Protecting the System, Stranding the User: The Limits of Multi-Agent Authorization

Current multi-agent authorization architectures prioritize system integrity over human outcomes. While recent models successfully prevent privilege escalation, they quietly externalize the cost of failure onto the human operator. Re-centering authorization around human impact exposes four structural vulnerabilities in current paradigms. First, labeling semantic intent as verified is false because intent-fidelity is formally undecidable, systems must replace deceptive guarantees with explicitly probabilistic, risk-anchored thresholds. Second, dynamic trust scores fail across multi-agent handoffs; transmitting algorithmic judgment across a company boundary without underlying evidence violates Contextual Integrity. Third, treating a safely halted workflow as a successful refusal is a category error if it strands the user; compensating actions must be bound directly to the capability token rather than the planning layer. Finally, we hypothesize that frictionless automated recovery introduces a moral hazard, disincentivizing developers from building robust initial intent checks. We conclude by proposing an architectural synthesis to bridge the gap between deterministic security and human outcomes, alongside the fundamental theoretical limits that remain unresolved.