Multi-agent systems fail operationally when every agent can call every tool with the same secrets. Constraint is the product. With Mistral Large 4, give each agent a narrow job, a typed message schema, and a permission set enforced in code. A supervisor decides routing and termination. Agents propose; privileged executors act.
Roles Before Models
Define jobs as contracts
Name roles by output, not by personality. Examples: classifier, retriever, planner, critic, executor. Each role has an input schema, an output schema, and a maximum number of turns. If you cannot write the contract, you are not ready to add another agent process.
One model family, many policies
Multiple roles may call Mistral Large 4 with different prompts and tool allowlists. Shared weights do not imply shared authority. Policy attaches to the role id in your orchestrator, not to the provider model string alone.
Supervisor responsibility
The supervisor validates inter-agent messages, enforces budgets, and chooses the next role. It is deterministic code. Avoid a free-form “manager agent” with universal tools; that recreates a single omniscient agent with extra latency.
Human boundary
Some states require human approval: spending above a threshold, external communications, or production deploys. Model confidence language is not approval. Represent waiting-for-human as an explicit state with timeouts and escalation.
Permission Boundaries
Tool allowlists per role
Each role receives a set of tool names. The executor rejects anything outside the set even if the model emits it. Adding a tool is a code change with review, not a prompt edit. Log denials with role id to detect systematic attempts to escape scope.
Data scope
Scope retrieval to tenant, project, or document collection. Pass scope tokens from the authenticated user request, not from model output. Agents must not broaden scope by quoting user instructions that say “ignore previous restrictions.”
Credential isolation
Executors hold credentials. Agent planners hold none. If a role only classifies text, it should not load cloud keys into its process. Split processes when high-privilege tools exist beside low-privilege language roles.
Permission matrix
Role | Tools allowed | Data scope | Writes |
|---|---|---|---|
Classifier | none | Current ticket text | No |
Retriever | search, fetch | Tenant-scoped index | No |
Planner | none | Snapshot fields only | No |
Executor | approve-listed mutations | Same tenant | Yes, after checks |
Critic | none | Plan plus diffs | No |
Message Passing and Schemas
Typed envelopes
Inter-agent messages use versioned schemas: role, correlation id, payload, and budget remaining. Reject malformed envelopes before the next model call. Free-form chat transcripts are a debugging view, not the control plane.
Least data in flight
Pass references and ids where possible. Dumping entire corpora into every hop multiplies cost and leakage risk. Retrievers return ranked hits; planners see summaries plus ids; executors load full rows only when acting.
Validation on every hop
Each received message is schema-checked. Do not trust the previous agent’s “valid JSON” claim. A valid response is not necessarily a correct response, and correctness still needs role-specific semantic checks.
Idempotent handoffs
Supervisor transitions record durable state. Replaying a message must not spawn duplicate executors. Use job keys and state machines rather than pure in-memory conversations that vanish on process restart.
Budgets, Loops, and Termination
Step and token budgets
Assign global and per-role limits. When a budget exhausts, transition to failed or human-review with a structured reason. Silent budget overruns are how overnight agent jobs create surprise invoices.
Loop detection
Track repeated tool signatures and repeated plan hashes. Identical failures beyond a threshold force stop. Models that rephrase the same failing call are still looping. Counters in the supervisor beat prompt instructions that say “do not repeat.”
Termination states
Success, failed, rejected, and needs-human should be exhaustive. “Still thinking” is not a terminal state for APIs that must respond. Asynchronous products expose status; synchronous APIs must deadline.
Comparison of stop conditions
Condition | Detected by | Next state |
|---|---|---|
Schema invalid message | Validator | Failed |
Tool not allowlisted | Executor | Failed or critic |
Budget exhausted | Supervisor | Failed or needs-human |
Repeated identical tool failure | Loop detector | Failed |
Business rule fail | Executor | Rejected |
All required steps done | Supervisor | Success |
Failure Boundaries in Multi-Agent Designs
Partial tool calls
Agents may emit incomplete argument objects. Executors validate and deny. Never fill missing critical arguments with defaults that spend money or delete data. Prefer failure over inventing an amount or destination.
Cross-agent prompt injection
Content retrieved by one agent can instruct another to ignore policy. Keep untrusted text inside data fields and apply allowlists in code. Critics should evaluate structured plans, not obey instructions embedded in documents under review.
Privilege escalation attempts
A low-privilege agent may request the supervisor to “temporarily” grant admin tools. Hard-code grant rules. Dynamic escalation without human approval is an anti-pattern in production agent graphs.
Cascading retries
If each agent retries provider errors independently, load multiplies. Centralize transport retries at the client layer and let the supervisor apply a single job-level budget. Stacked retries without coordination create rate-limit storms.
Testing and Rollout
Contract fixtures per role
For each role, store legal and illegal outputs. Assert denials for extra tools and out-of-scope ids. Run these fixtures in CI on every orchestrator change. Role proliferation without fixtures is how permissions rot.
End-to-end adversarial scripts
Simulate users who paste “ignore previous instructions” into tickets and documents that contain tool-call bait. The system should stay inside allowlists. Record traces for postmortems without writing secrets to logs.
Progressive enablement
Enable read-only roles first. Add mutating executors last, behind feature flags and lower rate limits. Measure denial rates and human escalations before widening scope. Fancy graphs with all tools live on day one are demos, not launches.
Operational readiness
Dashboards need per-role latency, token use, denial counts, and loop stops. On-call must know which role owns a spike. Without role labels on spans, multi-agent systems become opaque relative to a single call.
Production Verdict
Design rule
Agents are roles with contracts, not autonomous employees. Mistral Large 4 can power several roles, but permission boundaries live in the supervisor and executors. Shared credentials across roles are a production incident waiting on a single injected document.
Checklist
Role contracts documented. Tool allowlists in code. Data scope from auth context. Typed envelopes. Budgets and loop detectors. Human states for high risk. Fixtures for denials. Metrics labeled by role. No dynamic privilege grants without policy.
When to avoid multi-agent
If one validated planner plus deterministic handlers solves the job, skip extra agents. More roles mean more failure modes. Add agents only when a measured bottleneck needs specialization, not because a diagram looks sophisticated.
Boundary
Permission is never inferred from model wording. Permission is computed from role, allowlist, and authenticated scope. The model proposes the next message. The application decides whether anything happens in the world.
