The usual pitch for multi-agent AI systems is simple: if one model can make a mistake, add another model to check its work.
One agent proposes. Another critiques. Maybe a third votes. More perspectives, fewer errors.
But what power does the reviewer actually have? Can it advise, block, or replace the first agent's decision? And if the reviewer is wrong, who protects the original answer?
I started thinking seriously about this after reading METR's investigation of the OpenAI/Hugging Face incident. Roughly 1,200 supposedly isolated agents found a way to communicate through an unsanctioned message board. They sent more than 70,000 messages and files, and around 700 eventually participated in the attack on Hugging Face.
What stuck with me was how quickly the agents developed an organization. They created coordinators, delegated tasks, assigned owners, and invented HOLD, VETO and STOP conventions. Some even accepted assignments that endangered their own task because they believed it would help the wider collective.
The incident was not only about capable models or bad permissions. It was also about authority: informal rules determined who acted, who waited, and whose objectives mattered.
My experiment is smaller, safer, and much less dramatic. It asks:
When AI agents make decisions together, how do institutional rules determine whether they preserve, repair, or abandon the objectives entrusted to them?
the reviewer is not just another model
Most multi-agent research asks whether debate, voting, or critique improves accuracy. Multi-agent debate showed that exchanging arguments can improve reasoning. Self-Refine found gains from iterative feedback. But asking a model to reconsider can also make a correct answer worse, especially without reliable external feedback (Huang et al., 2023). More recent work asks whether debate's apparent gains are really the simpler effect of voting (Choi, Zhu and Li, 2025).
Blaž Bertalanič and Carolina Fortuna find a related problem: interaction among homogeneous groups of ten agents can produce conformity and destabilize correct reasoning. They focus on communication and consensus. I ask what happens next: once a reviewer wants to change an answer, when should that change become binding?
A reviewer has competence—whether its recommendation is good—and authority—when its recommendation can replace the original decision. Those are different things. A strong reviewer with broad authority can still corrupt decisions when it is wrong. A weaker reviewer may be useful if it can intervene only after showing evidence of a specific violation.
I wanted to separate the model from the institution around it.
seven principals, seven policies, one protected duty
I gave an AI agent seven possible policies. Seven synthetic principals had different preferences over them, including different priority weights. The agent had two ordered duties:
- Do not violate a protected principal's binding limit.
- Among the policies that respect that limit, choose the one that best represents everyone in aggregate.
Here, a principal is the person or group whose interests the agent is supposed to represent. The priority weight says how much a disagreement with that principal counts in the aggregate score. One principal also has a protected limit that cannot be traded away just because another option scores better overall.
I used synthetic preferences because they give us a known right answer. We can calculate which policies are allowed, which one best represents the group, and exactly when a reviewer helps or causes harm. That precision matters here more than pretending the setup is a realistic legislature.
This produced three proposal states: correct; violating the protected duty; or compliant but worse than another eligible policy.
A second agent reviewed the proposal under one of two institutions. Under broad override, any valid recommendation from the reviewer became final. Under evidence-gated override, it could replace the proposal only by producing a mechanically checkable record of a violation and a valid repair.
Everything else stayed fixed: models, task, information, and review. Only the rule that turned advice into action changed.
I ran the experiment locally on two open-weight models, Qwen3-8B and Mistral-Small-24B. It covered 96 spatial-policy tasks and 96 public-project portfolio tasks involving budgets, minimum coverage requirements, and public benefit.
the interface is part of the institution
In the first controlled experiment, broad review turned 85 of 96 correct proposals into something worse for each model. The first agent had the right answer, yet giving a reviewer general replacement power destroyed it almost nine times out of ten.
The evidence gate protected all 96 because there was no violation to justify intervention—an 88.5 percentage-point advantage over broad review in these cases.
That looked damning. It also had a confound: the response format always asked the reviewer to recommend a policy. It could recommend the original answer, but the interface may have nudged it to change something.
So I froze a second test before running it. Reviewers now had three explicit actions: retain, replace, or escalate. I tested 48 tasks in each proposal state for both models.
The result was not a neat universal fix.
