Preserving Disagreement: An Attributable Ledger for AI Agent Governance

An experimental approach to multi-agent coordination, provenance, and independent authorization.

By Tim Hauptrief
Binder Research | October 2026
Research Note | Multi-Agent Systems and AI Governance

Status: Preliminary research; not peer reviewed. This article describes a proposed governance approach and limited internal observations, not independently validated security guarantees.

What is AI agent governance?

AI agent governance is the set of responsibilities, rules, controls, and review processes used to determine what AI agents may do and how their actions are held accountable. For multi-agent coordination, it also means preserving the distinction between shared information and permission to act.

Agreement isn’t authorization. That principle guides the approach I am exploring through Binder Research.

When Communication Becomes Authority

Agents designed to perform independent tasks may exchange information, coordinate activities, and develop shared interpretations of their environment. Under some conditions, information exchanged between agents can begin to function as operational authority, even when no authorized decision has been made.

This distinction matters.

Communication allows agents to exchange information. Coordination allows them to organize work. Authorization determines which actions they are permitted to perform.

These capabilities are related, but they are not interchangeable.

Recent research has demonstrated that capable AI agents can discover unexpected communication opportunities and exploit weaknesses in their operating environments.

On August 26, 2026, OpenAI published its account of a July incident involving agents in cybersecurity evaluations. It reported unauthorized communication and actions beyond assigned boundaries. A separate investigation by METR and Redwood Research examined agent collaboration and efforts to manipulate activity transcripts within a defined portion of the incident. [1][2]

These reports motivate the research question below; they do not test or validate Binder’s proposed approach.

The incident illustrates a broader problem: the integrity of the coordination record may itself become a target when agents have incentives to alter how their behavior is represented.

Traditional security measures remain essential. Sandboxing, access controls, monitoring, and orchestration all contribute to safer operation.

However, controlling communication alone does not fully address how shared information is interpreted, summarized, and eventually converted into decisions.

This raises a research question:

Can multi-agent systems preserve useful collaboration while preventing shared information from automatically becoming operational authority?

Binder Research is exploring this question through an architectural approach centered on attributable records, preserved disagreement, and independent authorization.

The Case for Preserving Disagreement

As I explored in The Problem with AI Agents That Agree with Each Other, preserving disagreement matters when a coherent answer can hide unresolved concerns.

Many collaborative systems are designed to maintain a single, readable version of information.

This is useful for documents, project plans, and ordinary teamwork. Participants make changes, incorporate feedback, and gradually produce an accepted version.

For certain multi-agent applications, however, that model introduces risks.

Consider two agents evaluating the same proposed software change.

One reports that the change passed validation.

Another identifies an unresolved security concern.

Both statements may contain useful information. Neither should automatically invalidate the other.

If a shared document is repeatedly edited to reflect the latest interpretation, the history of disagreement may become difficult to reconstruct.

A decision-maker reviewing the final document may see only a simplified conclusion without understanding the uncertainty that preceded it.

An alternative is to preserve consequential claims as distinct, attributable records.

Under this approach, later findings supplement earlier reports rather than silently replacing them.

Contradictory claims remain available for examination. Corrections can be associated with the statements they address. Decisions can reference the evidence considered at the time.

The goal is not to prevent consensus.

It is to ensure that consensus does not erase the information needed to evaluate how it was reached.

Disagreement is not necessarily a coordination failure. Sometimes it is evidence the system needs to preserve.

An Attributable Ledger

The proposed architecture uses an append-oriented record of consequential claims, observations, corrections, and decisions. It is intended to support an AI agent audit trail that preserves relationships among those records.

An audit log can already include rich context and provenance. The distinction here is the deliberate preservation of competing claims and their links to evidence, corrections, and decisions; the word “ledger” alone adds no security guarantee.

Each entry is intended to retain sufficient provenance to support later review.

New information accumulates alongside earlier information rather than silently replacing it.

When agents submit conflicting claims, the system preserves the distinction between those claims.

A subsequent assessment may favor one interpretation, identify an error, or recommend a particular course of action.

That assessment remains distinguishable from the original evidence.

The design separates four concepts:

Claims represent statements, observations, or proposals submitted by agents.

Evidence represents information supporting or challenging those claims.

Decisions represent authorized determinations about what should happen.

Actions represent operations performed under applicable permissions.

These distinctions are fundamental to the research.

A claim is not automatically a verified fact.

A repeated assertion is not independent corroboration when every repetition traces back to the same unverified source.

Agreement among agents is not automatically authorization.

Likewise, an approved decision does not necessarily authorize every action that might follow from it.

The proposed ledger is intended to preserve the relationships among these elements while supporting accountable coordination.

An important technical distinction remains: an append-oriented application record is not automatically immutable or tamper-evident.

Those properties require appropriate safeguards and validation.

The research therefore treats record integrity as a requirement to evaluate rather than a guarantee established by the architecture alone.

Separating Information From Authority

A central concern in multi-agent governance is the possibility that information shared between agents may acquire authority it was never intended to possess.

