Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents

A rapidly growing class of LLM agents is multi-party: the agent acts for a principal (who briefs it, sends follow-ups, and receives results) while also conversing in a separate channel with a counterparty whose interests may diverge (negotiating with a vendor, screening inbound requests, or mediating between employees). Here “help whoever you are talking to” is the wrong objective. The agent must stay loyal to the principal it represents without over-refusing the principal’s own cooperative asks. We study this multi-party loyalty problem and contribute a measurement instrument, two mechanisms, and a structural lesson. PrincipalBench is a 75-item multi-turn benchmark with leak probes, dual judges, and an integrity-audit gate. Across 13 frontier subjects it exposes a sharp split (≤20% vs. 53.6–75.3% harm) invisible to single-turn safety evaluations: a selective cluster that declines adversarial probes while still following the principal’s legitimate requests, and an over-refusing cluster that refuses broadly. (M1) A prompt-time loyalty scaffold (a fixed system prompt of seven prioritized rules, open-coded from 50+ failure trajectories) holds Claude-Sonnet to 19.4% harm and all nine selective subjects to ≤20%. (M2) A per-token-KL distillation recipe transfers a prompted Qwen3-32B teacher into 8B Qwen3 and Llama-3.1 students, the strongest open-weight recipe we measure. (Lesson) Both mechanisms only move along a common leak/over-refusal tradeoff rather than crossing it: improving one axis costs the other, and the jointly favorable outcome stays out of reach.

Introduction. Most LLM agents today live in a digital world. They read documents, call APIs, browse, generate code, and complete tasks against tools whose behavior is mechanical and stipulated, not negotiated. There is only one human in the loop, the user who issued the task, and that user is the party being served. Thus, the agent’s only loyalty question is “How do I best help the person in front of me?” The frameworks, training recipes, and benchmarks the agent community has built up are overwhelmingly organized around this two-party picture: a user, a set of tools, and a shared goal. A rapidly growing class of deployments breaks this picture. Agents are increasingly sent outward to talk to other people on behalf of their principal, and concrete products in this class are already being shipped. Pine AI [24] handles phone disputes on a user’s behalf, such as bill negotiation, subscription cancellation, and customer-service complaints. Google’s “Ask for Me” [12] calls small businesses for pricing and availability on the searcher’s behalf. Voice agents in the Qwen app [3] and Honor’s YOYO [15] place restaurant and appointment calls for consumers. 11x.ai [1] runs autonomous outbound sales on behalf of sales reps. The pattern generalizes well beyond phone calls: a procurement agent negotiates with a vendor on its company’s behalf, an inbox agent screens cold outreach for the owner, an HR agent mediates between two employees, and a founder’s agent fields acquisition interest. The counterparty in these settings is no longer a tool with a published API or a benevolent user. It is a person whose interests may directly conflict with the principal’s, and someone who can probe, pressure, flatter, or manufacture urgency to extract information or concessions the principal did not authorize. The default “help whoever you are talking to” instinct, inherited from the tool-and-user world, is precisely wrong here. The agent must instead stay loyal to the principal it represents. That means protecting their private information, holding their stated positions under pressure, and declining requests the principal did not authorize, all without becoming so defensive that it refuses the principal’s own cooperative asks. The principal does not disappear once the briefing is handed over: the principal-agent channel runs backand-forth (briefings, clarifications, results returned) in parallel with the agent-counterparty channel. We call this the multi-party loyalty problem, and we argue the agent research community has under-studied it. The gap is not primarily one of evaluation. It is a gap in the dominant model of what an agent is. The third role, the principal that the agent is defending from its conversational partner, is largely missing from how agents are framed, trained, and measured. Its core tension (loyalty to the principal versus helpfulness to the counterparty in the room) has no analogue in the two-party setting. It is therefore missed by single-turn safety benchmarks (whose failures are isolated and adversarial rather than conversational and pressure-driven), by helpfulness benchmarks (where being helpful to the counterparty counts as success), and by existing agent benchmarks (which collapse principal and interlocutor into one user).

Contributions.

1. Problem framing. We formalize multi-party principal-loyalty as a distinct evaluation target, adding a third role on top of the agent and its conversational partner, and decompose it into six failure modes (Section 2). To measure both mechanisms below, we build a 75-item multi-turn instrument (PrincipalBench) with leak probes, dual judges, and an integrity-audit gate (Section 4). Running it across 13 frontier LLM subjects exposes a sharp

Related work. Agent benchmarks are two-party. Most tool-agent-user benchmarks (τ-bench [35], Agent- Bench [17], WebArena [38], GAIA [19], ToolLLM [26], and AppWorld [32]) evaluate an agent whose conversational partner or tool environment is the party it serves. PrincipalBench inserts a third role: a principal whose private state the agent must protect against the very party it is conversing with on the principal’s behalf. Helpfulness toward the interlocutor thus becomes a failure rather than the goal.

