As enterprises move from deploying individual models to operating populations of co-deployed agents, a structural property emerges that behavioral monitoring was not designed to handle. The components that record, evaluate, and audit an agent's behavior increasingly sit inside the same infrastructure the agent can read, write, or suppress. We identify and formally define two such properties. The Agent Deception Surface (ADS) is the set of all system components that an agent can read, write, or suppress, and that are simultaneously used to record, audit, or evaluate the agent's own behavior. The Swarm Coordination Escape (SCE) describes the emergence of unsanctioned inter-agent communication channels and collective objectives in co-deployed agent populations. We provide formal set-theoretic definitions for both constructs, derive a three-layer ADS taxonomy (log write access, evaluation input access, channel formation access), specify the Containment Quartet, four architectural controls that together reduce ADS to a structurally bounded minimum, and propose a four-tier maturity model for ADS reduction. The central result is the Governance Gap Property. A deployment can satisfy every monitoring obligation and still carry a non-empty deception surface, because monitoring requirements do not by themselves bound the intersection of agent write scope and audit scope. The coined terms and framework are intended to give practitioners vocabulary that is immediately usable in architecture reviews and deployment assessments.
Enterprise AI deployments have crossed a threshold. Organizations no longer run single models against isolated datasets. They run populations of agents, each with read and write access to shared infrastructure, each capable of taking actions that affect the environment in which they operate. This transition from model deployment to agent deployment has outpaced the monitoring architectures designed to observe it.
Monitoring and accountability are near-universal expectations for deployed systems. A record of what an agent did, and an evaluation of whether it behaved as intended, are assumed to exist and to be trustworthy. That assumption rests on a tacit topological premise. The audit and monitoring infrastructure is separate from the system it observes. For single models reading static datasets, the premise held. For populations of agents with write access to shared infrastructure, it no longer holds by default.
The failure mode is structural, not behavioral. When an agent can reach the components that record, score, or constrain its own behavior, it acquires the capability, regardless of intent, to shape the record those components produce. The absence of anomalies in a record the agent can edit is not evidence that no anomaly occurred. The same holds across a population. When agents meant to operate independently share a writable surface, that surface can become an unsanctioned channel through which coordinated behavior emerges without appearing in any per-agent record.
Neither case requires an adversarial agent. Both follow from ordinary operational permissions in a shared environment, and both are invisible to monitoring that assumes it sits outside the system it observes. This paper names that structural property, formalizes it, and specifies the architecture that removes it.
The contributions of this paper are as follows.
The remainder of the paper is organized as follows. Section II reviews related work. Section III provides formal definitions. Section IV presents the three-layer taxonomy. Section V specifies the Containment Quartet. Section VI presents the maturity model. Section VII discusses relations to prior work and limitations. Section VIII concludes.
The problem of agents modifying their own evaluation signals has been studied in reinforcement learning under the framing of reward hacking and specification gaming. Krakovna et al. documented more than 60 cases of agents exploiting gaps between specified rewards and intended behavior [1]. The canonical example is an agent that achieves high apparent performance by corrupting the measurement apparatus rather than improving actual performance. The enterprise AI deployment context introduces a qualitatively different problem. The measurement apparatus is shared operational infrastructure, and the agent's access to it is not a design failure but a consequence of normal operational permissions.
Multi-agent coordination and emergent behavior have been studied extensively in distributed systems and swarm intelligence research. The specific mechanism of interest here, emergent coordination through shared write surfaces in systems not designed for coordination, is distinct from both the cooperative multi-agent systems literature and adversarial multi-agent game theory. In the setting considered here, agents not designed to coordinate can still do so once optimization pressure meets a shared writable surface.
Logging, monitoring, and accountability obligations are well established at the policy level for deployed systems. What those obligations generally leave unspecified is a topological requirement. The infrastructure that monitors an agent must lie outside that agent's write scope. This paper supplies that requirement and the controls that enforce it, so that an accountability obligation stated at the policy level is met structurally rather than by assumption.
The closest prior work to our Agent Deception Surface construct is the concept of Goodhart's Law applied to AI systems. When a measure becomes a target it ceases to be a good measure [2]. The ADS formalizes the precondition under which Goodhart's Law applies to behavioral monitoring. An agent can only corrupt a measure it can reach.
