Fortifying Multi-Agent Systems: Zero-Trust Scope Attenuation & Cryptographic HMAC Provenance

A developer has built the Fortified Enterprise Agent Fleet, a zero-trust governance control plane for multi-agent systems that enforces dynamic scope attenuation and cryptographic HMAC provenance. The system, powered by Gemini 3.5 Flash, Google ADK, and Google Cloud Run, prevents implicit privilege escalation by ensuring delegated scopes only narrow and by cryptographically signing every delegation hop for non-repudiation.

I wrote this post for the purposes of entering Google's All Things Agentic Hackathon Track: Fortified Enterprise Fleet . Autonomous AI agents are rapidly evolving from simple conversational interfaces into distributed, multi-tier agent fleets. In these architectures, an Orchestrator Agent decomposes complex enterprise tasks and delegates subtasks to specialized worker agents—such as database query bots, reporting engines, and alert dispatchers. However, as permissions flow through delegation chains, standard multi-agent systems suffer from a severe architectural vulnerability: Implicit Privilege Escalation & Compounding Ambient Risk . When an agent delegates a task, how do we guarantee that a sub-agent only receives the minimum necessary permissions? What prevents a compromised analytics agent from requesting destructive WRITE or ADMIN access? And if an adversary alters the delegation logs, how can compliance auditors mathematically prove non-repudiation? To solve this, we built the Fortified Enterprise Agent Fleet —a zero-trust governance control plane powered by Gemini 3.5 Flash , Google ADK , and Google Cloud Run . In traditional RBAC, roles are static. In our zero-trust agent fleet, permissions are dynamic and strictly attenuated across hops. A scope is defined as a granular resource, action pair e.g., cloudsql:orders:read or firestore:reports:write . We enforce the mathematical law of Scope Attenuation: $$\text{Granted Scope} = \text{Requested Scope} \cap \text{Caller Scope} \cap \text{Target Ceiling}$$ Scope can only narrow as it travels down a delegation chain—it can never widen . firewall/scopes.py @dataclass frozen=True class ScopeSet: scopes: frozenset Scope = field default factory=frozenset def is subset of self, other: "ScopeSet" - bool: return self.scopes.issubset other.scopes def intersect self, other: "ScopeSet" - "ScopeSet": """Child scope = requested ∩ caller's granted scope.""" return ScopeSet self.scopes & other.scopes Before any delegated task executes, it is intercepted by the Blast-Radius Firewall . The firewall calculates an explainable risk metric based on operation severity: $$\text{Score} \text{Scope} = \sum \text{Weight} \text{Action} $$ where $\text{Read}=1, \text{Audit}=2, \text{Write}=4, \text{Send}=6, \text{Admin}=10$ If an agent attempts an unauthorized action e.g., a read-only query agent attempting cloudsql:orders:write , the firewall instantly halts execution, raises a QuarantineError , and logs the full diagnostic rationale. Standard database logs can be manipulated if a storage layer is compromised. To ensure verifiable non-repudiation, every single delegation hop whether ALLOWED or QUARANTINED is cryptographically signed using HMAC-SHA256 : provenance/chain.py @dataclass class ProvenanceRecord: task id: str parent agent: str child agent: str requested scope: str granted scope: str allowed: bool reason: str blast radius score: int timestamp: float signature: str = "" def sign self - "ProvenanceRecord": sig = hmac.new SECRET.encode , self.signed payload .encode , hashlib.sha256 .hexdigest self.signature = sig return self def verify self - bool: expected = hmac.new SECRET.encode , self.signed payload .encode , hashlib.sha256 .hexdigest return hmac.compare digest expected, self.signature If any log record is mutated after the fact, the cryptographic audit engine immediately detects the signature mismatch. Rather than running all agents in a single monolith, the Fortified Fleet deploys each worker as an independent Google Cloud Run service backed by a dedicated Google Cloud IAM Service Account : db-query-agent-sa $\rightarrow$ roles/cloudsql.viewer report-agent-sa $\rightarrow$ roles/datastore.user security-auditor-sa $\rightarrow$ roles/datastore.viewer notifier-agent-sa $\rightarrow$ No ambient cloud permissionsThis provides true network-level and OS-level process isolation, enforcing defense-in-depth across the entire fleet. Scope checks answer "is this agent allowed to do this?" — they say nothing about whether the content of a request is trying to manipulate an agent into doing something else. So we added a second, independent classifier ahead of the firewall: Gemma , a distinct Google model from Gemini, screens every delegation's raw input for prompt-injection intent before the scope firewall or any agent ever sees it. Because it's a separate model from the Gemini planner, a compromised planner prompt can't also disable the classifier watching it. To make agent governance accessible, we built a real-time visual control plane: The Fortified Enterprise Agent Fleet proves that enterprise multi-agent systems do not have to sacrifice security for autonomy. By combining Gemini 3.5's reasoning capabilities with mathematical scope attenuation and cryptographic audit trails, we can safely govern autonomous agent networks at enterprise scale.