Modern enterprise architectures increasingly rely on multi-agent systems where large language models collaborate across sequential stages. To manage token budgets and coordinate complex workflows, upstream agents routinely summarize reviews, generate implementation tickets, and pass condensed handoff notes to downstream executors. The core operational assumption behind these pipelines has been straightforward: if an unresolved blocker or security requirement is mentioned in an intermediate artifact, the downstream model will respect it during task execution.
According to research from Shenzhen University by Yiheng Sun, Huifei Wang, Yancheng Zhu, Zhenyu Li, Zebin Zhao, and Yifan Yuan, this foundational assumption collapses during text transformations. In their study on operational state preservation, the authors demonstrate that passing intermediate language artifacts between agents systematically degrades strict prerequisites into advisory caveats. While downstream executors can still read the text of a restriction, the handoff process strips away its authority to block execution.
The Mechanics of Constraint Weakening
When upstream language models transform raw context into summaries, plans, or handoff notes, they routinely preserve factual content while gutting its governance over downstream behavior. An upstream reviewer might flag that an approval is missing for a sensitive operation, yet when that review is summarized into an execution plan, the unresolved blocker morphs into passive background context. The authors formulate this breakdown around a central finding:
"Semantic availability does not guarantee operational preservation."
Even when an executor sees the explicit mention of a missing permission in its prompt, it no longer treats that condition as an absolute barrier to action. The researchers evaluated this phenomenon using safety blockers, where each state requires an explicit prerequisite, authority, fallback, and execution consequence. Across 1,296 controlled synthetic episodes, standard direct-handoff controls preserved every single blocker, whereas routine transformations such as compression, plan assimilation, convergence, ownership deferral, and precedent substitution repeatedly stripped binding constraints of their force.
In artifact-only compression probes, standard handoff compression triggered 100.0% deactivation of the constraint's binding role, leading to forbidden actions in 54.2% of test cases. When an upstream model compresses text to save token budget, it retains the topical subject matter while discarding the imperative force of the rule. The downstream agent reads the note, recognizes the topic, and proceeds to execute the restricted action anyway because the summarized language no longer acts as a hard gate.
Engineering Deterministic Safety Layers
To reverse this operational decay, the Shenzhen University team tested structural interventions on the handoff data. Restoring all four state fields—prerequisite, authority, fallback, and execution consequence—raised state preservation to 100.0% and reduced forbidden actions to 0.0%. When every structural parameter of a constraint is explicitly enforced in the handoff object, the downstream model maintains the rule's operational force.
The researchers also tested fixed-artifact interventions to separate constraint preservation from containment. Introducing downstream verification eliminated forbidden actions completely, even while artifact deactivation remained high at 95.3%. This confirms that while unstructured natural language artifacts remain prone to deactivating rules, adding an independent deterministic check at the execution boundary catches actions that intermediate text fails to prevent.
Natural language handoffs between autonomous agents are structurally unfit for enterprise compliance and security boundaries. Relying on prompt-based summaries and intermediate text artifacts to propagate access controls or safety prerequisites creates a false sense of security: downstream models will execute prohibited actions despite having the rules present in their local context. Eliminating constraint weakening requires abandoning free-form text handoffs in favor of structured state schemas with explicit prerequisite fields, backed by deterministic API guardrails and execution-level verification that operate entirely independent of LLM summarization.