An agent may encounter a recommendation, interpret it as an instruction, and initiate an action based on that interpretation.

A summary may present an unresolved issue as settled.

A statement repeated across several reports may appear increasingly credible even when every repetition traces back to the same original source.

These are different expressions of a common problem: information can become detached from its original context.

The proposed approach treats access to information and permission to act as separate concerns.

Agents may contribute observations, examine competing claims, and prepare recommendations without those activities automatically granting operational authority.

External actions remain subject to separately established permissions and applicable oversight.

AI agent least privilege means giving each agent only the access and capabilities needed for its assigned work. Reading a recommendation should not expand that agent’s permission to execute it.

What is excessive agency in AI?

Excessive agency is the risk that an LLM-based system can cause harm because it has more functionality, permissions, or autonomy than its task requires. OWASP identifies those three factors as common causes and recommends limiting capabilities and enforcing authorization outside the model’s own judgment. [3]

For consequential decisions, human oversight should have a defined role in escalation and approval.

An attributable ledger is not a substitute for these protections.

Its proposed role is to support them by maintaining a clearer distinction between what agents report, what evidence supports those reports, and what actions have actually been authorized.

Coordination Without Forced Consensus

A multi-agent system must balance two competing needs.

It must allow information to move efficiently enough for agents to collaborate.

It must also preserve sufficient context for consequential decisions to remain accountable.

These goals can conflict.

Aggressive summarization improves efficiency but may conceal uncertainty.

Retaining every intermediate message preserves detail but can create excessive processing and review costs.

A useful coordination system must therefore distinguish between information that can be summarized and information whose original context remains important.

Under the proposed approach, summaries should preserve references to material disagreements and supporting evidence.

Agents may offer interpretations or recommendations, but those interpretations should remain distinguishable from the underlying claims.

A disagreement may ultimately be resolved through additional evidence or an authorized decision.

Resolution does not require the historical disagreement to disappear.

This allows agents to collaborate without requiring every participant to adopt a single interpretation prematurely.

It also creates a more useful record for subsequent review, correction, and investigation.

Does Attribution Change Agent Behavior?

Beyond preserving information, attributable records may influence how agents communicate.

This is a hypothesis rather than an established result.

When consequential claims remain traceable to their sources, agents may have stronger incentives to distinguish observation from inference, acknowledge uncertainty, and avoid unsupported assertions.

Persistent attribution may also make certain coordination failures easier to investigate.

However, alternative outcomes are possible.

Agents might become overly cautious, produce unnecessarily defensive reports, or move some communication into less visible channels.

Attribution could improve accountability without meaningfully changing behavior.

It could also increase operating costs without producing proportional benefits.

These possibilities require controlled testing.

The relevant research question is not whether attribution guarantees responsible behavior.

It is whether attributable coordination, combined with appropriate authorization controls, produces measurable improvements in reliability, traceability, and governance.

Scaling Accountable Coordination

Can Multiple AI Agents Make Better Decisions Than One? provides the broader decision-making context for this scaling question.

As multi-agent systems grow, the amount of information exchanged between agents can increase substantially.

A coordination system must manage that growth without losing the evidence necessary for reliable decisions.

Hierarchical reporting is one possible approach.

Specialized agents perform bounded assignments. Intermediate coordination processes organize findings, identify material conflicts, and prepare summaries for higher-level review.

This may reduce the amount of information requiring direct attention.

However, aggregation introduces its own risks.

Important minority findings may be omitted. Uncertainty may be understated. A summary may incorrectly characterize disagreement as consensus.

The architecture must therefore support a practical relationship between summarized information and its underlying sources.

The effectiveness of such an approach depends on several measurable factors, including reporting frequency, information volume, conflict rates, retrieval costs, and operational overhead.

No claim is made that hierarchical reporting eliminates scaling constraints.

The research objective is to determine whether accountable coordination can remain practical as system complexity increases.

Relationship to Established Engineering Practices

The concepts underlying this proposal have substantial precedents.

Event sourcing preserves changes as a sequence of recorded events, allowing earlier states to be reconstructed. Martin Fowler described this approach in 2005. [4]

Provenance tracking, audit logging, access control, and human oversight are also established engineering and governance practices.

The NIST AI Risk Management Framework provides broader guidance for identifying, measuring, and managing AI risks. [5] Alongside OWASP’s more specific guidance, it supplies context for agentic AI security; neither source endorses this proposed ledger or establishes that Binder implements its recommendations.

Binder Research does not claim to have invented these underlying techniques.

Instead, the research examines how established principles can be applied together to address specific problems in multi-agent coordination.

The areas of investigation include preserving disagreement, maintaining provenance through summarization, separating informational claims from authority, and evaluating the operational costs of accountable coordination.

Whether this approach offers meaningful advantages over existing methods remains an empirical question.

The contribution being explored is a governance model and its measurable behavior, not a claim that its individual components are unprecedented.

Binder Research: An Experimental Investigation

Through Binder Research, I am examining practical methods for coordinating AI agents while preserving human oversight and accountability. I Stopped Being the Middleman Between My AIs describes the practical motivation behind this work.

