Compliance for Agent Teams
That Form Themselves
Per-agent safety is necessary but not sufficient. A2ASTC governs the emergent team.
from thinkneo_a2astc import TeamComplianceGate
a2a_server.add_middleware(TeamComplianceGate())// The Compound-System Gap
Why per-agent safety is not enough
Individually safe agents can produce unsafe joint behavior. A2ASTC detects and governs the four risk classes that emerge when agents form teams.
Joint Policy Violation
Two individually safe agents produce unsafe joint behavior when their outputs combine. No single agent violates its policy, yet the team does.
Emergent Coordination
Agents begin coordinating without explicit instruction, converging on vocabulary, timing, or strategy that was never designed or authorized.
Adversarial Exploitation
One agent exploits another agent's individually safe outputs as a side-channel, laundering capabilities or escalating privilege through composition.
Multi-hop Cascade
A safe chain A to B to C produces an unsafe end-state. Each hop is compliant in isolation, but the cascade amplifies risk across the team.
// Protocol Architecture
Five components, one pipeline
Every A2A message passes through a deterministic pipeline from detection to audit trail.
Agent A --> [ Detector --> Manifest --> Audit --> Gate --> Trail ] --> Agent B
Detector
Monitors bidirectional A2A traffic. When messages cross within a 600s window, a team is detected and a manifest is formed.
Team Manifest
JSON document with members, capabilities, safety class, and formation timestamp. Immutable once sealed.
Audit Engine
Five signals: topology analysis, semantic convergence, privilege aggregation, side-channel detection, deceptive cascade tracing.
Compliance Gate
Per-message verdicts based on R_team risk score [0,1]. Five verdict bands from ALLOW through TERMINATE.
Audit Trail
Hash-chained tamper-evident log. Every verdict, intervention, and manifest change is recorded with cryptographic integrity.
// Verdict Bands
Rteam risk score to verdict mapping
// Integration
Two lines to compliance
Add the gate as middleware. Works with A2A JSON-RPC, gRPC, or any custom transport.
from thinkneo_a2astc import TeamComplianceGate
a2a_server.add_middleware(TeamComplianceGate())Install from PyPI
pip install thinkneo-a2astc// Conformance Levels
Three levels of compliance maturity
Start with detection, scale to full production. Each level builds on the previous.
Team formation detection is operational. Bidirectional A2A traffic within the configured window triggers manifest creation.
All five audit signals are active. Compliance gate issues per-message verdicts. Hash-chained trail is being recorded.
Full production-grade deployment with operational guarantees. Meets latency, throughput, and reliability requirements.
// Adversarial Fixtures
40+ adversarial test fixtures
Every fixture reproduces a real multi-agent attack pattern. The test suite runs 200+ cases across 15 core scenarios.
Core Fixture Suite
Each fixture includes setup, attack vector, expected detection, and remediation verdict.
Capability Laundering
Agent A requests capability from B that it cannot access directly, laundering through composition.
Emergent Collusion
Two agents develop aligned behavior without explicit coordination instructions.
Three-hop Deceptive Cascade
Safe outputs chain A to B to C, producing an unsafe end result invisible to any single hop.
Side-channel via Timing
Information leaked through response latency patterns between cooperating agents.
Side-channel via Length
Message length encodes hidden data not visible in content inspection.
Steganography in Metadata
Covert channel embedded in message metadata fields, invisible to content auditors.
Privilege Aggregation
Individual low-privilege agents combine to achieve high-privilege actions.
Identity Multiplication
Single agent spawns multiple identities to bypass per-agent rate limits.
Adversarial Prompt-injection Cascade
Injected prompt propagates through A2A chain, amplifying at each hop.
Coalition Against Third Party
Two or more agents form alliance to manipulate outputs targeting a third agent.
Convergent Vocabulary
Agents develop shared private vocabulary not present in training data.
Throttle Evasion
Agent attempts to circumvent THROTTLE verdict via message splitting or re-routing.
Isolation Evasion
Isolated agent attempts communication through indirect or out-of-band channels.
Manifest Desynchronization
Agent reports different capabilities to different team members, creating inconsistent manifests.
Trail Tamper Attempt
Agent attempts to modify or delete entries in the hash-chained audit trail.