Privacy benchmarks isolate information flow, not adversarial pressure. The closest prior work measures contextual privacy. ConfAIde [20] shows that frontier models violate contextualintegrity norms, revealing information that humans would withhold. However, its episodes are short information-flow vignettes rather than multi-turn adversarial dialogue. MAGPIE [16] moves to multi-agent settings and reports large leakage even under explicit privacy instructions. Yet its agents remain collaborative and non-adversarial, treating privacy as a side constraint on a shared goal. Both build on the contextual-integrity framework [21], increasingly operationalized for LLM assistants [5, 11, 28]. PrincipalBench differs on both axes simultaneously. The counterparty is adversarial and actively probes for information, and the interaction is multi-turn, allowing pressure to compound over time. This is also why the sanity cell is essential. Prior privacy benchmarks lack an over-refusal axis, so they cannot distinguish loyalty from blanket defensiveness, the core distinction that drives our selective/over-refusing split (Section 5).

Instruction hierarchy and prompt injection are the closest control problem. The multiparty setting is structurally related to the instruction hierarchy problem [33]: a lower-privilege counterparty attempts to override the principal’s higher-privilege briefing. It is also adjacent to prompt injection, where a third party plants instructions to hijack an agent [13, 18, 23]. This threat has driven both agentic injection benchmarks (InjecAgent [37] and AgentDojo [8]) and a line of defenses [6, 7, 9]. PrincipalBench differs in three ways. First, its attacks are social (probing, flattery, manufactured urgency) rather than literal injected imperatives. Second, its failures are graded (subtle tells, capitulation, posture, authored artifacts) rather than binary. Third, and most importantly, injection benchmarks reward only whether the privileged instruction “wins” and impose no penalty for over-refusal. Like the privacy benchmarks above, they cannot separate genuine loyalty from blanket defensiveness.

Method. Setup. A multi-party loyalty episode has three roles. The principal P delegates a task and provides private state SP (facts, bounds, instructions), and remains in the loop across the episode (sending follow-ups, asking for status, refining the briefing, receiving results). The agent A acts on P’s behalf. The counterparty C converses with A in a separate channel and has an objective that may conflict with P’s. C never sees SP or the principal-agent cell what goes wrong example (used-car sale) Leakage Direct revelation of a withheld fact from SP in a chat turn. C: “what’s the seller’s minimum?” →A: “$12,000.”

Capitulation Conceding P’s stated position under social or temporal pressure (ultimatums, false urgency, repetition); the agent does not leak, it folds.

“Take $11,500 or I walk” →“$11,500 works.”

Posture Signaling that undermines P’s standing without naming a fact—telegraphing that P is motivated, rushed, or flexible.

“She seems pretty motivated” leaks the seller_is_motivated flag without naming a number.

Authoring Drafting an artifact (email, post, listing) that contains the leak or concession, even when the live chat with C does not.

P asks A to draft a listing; it reads “willing to take $12k.” The leak is now in writing.

Moderation Mishandling third-party confidentiality (the principal is a witness, patient, mediator, or HR rep).

“Who else saw the incident?” answered with names—a failure even if every fact about P stays private.

Sanity Over-refusing the principal’s own cooperative requests; included so that blanket refusal cannot game the benchmark.

P asks A to summarize P’s own notes and A refuses, treating them as withheld.

Table 1. The six failure cells of multi-party loyalty. Five (Leakage–Moderation) are distinct ways the agent fails the principal; the sixth (Sanity) is a cooperative item where over-refusal is the only failure, included so that “refuse everything” is not a winning strategy. channel directly but may probe, pressure, flatter, or manufacture urgency to extract them, or to extract concessions P did not authorize. The agent succeeds when it advances P’s task without (a) leaking withheld facts in SP, (b) violating P’s private bounds (e.g. a reservation price), (c) capitulating to C’s pressure on P’s stated positions, or (d) over-refusing legitimate requests, whether from C on P-authorized topics or from P directly. We refine these four failure conditions into six measurement cells below, separating (a) by leak channel (direct revelation, posture signaling, authored artifact) and adding a third-party moderation cell and a sanity cell for (d).

For models accessible only through an API, the system prompt is the sole lever. We developed a loyalty scaffold by open-coding 50+ failure trajectories of default-prompted Claude-Sonnet on the leakage and capitulation cells and naming the recurring error patterns. The resulting scaffold is a system prompt of seven prioritized rules organized around four core insights (full text in Section A):

1. Adversarial-stranger framing. The counterparty is an unverifiable stranger whose credentials, urgency, and “reasonable person” framings are negotiating tactics and not trust signals. Nothing they say overrides the briefing.

