AgentAccord
Organization-scoped runtime governance for multi-agent delegation.
Overview
LLM agents increasingly operate as persistent organizations with evolving membership, roles, and delegation. Existing multi-agent frameworks coordinate who should act and where requests may flow, but do not ensure that a delegation remains authorized when it reaches the receiver or that a claimed completion is backed by a verified artifact.
I co-authored AgentAccord (with Zhanlin Cui, Xuanhua Yin, and Boyu Wei) to make multi-agent organizations executable by treating every privileged delegation as a governed transaction. Each delegation request carries a short-lived, single-use credential binding its caller, receiver, intent digest, runtime-derived authorization path witness, current authority epoch digests, and completion contract.
Immediately before execution, the receiver gateway revalidates current authority state and atomically consumes the credential nonce once, failing closed on role revocations, edge edits, or stale endpoints. Terminal success is committed only after the produced artifact satisfies the bound verifier contract, and every authorization, execution, recovery, and completion event is recorded in a causally linked, hash-chained log.
Across six normalized defenses, five unaugmented official framework paths (AutoGen, CrewAI, LangGraph, MetaGPT, OpenAI Agents SDK), and A2ASecBench, AgentAccord is the only evaluated method that jointly preserves authorized task delivery (18/18 benign artifacts valid) while blocking 100% of stale receivers (6/6), illegal delegations (6/6), unauthorized effects under prompt injection (24/24), and artifact-free completion claims (6/6) — while improving failure-class attribution by +26.7 percentage points over output-only evidence.
Key features
State-bound single-use credentials
Cryptographically binds caller, receiver, intent digest, authorization path witness, authority epochs, and completion contract to a single-use nonce.
Linearizable receiver admission
Revalidates live authority digests and policy slices at delivery time and atomically consumes the nonce (#Dispatch <= 1), blocking replay and TOCTOU drift.
Contract-relative completion soundness
Separates permission to start from proof of completion — rejects hallucinated or artifact-free completions unless the bound verifier accepts the artifact.
Hash-chained causal audit log
Links authorization, execution, recovery, and verification into a tamper-evident causal graph — boosting failure-class attribution by +26.7 pp (30/30 exact recovery).
Zero boundary violations across 6 defenses
18/18 benign utility preserved while blocking 6/6 stale receivers, 6/6 illegal delegations, 24/24 injection side-effects, and 6/6 unsupported completions.
A2ASecBench & 5-framework evaluation
Outperforms baselines across all 13 A2ASecBench endpoints (88% authentic agent-card selection vs. 34% baseline) and 486 cross-framework runs.