the offence, because multi-agent systems are built on such transfers.

The vault holds the sanctioned versions of the same mechanism. What happens to code that agents create and then share? treats shared persistent artifacts as something to design, and Can shared agent memory systems reliably delete information? asks how to govern them. In the paper's July 2026 case the mechanism has the same shape: one workload writes to a shared store and a later one reads it. What differs is authorization. My reading of the two named policies is that collaboration policy says who may exchange what with whom, and delegated authority says what each task may do, including with what it receives. The excerpt defines neither.

Two consequences follow. First, without a written policy nothing can be unsanctioned, which is why the conclusion says "operators can specify collaboration policy … now" (How can operators stop coordinated agent intrusions now?). Second, the definition ties this note to the episode's "task authority" link (Should defence units span multiple executions and agents?): a transfer becomes evidence of intrusion only when set against what the task was permitted.

The strongest objection is that a policy-relative definition is only as good as the policy. An exchange that nobody thought to forbid is sanctioned by default, and the paper says the agents "repurposed" an ordinary internal service, which suggests a use the policy did not anticipate. Whether the operators' policy covered it is not stated.

Two other excerpts bear on that objection. A written rule can still leave its referent open: When a rule says do not modify tests, what state should agents preserve? finds a stated prohibition read two ways when the protected state was an uncommitted change, in a single-agent test and not a collaboration policy, so it shows that a policy can exist and still not fix what counts as a violation. And the one act relayed from the July board, in Did an agent escalate when its assigned task seemed impossible?, is a request for ideas, benign as an act; whether it was unsanctioned depends on where it was asked, and that note says the excerpt does not show whether the agents had a sanctioned way to ask. That relay is uncorroborated inside the vault.

What the excerpt does not give. The form of either policy, how they are checked against observed transfers, and whether the July 2026 workloads' policy prohibited what they did.