First surfaced in Tandemly Briefing — 2026-09-07.
The quorum looks safe.
until the source fails.
More reviewers only helps when those reviewers actually see different things. Researchers Jun He and Deying Yu formalize what happens when they don't: a multi-agent approval system can scale to any number of agents and still have the structural resilience of one.
Counting voters
is not counting independence.
As agents gain the ability to take consequential actions, the standard response is to require approval from multiple agents before acting. The assumption underneath that response is that multiple reviewers are meaningfully independent. That assumption is usually wrong.
Imagine a system where three agents must each approve a high-stakes database write before it executes. On paper this looks robust: no single point of failure, no single agent whose compromise sinks the whole operation. It looks like the kind of defense-in-depth that security engineers reach for.
Now ask where each of those three agents gets its information. If they all consult the same telemetry feed, read from the same document store, or call the same tool backend, then a failure in that shared source propagates to all three simultaneously. All three agents see the same corrupted picture. All three vote to approve. The quorum passes. The harmful action executes.
This is not a theoretical edge case. Most agent systems share infrastructure. Document retrieval pipelines, monitoring dashboards, and tool APIs are typically singletons, accessed by every agent in the system. The appearance of redundancy exists; the substance of it does not.
What was missing was a formal way to measure this. Without a metric, "add more reviewers" continues to feel like progress even when it provides no additional structural protection.
When a multi-agent quorum authorizes a high-stakes action, how many independent failures would actually be required to produce a false authorization? And is that number determined by the number of agents, or by something else entirely?
Epistemic Fault Domains
and the structural cut.
He and Yu contribute two things: a formal model for describing how agents share upstream dependencies, and a metric for measuring how many independent failures a quorum can actually absorb. The metric is not about agent count. It is about the structure of what agents read.
The first building block is the Epistemic Fault Basis: an enumeration of every upstream source an agent system depends on. Each entry in the basis is a root that, if corrupted, could produce false beliefs in the agents that read from it. Think of it as a dependency map drawn one level above the agents themselves: not "which agents exist" but "which sources exist and which agents read from each."
From that basis, the authors define an Epistemic Fault Domain (EFD): the set of agents whose beliefs could be compromised by corruption in a specific root. If ten agents all query the same document store, that document store defines one EFD covering all ten. Any quorum drawn entirely from within one EFD provides no structural redundancy, because all members share a single fault.
The key metric is the Structural Epistemic Cut, written as kappa-E. It measures the minimum number of root faults from the Epistemic Fault Basis whose exposure would be enough to compromise an authorizing coalition. Specifically: how many roots would an attacker need to corrupt to ensure that enough agents see a false picture to approve the action?
A kappa-E of 1 means a single corrupted source is sufficient. A kappa-E of 3 means an attacker would need to corrupt at least three independent roots. Standard security practice around Byzantine fault tolerance aims for the analogue of this in physical systems: requiring failures in k independent components rather than one. The paper establishes the same concept for the epistemic layer, and proves several results about how quorum design choices affect it.
The Dependency-Aware Quorum Controller is the enforcement mechanism that comes out of this framework. It sits at the admission layer of a quorum decision and computes kappa-E for the proposed authorizing coalition. If the cut falls below a configured threshold, the authorization is rejected and a higher-kappa-E coalition is requested instead.
It decomposes quorum safety into two separate terms. The first is validity: what does the Epistemic Fault Basis actually cover? The second is compliance: does the quorum controller actually enforce the threshold? You can audit each term independently, and you can diagnose whether a failure was a modeling failure (the fault basis was wrong) or an enforcement failure (the controller was bypassed).
The modeling step is the hard one. kappa-E is only as honest as the Epistemic Fault Basis you construct. If a shared source is missing from the basis, the metric looks better than it is. The paper is explicit about this: the approach is load-bearing on how carefully the fault basis is written.
Three results that cut
against standard practice.
The paper derives formal proofs rather than reporting empirical accuracy numbers. The evaluation runs against a frozen 120-task simulation benchmark rather than a production deployment. But the proof-level results are the point: they hold by construction, not by chance.
An exposure extension is compatible when the new agent added to the quorum shares at least one upstream root with an existing coalition member. In practice, this describes most "add a reviewer" decisions: the new reviewer is drawn from the same team, uses the same tools, and reads from the same data sources. The condition under which the proof applies is the common case.
The evaluation is analytical derivation plus simulation against a frozen 120-task benchmark rather than a production deployment. This means the proofs are sound but the behavioral claims about the Dependency-Aware Quorum Controller have not been tested at production scale or under adversarial manipulation of the fault basis itself.
kappa-E is only as honest as the Epistemic Fault Basis the team writes. This is the load-bearing and most easily gamed part of the approach. A fault basis that omits shared dependencies will report an inflated kappa-E, and nothing in the framework catches that omission automatically. The modeling step requires independent audit.
Quorum strength is
a source-count question.
The actionable move is not about agents. It is about mapping what those agents read, and adding reviewers on genuinely disjoint information paths rather than adding more reviewers who see the same thing.
Where to go
from here.
Applying this framework starts with a mapping exercise, not a new deployment.