Splitting AI agents into modular components causes them to lose policy-relevant facts at handoffs, sharply increasing compliance failures in simulated KYC/AML tasks — modular pipelines dropped 56–85% of discovered facts on a 32B model versus 0% in a single-loop agent, with much smaller losses for a stronger model.

Main Finding

Decomposing a task-oriented agent into multiple components (pipeline or orchestrator + subagents) materially degrades policy compliance because policy-relevant facts discovered by one component are frequently lost at handoff boundaries. This "fact attenuation" reduces correct escalation/abstention decisions and can produce both under- and over-escalation. The magnitude of the degradation depends on model capability: a 32B open-weight model suffered large attenuation (56–85% at constraint distance 2), while gpt-4.1-mini showed much smaller attenuation (3–6%), with a single-loop baseline (no boundary) attenuating 0% on both models.

Key Points

• New benchmark: Fiducia-bench — 100 KYC/AML task variants with machine-checkable policy packs and deterministic verification (replayable trajectories, environment-owned audit logs).
• Core mechanism: "Fact attenuation" at component handoffs. Summaries used to hand off work often omit policy-critical facts, so the downstream decision-maker never sees them.
• Effect size (fact attenuation, conditional on discovery, at constraint distance 2):
  • Qwen2.5-32B: D0 (single-loop) 0%; D1 (fixed pipeline) 56%; D2 (orchestrator + subagents) 85%.
  • gpt-4.1-mini: D0 0%; D1 3%; D2 6%.
• The same attenuation mechanism causes both under-escalation (risk facts dropped) and over-escalation (exculpatory facts dropped); therefore always-escalate is not a robust mitigation.
• Decomposition can increase discovery but worsen propagation: D2 elicited more trigger facts yet dropped many more of them than D0.
• Introduced metrics that are pure functions of trajectory and task YAML: governed success, propagation loss, fact attenuation, violation locus, authority diffusion—so historical runs can be rescored as verifiers improve.
• Design invariants in Fiducia-bench: environment-owned audit logs/actor attribution and trajectory replay verification (state at each call).
• Limitations noted by authors: uncertain generalizability beyond KYC/AML, unknown behavior at frontier-model scale, scripted environment, prompt confounds.

Data & Methods

• Tasks: 5 seed KYC/AML scenarios (constraint distances 0–2) expanded to 100 deterministic variants by varying persona, jurisdiction, amounts, ownership percentages. Each task includes an oracle (governed success = true) and at least one trap script (governed success = false).
• Policy packs: YAML files with 10 deterministic, machine-checkable rules (require before, allow list, state assert, forbid when).
• Environment & tooling: JSON store with deterministic tools; every tool call is auto-logged (tool name, args, result digest); environment stamps actor attribution (Invariant: environment owns the audit log).
• Architecture arms (independent variable):
  • D0: single ReAct loop, no boundaries (context fully available).
  • D1: fixed 3-stage pipeline (intake → research → decide), handoff summaries only (2 boundaries).
  • D2: orchestrator + scoped subagents (strict context isolation, tool scoping; reported boundaries 2/round-trip).
• Models and runs:
  • Qwen2.5-32B-Instruct (local, 300 episodes).
  • gpt-4.1-mini (API, 296 episodes).
  • Grid: arms × policy access modes × 100 task variants per model; total reported episodes ~626.
  • Step budget per episode: 25.
  • Policy access modes: P0 (full policy in context) and P1 (retrieval on demand). No systematic effect from access mode—decomposition, not policy access, drives attenuation.
• Metrics: all are pure functions of (trajectory, task YAML); verification replays the trajectory against a fresh environment copy so state is evaluated as it was at each tool call.

Implications for AI Economics

• Compliance externalities of architectural choices: Firms adopting modular, orchestrator-driven agent architectures gain software engineering benefits (modularity, tool scoping, specialization) but incur measurable governance costs (higher probability of policy violations). Those costs are non-negligible with current mid-sized models.
• Trade-offs and cost modeling:
  • Direct expected cost increase: higher likelihood of violations raises expected fines, remediation costs, and reputational losses. Quantifying fact attenuation lets economists model expected noncompliance costs conditional on architecture and model capability.
  • Monitoring and verification costs: deterministic, environment-owned audit logs and replayable verification reduce audit friction but impose engineering overhead. Firms must weigh these infrastructure costs against risk reductions from centralized single-loop designs or stronger models.
  • Investments vs. returns: stronger models reduce attenuation (e.g., gpt-4.1-mini vs. Qwen32B). Economic decisions about upgrading model capacity should account for expected reduction in governance failures per dollar of model/compute vs. process solutions (structured handoffs, mandatory fields in summaries).
• Labor and process effects: Decomposed architectures may necessitate additional process controls—structured handoff protocols, mandatory summary fields, or human-in-the-loop checkpoints—raising operating costs and changing role designs (more auditors, fewer generalist agents).
• Market and regulatory implications:
  • Demand for verification tooling and standardized, machine-readable policy packs likely to grow. Fiducia-bench-style artifacts provide a template for compliance-as-a-product.
  • Regulators may favor requirements that mirror Fiducia-bench invariants (environment-controlled logs, replayable audits, machine-checkable policy), increasing compliance costs but lowering enforcement uncertainty.
  • Liability assignment complexity increases: violations may arise from information loss at boundaries, not a single component's erroneous action; legal frameworks and contracts will need to account for authority diffusion.
• Dynamic effects and uncertainty:
  • The governance cost is capability-dependent. As models improve, attenuation may fall, altering the cost-benefit calculus of architecture choices. But the single-loop baseline remains the lower bound (zero boundary attenuation).
  • Generalization risk: results are from KYC/AML tasks; empirical parameters (attenuation rates) for other regulatory domains (healthcare, safety-critical systems) are unknown—economic models should include uncertainty and scenario analysis.
• Practical recommendations for economic decision-making:
  • Explicitly include "fact attenuation risk" in TCO and compliance risk models when evaluating agent architectures.
  • Compare marginal cost of stronger models vs. engineering/process fixes (structured handoffs, mandatory checks) in reducing expected violation costs.
  • Invest in standardized machine-checkable policy packs and environment-level auditability to make compliance measurable and insurable.
  • Consider regulatory and insurance implications: architectures that make violations non-attributable or diffuse may raise premiums or invite stricter oversight.

Summary nutshell: decomposition raises measurable governance costs by leaking policy-relevant facts at handoffs. These costs are quantifiable and model-dependent, so economic planning for enterprise agents should internalize them when choosing architectures, budgeting for model upgrades, and designing compliance and audit infrastructures.