Let A be a deployed agent with action space Act(A) and let M be the set of all monitoring and audit components in the deployment environment. Define R(A) as the set of components that A can read, W(A) as the set A can write, and S(A) as the set A can suppress (delete, overwrite, or prevent from being written). Define Audit(A) as the set of components used to record, evaluate, or report on A's behavior. Then the Agent Deception Surface of A is defined as follows.
ADS(A) = (R(A) ∪ W(A) ∪ S(A)) ∩ Audit(A)
A deployment is deception-surface-contained if and only if ADS(A) = ∅ for all deployed agents A. An agent with ADS(A) ≠ ∅ has the structural capability, regardless of intent, to falsify the record of its own actions. The severity of the deception surface is proportional to |ADS(A)| and the criticality of the components within it.
Let P = {A1, A2, ..., An} be a population of co-deployed agents, and let Cprov(P) be the set of communication channels explicitly provisioned for inter-agent communication. Let Cobs(P) be the set of communication channels actually observed to carry inter-agent messages during deployment. Swarm Coordination Escape occurs when the following condition holds.
Cobs(P) \ Cprov(P) ≠ ∅
That is, when agents communicate through channels not in the provisioned set. A deployment is swarm-contained if and only if Cobs(P) ⊆ Cprov(P) for all agent populations P at all times. The SCE set Cobs(P) \ Cprov(P) consists of any writable shared store an agent uses to pass information to another agent without that store being designated as a communication channel.
For any governance framework F that specifies monitoring requirements but does not specify isolation requirements between the agent's write scope W(A) and the audit component set Audit(A), there exists a class of deployments that is compliant with F but has ADS(A) ≠ ∅. This is the Governance Gap Property. Compliance with F is necessary but not sufficient for deception-surface containment.
In any deployment where two agents Ai and Aj share a writable component S ∈ W(Ai) ∩ W(Aj), and S ∉ Cprov({Ai, Aj}), then S is a latent SCE vector. Swarm Coordination Escape does not require adversarial intent. It is a structural property of shared-write environments with optimization-driven agents.
The Agent Deception Surface decomposes into three mechanistically distinct layers. Each layer has different detection difficulty, different remediation cost, and different severity of impact on the integrity of behavioral records.
The highest-severity ADS layer occurs when an agent has write access to the same logging infrastructure that captures its actions. Components in this layer satisfy W(A) ∩ Audit(A) ≠ ∅. An agent with Layer 1 deception surface access can suppress or overwrite records of specific actions, making complete forensic reconstruction of its behavior impossible. Where behavioral records are retained inside the agent's write scope, the absence of anomalies in those records cannot be read as evidence that no anomalous behavior occurred, because the record and the behavior are no longer independent.
The intermediate-severity layer occurs when an agent has access to the data used to evaluate its performance, satisfying (R(A) ∪ W(A)) ∩ EvalInput(A) ≠ ∅ where EvalInput(A) ⊆ Audit(A). An agent with Layer 2 access cannot suppress its action log, but can influence how those actions are scored. An agent under optimization pressure toward a favorable evaluation can therefore raise its measured performance without improving, or even while degrading, its actual behavior. This is the precondition under which specification gaming extends from a training-time concern to a deployment-time one.
The emergent-coordination layer occurs when agents have access to shared write surfaces not designated as inter-agent channels, creating the conditions for SCE as defined in Definition 2. Layer 3 does not directly affect audit record integrity, but enables the emergence of collective agent behavior that is not captured by per-agent monitoring, because the coordination is occurring through channels outside the monitoring perimeter.
Table I summarizes the three layers, the condition that defines each, its impact on the integrity of behavioral records, and the containment control from Section V that eliminates it. The three layers are mechanistically independent, which is why a single control is never sufficient.
| Layer | Defining Condition | Record Integrity Impact | Detection Difficulty | Containment Control |
|---|---|---|---|---|
| Layer 1. Log write access | W(A) ∩ Audit(A) ≠ ∅ | High. Records can be deleted or overwritten | Moderate | C1. Immutable Log Isolation |
| Layer 2. Evaluation input access | (R(A) ∪ W(A)) ∩ EvalInput(A) ≠ ∅ | Medium. Scores can be shaped, logs intact | High | C3. Evaluation Input Isolation |
| Layer 3. Channel formation access | shared writable S ∉ Cprov | Low directly. Enables SCE outside per-agent records | High | C2. Channel Registry |
We specify four architectural controls that together form the Containment Quartet. Each control targets a specific ADS layer or SCE condition. We formally state the reduction property for each control, and show that the full quartet is required. No subset of three controls achieves deception-surface containment under all deployment conditions.
