Treat every agent's output as a claim to be checked, not a fact to be trusted. Validate at each handoff, cap how much any one agent can affect in a period, and keep lineage on all work, so that once a mistake is found, everything downstream can be found, held and corrected. Then drop the faulty agent's depth.
Why do mistakes spread between agents?
Because each agent assumes its inputs are right. A person passing work to a colleague might add "I wasn't sure about this one". An agent rarely does, and the next agent receives confident output either way. Once a wrong figure enters a chain, each agent that uses it adds work built on the error.
The faster and more automated the chain, the further a mistake travels before anyone looks. Speed that is useful when outputs are right becomes the problem when they are not.
What are the practical steps?
- Narrow each agent's role. An agent that does one job has one way to be wrong. The case against a single agent doing everything is set out in whether one AI agent should do everything.
- Mark agent output as derived. When one agent's output reaches another, it carries the producing agent's identity and the sources it used. A figure an agent extracted from a supplier's document is still external, however confidently it is passed on.
- Validate at the handoff. The receiving step checks the input against something independent: a system of record, a tolerance, a format rule.
- Cap reach. Limit how many records, how much value or how many customers one agent can affect in a period. A mistake that hits the cap is held rather than repeated.
- Never let a chain of claims authorise money. A payment should rest on facts the business holds itself, not on a sequence of agents passing on something a third party asserted. See how to stop external claims from authorising payments.
- Keep lineage. Every output records what it was built from, so you can find everything downstream of a bad input.
- Quarantine fast. When an agent is found faulty, its depth drops at once and its recent outputs in flight are held.
What may agents do, and what stays with a person?
| When an error is suspected | Agents | People |
|---|---|---|
| Flag an input that fails validation | Yes | None |
| Hold work built on a flagged input | Yes, automatically | None |
| Find downstream work by lineage | Yes, list it | Review the list |
| Correct affected records | Draft corrections | Approve them |
| Restore the faulty agent's depth | No | After recertification |
Accountability for the outcome sits with people, as discussed in who answers for an AI agent's mistake.
What does this look like in practice?
Take a wholesaler running an extraction agent on supplier invoices, a matching agent and a payment-prep agent. A supplier changes its invoice layout, and the extraction agent begins reading the currency field from the wrong place. Invoices in euros arrive as pounds.
The matching agent's handoff validation compares each invoice's currency with the purchase order. The first mismatch is held. The reach cap means the extraction agent has processed a limited number of invoices that day, and lineage shows exactly which ones. Three were already matched against purchase orders in pounds by coincidence; those are held too. The extraction agent's depth drops to read-only while its certification is re-run on the new layout. The payment run that evening contains no affected invoices. A person approves the corrections the next morning.
Why does one source of truth for permissions matter here?
When a mistake is found, you need to reduce one agent's authority immediately and know that every other agent sees the change. If permissions are scattered across agent configurations, that takes hours and leaves gaps. If they are held in one source of truth for what agents may do, it is one change, effective at the next action.
Orchestrated setups need the same discipline, since an orchestrator can spread a sub-agent's mistake across many tasks quickly; see how to run several AI agents under one orchestrator.
Where Pryme fits
Pryme stamps every fact with its provenance class, so an extracted external figure stays external through every handoff. A certification run that clears no depth drops an agent to depth 1 the same day, and because every verdict sits in one append-only record, finding the affected work is a query. The full design is in the governed agentic operating system guide.
Questions people ask
Can a second agent catch the first agent's mistakes?
It can, if it checks against a different source. A second agent reading the same input with the same model often repeats the same misreading.
How quickly should a faulty agent be stopped?
As soon as the fault is suspected. Reducing depth is reversible; letting a known fault keep acting is not.
Should the whole chain stop when one agent fails?
Not usually. Hold the work that depends on the faulty agent's outputs and let unrelated work continue. Lineage is what makes that distinction possible.