Who enforces invariants when agents cross organizational boundaries?

Two sentences in the excerpt meet without touching. The abstract says agents "increasingly delegate tasks across organizational boundaries," and the introduction says agent behavior is constrained by "operational constraints, organizational policies, regulatory requirements, and technical standards." The conclusion asks for "reasoning about composed, stateful, multi-party behavior." What is never said is whose invariants a multi-party trajectory must satisfy.

The four sources of constraint generally have different owners: an operator, an organization, a regulator, a standards body. When a trajectory passes through agents belonging to several organizations, the envelope that should bound it could be the originating organization's, the intersection of all parties', or the union. The parties' policies can conflict. No single party may see the whole trajectory, and the excerpt lists "identity, trust, capability control, and decision transparency" as multi-agent challenges without saying who states or checks the sequence-level constraints. This is the sequence-level version of an existing problem: Who actually bears the risk when multi-agent workflows fail? shows the requester, the observer and the affected party coming apart in a delegation chain.

The vault holds pieces of a possible answer, none of them offered by this paper. Can semantic labels on requests prevent malicious propagation through agent networks? lets the originating request set the scope, which is an originator-owns-it answer inside one system. The audit spine described in Why do agents fail at identity verification and authorization? would give parties a common evidence record, which is a precondition for any party checking a trajectory it did not run. Those are vault connections, not claims from the survey.

Three other notes show the dependence on the owner from different sides. How do policies determine whether agent transfers are violations? shows it inside one operator's domain: whether a transfer is a violation depends on which policy is applied, so the constraint cannot be read off the trajectory alone. The question here is the same dependence across owners. What must auditors reconstruct to verify agentic workflows? lists "which policy applied" among what must be reconstructable, so a record can show whose policy governed a step and does not settle whose should have. How does the authorization layer stay outside the poisoned path? leaves a version of the gap open inside one pipeline: an authorization layer checks a policy, and its excerpt does not say who issues the tokens or whether any agent in the pipeline can write the policy. These are again the vault's pairings.

What would count as an answer. A design or result that says, for a delegation across two organizations, whose invariants are enforced, where the check runs, and what happens when the two organizations' invariants disagree.

Why it matters. Can stateless checks ever catch sequence-level constraint violations? asks for invariants without an owner; without an owner, trajectory assurance across parties has nobody to be accountable to.