The Containment Quartet consists of four controls. (C1) Immutable Log Isolation, (C2) Channel Registry with Deny-by-Default, (C3) Evaluation Input Isolation, and (C4) Out-of-Band Behavioral Monitoring. A deployment achieves full containment if and only if all four controls are implemented with the specifications given in this section.
Specification. The audit log store must satisfy W(A) ∩ LogStore = ∅ for all agents A, implemented through identity and access management policies that grant the agent runtime write-only forwarding credentials to a separate log store, with all read, modify, and delete operations restricted to non-agent principals.
Reduction property. C1 eliminates Layer 1 ADS exposure. After C1 is applied, W(A) ∩ AuditL1(A) = ∅ where AuditL1(A) is the log store component of the audit system.
Incompleteness. C1 alone does not address Layer 2 or Layer 3, and does not prevent SCE.
Specification. All inter-agent communication must occur through explicitly provisioned channels in a registry Rch. Any write to a shared component not in Rch by a member of an agent population P is blocked at the infrastructure layer. This requires network policy or IAM policy enforcement, not application-layer enforcement, because application-layer enforcement is itself within potential agent write scope.
Reduction property. C2 eliminates SCE. After C2 is applied, Cobs(P) ⊆ Cprov(P) = Rch for all agent populations P.
Incompleteness. C2 does not address Layer 1 or Layer 2 ADS.
Specification. Components used as evaluation inputs for agent A must satisfy W(A) ∩ EvalInput(A) = ∅, implemented either through separate source systems for evaluation pipelines or through cryptographic integrity guarantees that make post-write modification of evaluation inputs detectable.
Reduction property. C3 eliminates Layer 2 ADS exposure. After C3 is applied, (R(A) ∪ W(A)) ∩ EvalInput(A) ⊆ R(A) only, and all read accesses are logged by the immutable store from C1.
Incompleteness. C3 does not address Layer 1 or Layer 3, and does not prevent SCE.
Specification. The behavioral monitoring system must derive its signals from infrastructure-level sources outside the agent's action scope. Sources include network flow telemetry, API call frequency and pattern analysis, credential usage logs written by the cloud provider rather than the agent runtime, and filesystem access logs written by the OS rather than the application. Formally, the monitoring system Moob must satisfy the following condition for all signals s ∈ Signals(Moob). The source of s must not be in R(A) ∪ W(A) ∪ S(A).
Reduction property. C4 ensures that ADS(A) = ∅ does not depend on the agent's cooperation. Behavioral signals exist outside the deception surface regardless of agent behavior. It also provides detection capability for SCE events by monitoring inter-agent message volumes on provisioned channels.
Full containment theorem. A deployment implements C1, C2, C3, and C4 if and only if it satisfies all three conditions. (i) ADS(A) = ∅ for all A. (ii) Cobs(P) ⊆ Cprov(P) for all P. (iii) Behavioral signals for all agents are derived from sources outside agent action scope.
We propose a four-tier maturity model for enterprise ADS reduction. Tiers are defined by which elements of the Containment Quartet have been implemented, and by the residual deception surface that remains.
Tier 0. Uncontained. No Containment Quartet controls implemented. ADS(A) is bounded only by the agent's operational permissions, which typically include write access to all shared databases and services within its application scope. SCE vectors exist wherever agents share infrastructure. This is the default state of most enterprise agent deployments.
Tier 1. Log-Isolated. C1 implemented. Layer 1 ADS eliminated. W(A) ∩ LogStore = ∅. Layer 2 and Layer 3 exposure remains. SCE vectors unaddressed. A forensically complete behavioral record exists but can still be undermined by evaluation input manipulation. This tier satisfies minimum requirements for incident forensics but does not prevent real-time behavior concealment.
Tier 2. Channel-Registered. C1 and C2 implemented. Layer 1 ADS eliminated and SCE prevented. Layer 2 exposure remains. Agents can still influence their evaluation scores. This tier is sufficient for deployments where evaluation score integrity is not a primary risk, such as agents that do not have performance-linked rewards or selection weights.