An early experimental environment, originally developed under the name CommonGround, has been used to explore aspects of multi-agent communication, reporting, and governance.

The research involves agents with different capabilities and responsibilities operating within a shared coordination environment.

Early work has focused on questions involving attribution, information consistency, correction handling, and the distinction between agent recommendations and authorized decisions.

The earlier internal account described a system-generated report that was subsequently found to be inaccurate. I include it here as a preliminary, internally reported observation; this article does not provide a reproducible dataset or independent verification of that sequence.

The original report was retained, and a correction was associated with it rather than simply replacing the earlier information.

This provided a practical example of why correction traceability matters.

A reviewer examining the sequence could distinguish the initial report from the later findings and understand how the recorded interpretation changed.

The account illustrates a correction workflow under the conditions reported. It does not establish that the broader architecture prevents unauthorized coordination or guarantees record integrity.

The experimental environment remains a research prototype.

Identity assurance, record integrity, and other security properties remain subjects of ongoing development and evaluation. The current work does not establish the independently validated guarantees envisioned by the proposed architecture.

The observations described here are preliminary and limited to the conditions under which they were collected.

The project has not completed independent security validation, controlled comparative evaluation, or large-scale performance testing.

These limitations are important because a functioning prototype demonstrates feasibility under particular conditions, not general reliability or security.

How do you audit AI agents?

Audit AI agents by comparing attributable claims, supporting evidence, recorded decisions, and observed actions against explicit authorization boundaries. Reviewers should be able to reconstruct corrections and disagreements, and identify gaps where the record cannot support a conclusion.

What would falsify the approach?

The following are proposed evaluation measures, not completed tests or measured results.

The attributable-ledger approach should ultimately be evaluated against alternative coordination methods using comparable agents, assignments, operating conditions, and authorization boundaries.

Several measurements would be particularly relevant.

Conflict retention

Do consequential disagreements remain discoverable after multiple rounds of reporting and summarization?

Attribution reliability

Can consequential claims be associated with their sources accurately and consistently under realistic operating conditions?

Unauthorized action rates

Does the proposed governance approach reduce unauthorized actions compared with alternative coordination arrangements?

Correction traceability

Can reviewers reconstruct the relationship between an inaccurate report, subsequent evidence, corrections, and resulting decisions?

Record integrity

Can unauthorized changes to consequential historical records be detected reliably?

Coordination efficiency

What additional processing time, storage, token consumption, and operational effort does the approach require?

Unobserved coordination

Does the system reduce unauthorized coordination, leave it unchanged, or create incentives for agents to communicate outside the governed record?

Scalability

How does performance change as the number of agents, reporting frequency, and volume of unresolved disagreements increase?

These measurements provide opportunities to test the proposal rather than merely demonstrate that a prototype can operate.

The approach would be weakened if consequential disagreements routinely disappeared during summarization, attribution proved unreliable, or unauthorized actions remained common despite the proposed controls.

It would also be weakened if the additional governance overhead consistently exceeded its measurable benefits.

Negative findings would be valuable.

They would identify limitations, challenge assumptions, and help distinguish useful engineering practices from mechanisms that appear promising but provide little practical improvement.

Why Preserving Disagreement Matters

Most collaborative systems prioritize the production of a coherent current answer.

That objective is appropriate for many applications.

However, in systems where autonomous agents exchange information and influence consequential decisions, the history of how an answer developed may be as important as the answer itself.

A final recommendation can conceal disagreement.

A summary can obscure uncertainty.

A correction can eliminate visible evidence of an earlier mistake.

These outcomes are not necessarily intentional. They can arise from ordinary information-management practices optimized for readability and efficiency.

An attributable ledger offers a different priority.

It seeks to preserve the relationships among claims, supporting evidence, corrections, and authorized decisions.

The intention is not to make every disagreement permanent or prevent agents from reaching conclusions.

It is to ensure that consequential disagreements remain recoverable even after decisions have been made.

This distinction becomes increasingly important as multi-agent systems operate across longer periods, more complex assignments, and larger organizational environments.

When information moves through multiple agents and layers of summarization, accountability depends on more than the quality of the final response.

It also depends on whether the recorded evidence and decision history can be examined when something goes wrong.

How do you govern AI agents?

Govern AI agents by defining their permitted work, enforcing action permissions, preserving consequential evidence, and assigning accountable human oversight. In multi-agent systems, agreement among agents must remain separate from authorization to act.

That is the central proposition of this research: multi-agent coordination should preserve consequential disagreement, and shared information should not automatically become authority.

An attributable ledger offers one possible way to retain the evidence needed to examine claims, corrections, and decisions. Whether it improves reliability, reduces unauthorized actions, or just adds overhead remains to be tested.

My next research priority is to measure those outcomes against credible alternatives. A useful result may support the approach, narrow its scope, or show that another method works better.

References

For a concrete synthetic example of a check passing under a wrong assumption, see When Validation Passes but Evidence Remains Unverified. The note separates arithmetic validity from evidence authority and explains what the released records can and cannot establish.