Multi-Agent Systems

Why Multi-Agent?

Split roles when tools, prompts, and success checks actually diverge — not because a slide showed four chatbots. Two LLM calls are a bill, not a society.

Split or Merge

If two roles share the same tools and the same done-check, they are one agent with two hats. Merge them. Draw the boundary as data.

The Coordination Tax

Every extra agent needs a message schema, an orchestration policy, shared memory with access control, team evals, and a story for loops. If you cannot name those, you are not ready to multiply agents.

The Interface Is Data

Researcher returns {brief, citations}. If the interface is “whatever they said in chat,” you will debug tone for a quarter and leak instructions sideways.

Keep a Single-Agent Baseline

The split has to beat one loop on evals. If it does not, delete a persona. Multi-agent is not an identity. Score quality, cost, latency, and incidents.

Roles: Planner, Worker, Critic

Three classic roles with different tools, outputs, and stop conditions. The critic should not hold the worker’s write tools. Start with this trio, not a soap opera.

Tool Isolation Is the Point

Each role has an allow-list. Planner cannot patch src. Coder cannot refund. Isolation is a security boundary the dispatcher enforces, not a vibe in a persona paragraph.

The Critic Does Not Write

Fixes go back to the worker as a new assignment. A critic with write tools is a second worker arguing in production, and the audit trail dies.

A Blackboard, Not a Group Chat

The current plan, artifacts, and decisions live in a typed store keyed by the run. Chat is the worst shared memory: unordered, untyped, and injection-friendly.

Handoffs Are Typed Events

Planner → worker is {step_id, inputs, budget}. Critic → worker is {issues, attempt}. Paragraphs cannot be retried, hashed, or denied by destination.

Orchestration: Sequential, Handoff, Supervisor

Who speaks next: a fixed pipeline, peer handoff, or a supervisor that assigns work. Pick one, log it, and know how each pattern fails.

Sequential Is the Default

A workflow that happens to contain agents. Prefer it when the graph is stable. Agents do not pick the next agent. HITL is a node in the list, not a thought.

Hop Limits and Acyclic Graphs

A may call B, B may not call A. Same payload hash twice stops. Unbounded handoff is an infinite loop. Cap hops before you add a manager persona.

Supervisor Star, Not a Mesh

Workers talk only to the supervisor. Secret side-channels between workers are how you lose the audit trail, skip the critic, and undo tool isolation.

Supervisor Plus a Sequential Subgraph

A mature shape: the supervisor picks a pipeline. Billing always runs extract → policy → HITL → apply. That is not a purity failure. Irreversible steps stay off a chatty handoff graph.

Debate and a Judge

Two agents disagree on purpose; a judge (or a grounded checker) picks. Debate is expensive — use it on hard, checkable, high-stakes questions, not on FAQs.

Ground the Judge

Two models agreeing is not truth. Agreement without evidence is a chorus. The judge must see the same snippets the user will see, blinded to speaker names.

Swarms of Cheap Workers

Fan-out many small jobs, fan-in the results. Swarms are map-reduce, not a group chat with 50 personas. Independent items, tiny tools, priced fan-out.

Reduce Is the Product

Map is easy. Never concatenate 200 traces into a supervisor prompt. Reduce down to a table: vote, merge ids, drop schema failures, list missing items.

A Write Barrier After Map

Map workers are read-only (or write only to their own prefix). Money and email happen once, after reduce, in the parent apply step, with an idempotency key.

How Multi-Agent Systems Fail

Ping-pong loops, cost explosions, conflicting tools, sideways injection, and traces you cannot replay. If you cannot name the failure, you will ship it. Price swarms before launch: 20 may fit the cap; 50 must not.

Detect Ping-Pong

Same payload hash twice, or A→B→A on a DAG, is a stop. A manager persona with more tools is not a control. Put cannot: ping-pong on the job and handoff.

One Writer Per Record

Two roles mutating the same customer is a distributed race with a chat UI. Lock per record, or give writes to one apply role. Children never take the lock.

When Not to Swarm

If a sequential pipeline or one agent will do, ship that. Complexity is not an achievement. Swarm only for independent map, boring reduce, priced cap, write barrier. Next track is evals.