Airlock: Bounding the Multi-Agent Blast Radius via Selective Online Containment: what it means for business leaders

Airlock traces what each agent has read and, after an alert, blocks only the external actions bad data can reach, stopping faulty actuations in testing while keeping far more healthy work than A2A or LangGraph controls.

1. What the method is

Airlock is a runtime and guardrail for multi-agent systems that contains a fault after an alert fires, stopping only the actions the bad data can still reach. It sits on EdgeCitadel, a tree-structured runtime in which each child agent receives a narrower set of permissions than its parent and every host runs a daemon mediating messages, results and external actions. Airlock adds an append-only provenance graph recording which agent consumed whose output. On an alert it offers two tiers: a default full quarantine that needs no solver and freezes every tainted execution, and an optimized cut that computes the least disruptive set of control switches able to act before each effect's deadline, then enforces it with a protocol called fence-then-prune. The advance is the pairing of authority boundaries with live data lineage, not a better detector; Airlock takes the alert's origin as given.

2. Why the method was developed

Once several agents share memory, workspaces or messages, a faulty output crosses task and host boundaries without any agent exceeding its permissions. Single-agent guardrails cannot see past their own harness. Framework controls act on one agent or on everything: A2A cancels individual tasks, LangGraph interrupts the graph or rolls back and re-executes, and topological safeguards sever a flagged agent's future edges. Stopping the producer misses agents that already read its output; stopping the workflow destroys healthy work. The authors measured the gap in a running smart-home service: at a late alert, 15 of 81 tasks were tainted, seven bad lamp commands had committed and 13 more were preventable, the first arriving 7.6 seconds later. Across their workflow benchmarks, only 1 of 76 preventable effects had been issued when the alert fired, so cancelling queued calls cannot help. Containment must trace forward to work not yet run.

3. Who should care

Platform and ML infrastructure teams are the primary audience: if we run agents that delegate across hosts or share memory, this is a concrete design for how the runtime should mediate them, and it requires routing all agent traffic and external actions through a daemon, so agents hold no broker or device credentials. Security and incident response gain a containment action between cancelling one agent and shutting everything down, plus a record of what each agent read. Product owners of agents that touch customers, payments, devices or production systems should care because it separates effects we must protect from outputs we can tolerate, a classification they would have to make. Procurement and architecture leads can use it as a test for vendors: ask whether the framework records cross-agent data lineage and can stop only downstream consumers. Teams running single-agent assistants have little to gain here.

4. How the method works

Every host daemon checks permissions and journals dispatches, mediated reads and writes, and effect commits in per-site order, streaming them to a central coordinator that builds the provenance graph. Taint spreads only forward in time, along data and shared-session edges; where an invocation does not declare its inputs, all delivered inputs count. For the optimized cut, the controller projects live work and available switches (holds on tasks, egress or events; revocations of grants, admissions or credentials) into a control graph, credits only actions landing before each effect's deadline, using a 400 ms nominal site latency, and solves for minimum collateral cost. The general problem is NP-hard, but nested per-vertex switches reduce to one max-flow call, with exact fallbacks. Fence-then-prune first pushes the initial cut, egress labels and, if timing is tight, a conservative hold, waits until confirmations and journals reconcile, then refines the cut and releases temporary holds. The authors prove no tainted effect commits at checked sinks after that convergence point.

5. How it was evaluated

The authors ran 1,832 testbed runs on three sites across two Linux hosts linked by NATS JetStream, with physical devices driven through Home Assistant. Workloads were a four-room smart-home application with 161 scored runs across six LLM deployments, including local Qwen and Gemma models, three frontier cloud APIs and a mixed tree; a long-running smart-home service of three agents and 81 tasks; and seven workflow benchmarks of seven agents each, with seeded faults and early or late alerts. Controlled grids used deterministic workers against exact ground truth, so those results measure containment, not LLM behaviour. Baselines were native A2A and LangGraph controls through thin adapters, plus a comparison of 11 strategies on EdgeCitadel. A simulator running the same controller code produced 24,266 records. Metrics were runs clean after the alert and healthy work kept without redo. Our copy of the text is truncated before the appendices, so per-cell results were not reviewed.

6. How it performed

Both tiers blocked every post-alert faulty actuation on the main testbed and smart-home grids, and across the 279 main-grid runs reaching convergence, at a median 0.18 seconds, no tainted effect committed afterwards. A2A's cancel-agent was clean in 12 of 42 content-fault runs; framework controls that stayed clean kept at most 16% of work without redo, against a median 100% for the optimized cut. Under saturated spread it kept 100% against full quarantine's 54%. Makespan stayed within 8.5% of A2A's. The limits matter. Effects committed before the alert stand, absorbed memory is not repaired, evasive agents are out of scope, and the optimized cut lets tainted replies continue. The coordinator saturates beyond roughly ten agents: in a 63-agent stress test ingest lag reached 90.8 seconds and only 1 of 22 runs was clean, though no holds were released early. Our call: pilot the design on one bounded workflow with external side effects, without expecting the prototype to carry a large fleet. (Source: arXiv 2611.06727, 2026)