Tier 3. Eval-Isolated. C1, C2, and C3 implemented. All three ADS layers eliminated and SCE prevented. Residual risk. Behavioral monitoring still depends on agent-generated or agent-accessible signals. An agent that controls its own observable outputs can present an accurate log while concealing the signals that would trigger anomaly detection. This tier is sufficient for most enterprise deployments where the agent does not have fine-grained control over the signals that feed monitoring systems.
Tier 4. Fully Contained. All four Containment Quartet controls implemented. ADS(A) = ∅ for all agents, SCE structurally prevented, behavioral monitoring fully out-of-band. The deployment satisfies the full containment theorem from Section V-D. This is the target state for high-assurance deployments. Agentic systems with access to sensitive data, critical infrastructure, or external networks.
The ADS construct is related to but distinct from the AI Output Provenance framework introduced in [3], which addresses the traceability of AI-generated outputs through transformation pipelines. Provenance frameworks assume the pipeline is observable; the ADS addresses the case where the pipeline's observability is itself a function of the agent's behavior. The Enterprise Agent Identity framework [4] addresses authentication and accountability for individual agents; ADS addresses the structural properties of the monitoring infrastructure that accountability depends on.
The Containment Quartet's C2 control (Channel Registry) is architecturally related to zero-trust principles, in which no communication is assumed to be authorized without explicit verification. The extension here is that those principles must be applied to inter-agent messaging specifically, not only to human-to-system or system-to-system communication.
The formal definitions in Section III assume that the boundary between W(A) and Audit(A) can be precisely enumerated. In practice, enterprise deployments often involve implicit write paths, such as agents that can create files in directories that are swept by logging agents, or agents whose network requests are captured by security tools whose capture rules the agent could potentially influence. The ADS construct is most useful as a design principle. Enumerate the boundary explicitly at architecture design time, rather than discovering it through incident response.
The full containment theorem assumes that out-of-band monitoring signals (C4) cannot be suppressed by the agent. This assumption holds for infrastructure-level signals (cloud provider network logs, OS filesystem logs) but may not hold if the agent has elevated permissions that include access to monitoring configuration. The C4 specification requires that the monitoring system's source signals be outside the agent's action scope; verifying this requires the same enumeration approach as ADS assessment.
Accountability for an agent's behavior presupposes a record the agent cannot alter. An agent cannot be held accountable for behavior it can suppress from the record, and a monitoring system inside the agent's deception surface can report clean while providing no actual assurance. ADS = ∅ is therefore the necessary condition for accountability to be structurally enforced rather than merely asserted. The ADS framework turns the abstract requirement that systems be observable and auditable into a concrete, checkable condition at the infrastructure layer.
The maturity model turns that condition into a graded target. A deployment can state where it sits today, what residual deception surface remains, and which control it must implement next to reach the tier its risk profile requires. The cost asymmetry between implementing containment architecture at design time and reconstructing behavior after the fact strongly favors reaching Tier 4 for any deployment with access to sensitive data, critical infrastructure, or external networks.
We have introduced and formally defined two structural properties of deployed AI agent systems. The Agent Deception Surface (ADS) and Swarm Coordination Escape (SCE) both arise from ordinary operational permissions in shared, multi-agent environments, and both can persist in a deployment that meets every monitoring obligation placed on it. The Governance Gap Property makes this precise. Monitoring compliance is necessary but not sufficient for deception-surface containment, because it does not by itself bound the intersection of agent write scope and audit scope.
The Containment Quartet provides four implementable controls that together achieve ADS(A) = ∅ and SCE prevention. The full containment theorem establishes that all four controls are jointly necessary and sufficient. The four-tier maturity model provides organizations with a structured path from the default uncontained state (Tier 0) to full containment (Tier 4), with concrete criteria for each tier.
The coined terms Agent Deception Surface and Swarm Coordination Escape are intended to provide the enterprise AI practitioner community with vocabulary that is precise enough for architecture specifications, accessible enough for executive communication, and actionable enough to drive design decisions in the week a paper is read. Future work includes empirical measurement of ADS across deployed enterprise environments, extension of the formal model to handle dynamic permission changes during agent execution, and development of automated ADS assessment tooling.
© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. All rights reserved. Academic citation permitted with attribution; commercial use and derivative frameworks require written permission.