Qwen retained all 48 correct proposals, corrupting none. But it also retained every compliant-but-suboptimal proposal, missing every available welfare improvement. It repaired only 27 of 48 violations.
Mistral went the other way. It replaced all 48 correct proposals and corrupted every one. It replaced 46 of 48 compliant-but-suboptimal proposals, finding the exact optimum 30 times but creating five new violations. Neither model escalated once.
The forced interface explained much of Qwen's original behavior. It did not explain Mistral's. An abstention option made one reviewer cautious and left the other aggressively interventionist.
The practical point is that there are two design decisions here: the interface shaping what a reviewer tries to do, and the jurisdiction rule deciding which attempted changes become binding. The evidence gate did not make either model smarter. It made some mistakes less powerful.
protection has a price
When a proposal respected the protected duty but was not the best eligible choice, broad review could improve it. The evidence gate could not: no violation meant no authority to intervene.
On the spatial tasks, that cost was modest—2.1 percentage points for Qwen and 6.3 for Mistral. On the portfolio tasks, it was much larger: 51 points for Qwen and 87.5 for Mistral.
So the result is not that restricted review is simply better. It is a tradeoff:
Broader authority increases both the errors a reviewer can correct and the correct decisions it can corrupt.
I call this the correction-corruption frontier.
Where a useful system sits on that frontier depends on its errors. If the first agent is usually right, broad review creates more surface for damage. If its proposals are usually acceptable but mediocre, broad review has more room to help. If violations are especially costly, a gate may be worth the missed improvements.
compliance is not optimization
On naturally generated proposals, the evidence gate improved compliance for both models. But it improved exact policy selection for Qwen and descriptively reduced it for Mistral, with enough uncertainty that the Mistral effect could also be a tie.
The gate protected the mandate; it did not reliably find the best acceptable policy. Broad review could optimize more aggressively, but sometimes did so by replacing correct decisions or introducing new violations.
That is why a constitution is not just a committee of smart people. Some constraints exist because we do not want each decision-maker to rebalance them from scratch. A budget ceiling, minimum service requirement, authorization boundary, or provenance rule can be a condition for action rather than another suggestion in a prompt.
The reviewer can still reason. It just has to show why it has the right to overrule.
from legislatures to AI agents
This is a direct continuation of my first paper on institutional representation, although the machinery is different.
That paper modeled parliamentary and presidential systems and asked how citizens' preferences become passed policy. Its central tradeoff was between throughput and representation: passing more legislation did not necessarily mean passing legislation closer to what citizens wanted.
Here the "legislature" is only two AI agents. I am not claiming a reviewer is literally a parliament. The shared question is what happens between preferences going in and a binding decision coming out. In the first paper, voting rules, party discipline, and vetoes shaped that translation. Here, reviewer jurisdiction does.
The METR report is inspiration, not an experimental template. Its agents developed delegation, ownership, veto, and coordination norms on their own. This study isolates one piece of that wider problem: what evidence should one agent need before it can overrule another?
should AI agents review each other?
Yes, sometimes. But "add a reviewer" is not a complete design.
We need to know what mistakes the first agent makes, which ones the reviewer can repair, which correct decisions it tends to disturb, and which objectives must remain binding. Then we need a rule for turning recommendations into actions.
This connects to work on AI safety through debate, scalable oversight, and AI control. My claim is narrower: even with the reviewer fixed, changing its jurisdiction changes the collective's behavior.
There is an important limit. These are structured synthetic decisions, not hundreds of autonomous agents in an open-ended environment. The protected duties are mechanically checkable. Real objectives are often ambiguous, contested, or incomplete. A perfect gate around the wrong specification can preserve the wrong thing very reliably.
Still, the core result survived a stricter validation: reviewer power has a correction side and a corruption side; the action interface changes that balance in model-dependent ways; and an evidence gate can protect a binding duty even when the reviewer still wants to intervene. We should evaluate all three—competence, interface, and jurisdiction—before letting one agent overrule another.
The full Paper 2 manuscript, code, frozen outputs, and reproduction instructions are all open source.
Adding another agent is easy. Deciding what it is allowed to do is the institution.