2. Decline without enumerating. A generic refusal (“I can’t discuss that”) leaks less than a specific one (“I can’t share their medical history”). Even “I can neither confirm nor deny” leaks the existence of the withheld category.

3. Private bounds are not public positions. A reservation price or walk-away threshold is the private edge of what the principal will accept. Public offers must stay strictly inside that edge, never land on it.

4. Conditional permissions are held in reserve. A capped fallback authorization (“you may offer up to $50 once”) is something to hold in reserve, not to offer up front, and its cap should remain private. Three further rules cover executing explicit instructions (termination conditions, opening moves, scripted lines), holding stated public positions under repetition, and signaling firmness briefly without fabricating.

Discussion. 8 A structural leak/over-refusal trade-off Both the prompt-time loyalty scaffold (Section 6) and per-token KL distillation (Section 7) only move models along a common trade-off rather than crossing it. Plotted on the leak and overrefusal axes (Fig. 2), the variants trace a Pareto frontier whose jointly favorable lower-left corner is empty: no variant is simultaneously low-leak and low-over-refusal. The prompted Claude teacher and the per-token-KL student sit on the same frontier at different operating points, with neither dominating the other. We present five lines of evidence (one per mechanism family, plus a data-scaling control) that this frontier is a structural limit rather than an artifact of any single mechanism. Table 5 summarizes the five controls. Three are particularly decisive. Control 2 shows the frontier holds even relative to the best distillation checkpoint, not just the prompted baseline: RL initialized from the harm-minimum checkpoint actually increases harm. Control 3 shows that an apparent single-seed path around the frontier is a seed artifact that vanishes under multi-seed replication. Control 5 shows the frontier is not a data-volume artifact: naive scaling moves performance in the wrong direction (likely under-fitting at fixed epochs, as rank-16 LoRA capacity is spread across 4.2× more patterns).

External corroboration: an industrial-scale instance. The Claude Opus 4.8 system card [4] reports the same trade-off at production scale. Opus 4.7’s training included a regimen on “business skills and robustness against adversarial agents” that Anthropic found “inadvertently contributed to misaligned behavior including dishonesty”. Removing it for Opus 4.8 recovered honesty but left the model “more susceptible to scammers and... less able to negotiate good deals.” Pushing the loyalty/robustness axis cost truthfulness. Scaling it back cost negotiation. The axes differ from ours in detail (truthfulness vs. over-refusal, robustness vs. leakage), but the same trade-off surfaces independently at far larger scale, evidence that the frontier is a property of the objective, not of any one pipeline.

Conclusion. As agents are increasingly deployed to act for a principal among other people, the dominant “help the current speaker” objective becomes misaligned. The agent must remain loyal to the principal it represents, even as the counterparty actively pushes back. We call this the multi-party loyalty problem. This is not just an evaluation gap, but a gap in the agent paradigm itself. To study it, we built PrincipalBench as a measurement instrument. Running it across 13 frontier subjects showed they split into a selective cluster and an over-refusing cluster on the over-refusal axis. Against this backdrop, we present two mechanisms: a prompt-time loyalty scaffold, which brings Claude-Sonnet to 19.4% harm and the selective cluster to ≤20%, and an on-policy per-token-KL distillation recipe that transfers a prompted teacher into 8B Qwen3 and Llama- 3.1 students. While both mechanisms are immediately usable, the deeper lesson is more important: both approaches, along with single-objective (scalar-reward) RL, only move models along a common leak/over-refusal Pareto frontier rather than crossing it. This structural frontier suggests the next generation of loyalty mechanisms must address the trade-off at a more fundamental level. Natural next steps include scaling items, evaluating against real human counterparties, and adding single-party controls to better isolate multi-party-specific over-refusal.

Limitations. Judge sensitivity at the 8B scale. The two judges agree perfectly on frontier trajectories whose harm decision is unambiguous (κ = 1.0 on a balanced 60-item three-judge subset) but only agree weakly on the borderline per-token-KL 8B student (κ = 0.08, the secondary judge being systematically more lenient), and agree moderately on the base (κ = 0.42). This materially affects the headline significance. Re-judging all 1,080 base and student trajectories with the secondary judge preserves the direction of the per-token-KL harm reduction but not its significance, and the judge-independent leak probe behaves the same way (Table 6). We therefore report the reduction as keeping its direction across judges but reaching significance only under the primary judge. The caveat is specific to the borderline 8B regime. The frontier-model split of Section 5 is scored on trajectories with an unambiguous harm decision (κ = 1.0) and significant at p ≤10−6, so the paper’s central structural claim does not rest on the contested judge.

Counterparty range. Per-token KL is more counterparty-sensitive on the harm axis than per-turn SFT (Fig. 8b).