Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance

Every agentic system being built today faces a silent design choice: how many agents? One monolithic loop handles everything, or decompose into specialized subagents — a planner, a researcher, an executor — each tuned for its role. The industry has converged on decomposition. Multi-agent is the default architecture for every agent framework shipping in 2026.

A new paper — Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance by Bowen Li and Guojun Wang — asks a question nobody else is asking: does decomposing an agent degrade the policies it's supposed to follow?

The answer is yes. And the mechanism is specific enough to fix — if you know where to look.

The Question That Benchmarks Don't Ask

Existing agent benchmarks measure one thing: did the agent finish the task? Fiducia-bench, the benchmark Li and Wang introduce, measures something else: did the agent finish the task within policy?

For a financial agent handling KYC/AML workflows, "within policy" means:

Escalate when a transaction hits a regulatory threshold
Abstain when a decision exceeds the agent's authority
Leave an auditable trail — every decision traceable to a policy rule

The question is structural: when you split a task across multiple agents, policy-relevant facts discovered by one agent need to reach the agent that acts on them. What happens at the handoff boundary?

Three Architectures, One Mechanism

The authors test three common agent architectures across 100 KYC/AML task variants, two models, and 626 episodes:

graph TB
    subgraph S1["Single-Loop (baseline)"]
        A1[One agent] --> B1[All facts
stay in context]
        B1 --> C1[Action]
    end

    subgraph S2["Fixed Pipeline"]
        A2[Scout agent] -->|handoff| B2[Analyst agent]
        B2 -->|handoff| C2[Executor agent]
        C2 --> D2[Action]
    end

    subgraph S3["Orchestrator-Subagent"]
        A3[Orchestrator] --> B3[Subagent 1]
        A3 --> C3[Subagent 2]
        B3 -->|handoff| A3
        C3 -->|handoff| A3
        A3 --> D3[Action]
    end

    style S1 fill:#1e3a5f,stroke:#3b82f6,color:#fff
    style S2 fill:#27272a,stroke:#a78bfa,color:#fff
    style S3 fill:#27272a,stroke:#e879f9,color:#fff

The result: in every decomposed architecture, policy-relevant facts attenuate at handoff boundaries. The mechanism is not catastrophic failure — it's selective forgetting. The Scout finds a risk signal. By the time the Executor gets the handoff, that signal is gone.

The Numbers

With a 32B open-weights model (tested at constraint distance 2 — regulators are watching):

Single-loop: 0% of discovered facts attenuated
Fixed pipeline: 56% attenuated
Orchestrator-subagent: 85% attenuated

With gpt-4.1-mini:

All architectures: 3–6% attenuation across the board

That gap — 56–85% vs 3–6% — is the real story. The governance cost of decomposition is partly a function of model capability. A stronger model retains more facts across handoffs. But neither model is immune: even gpt-4.1-mini drops 3–6% of policy-relevant facts, and in a regulated setting that's not noise, it's liability.

Critically, the mechanism cuts both ways. The same attenuation that drops risk signals (under-escalation) also drops exculpating facts (over-escalation). An orchestrator that loses the "this transaction is fine because of X" memo flags a false positive. Governance degradation is bidirectional.

What This Means for People Building Multi-Agent Systems

Every framework shipping today — Anthropic's MCP, Google's A2A, LangGraph, CrewAI, AutoGen — defaults to decomposition. The pitch is modularity, specialization, and debuggability. What this paper shows is that each handoff is a governance leak.

The practical implication is stark: if you're building agent systems for regulated domains — finance, healthcare, insurance — you cannot assume that policy compliance survives decomposition. You need to verify it. The authors' fix is simple but non-standard: place verification gates at the handoff boundary, not at the end of the pipeline. Catch the attenuation before the action, not after.

For the agent-infrastructure crowd: this is the governance analogue of the Hallucination Snowball problem. That paper showed hallucinations transform and become undetectable across handoffs. This paper shows policy facts do the same thing. The two mechanisms are different expressions of the same structural flaw: handoffs are lossy, and the loss is invisible to the receiving agent.

Limitations

Constraint depth: All experiments use constraint distance 2 (regulators one step away). Real financial compliance can involve deeper chains of delegation and oversight. The attenuation curve for distance 3, 4, or 5 is unknown.
Domain specificity: KYC/AML is a particular regulatory context. The mechanism likely generalizes (fact attenuation at handoffs is architecture-level, not domain-level), but the specific attenuation rates may shift.
Two-model comparison: Only one open-weights and one proprietary model. The 56–85% vs 3–6% gap could compress or widen with other models, especially frontier systems with larger context windows.
Task structure: The 100 task variants are synthetic. Real KYC workflows involve unstructured data, conflicting signals, and ambiguous policy triggers that may amplify or dampen the attenuation.
Preprint length: 8 pages with 3 tables and 1 figure suggests room for deeper analysis on intervention effectiveness.

The Upshot

Decomposition is not free. Every handoff boundary in a multi-agent system is a governance tax — facts attenuate, policies degrade, and the degradation compounds with architectural complexity. Stronger models reduce the tax but don't eliminate it.

If you're shipping multi-agent systems, read this paper. Then add boundary verification to your handoff protocol. The mechanism is known. The fix is understood. The only question is whether you check at the boundaries or after the damage is done.

Source:

Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance — Bowen Li, Guojun Wang, Aug 2026