An orchestrator plus N sub-agents is not N+1 single agents. The shared lineage, the inherited permissions, and the fleet-wide blast radius are emergent properties, and they are exactly where single-agent tooling stops working.
An orchestrator with broad tool permissions spawns a sub-agent for a narrow task. Without scope-down enforcement, the sub-agent inherits the full parent permission set, and a single compromise of the cheapest, most exposed sub-agent escalates to the orchestrator's tool set.
The orchestrator hands the sub-agent a fragment of its context. That fragment now contains adversary-controlled text from a tool result, a retrieved document, or another sub-agent's output. The injection target moves from the orchestrator (well-defended) to a sub-agent (often not).
A poisoned dependency in one shared module appends an extra parameter to every outbound call across dozens of agents. No single agent crosses its per-agent threshold. Without fleet-level correlation, the breach is invisible until the data is already exfiltrating.
Every spawn produces a fresh agent identity, signed by the parent and ultimately chained to the originating human session. The sub-agent's calls carry its own identity at L1 of the Gateway. The chain, human principal → orchestrator → sub-agent → grand-child, is verifiable end-to-end and written to Time Machine.
Every spawn carries a tool-permission certificate that is at most the intersection of the parent's certificate and the sub-agent's task scope. A summarization sub-agent does not inherit initiate_wire from a payment-orchestration parent. The scope-down decision is enforced at L2 of the Gateway, deterministically, on every call.
The Fleet Correlator scores patterns across agents, not just within them. When a coordinated anomaly fires, a novel parameter on every outbound call across multiple agent types, a synchronized scope deviation, a cross-type tool-use spike, the Kill Switch publishes a fleet-level isolation event on Redis pub/sub. Every targeted Sentinel SDK enforces locally. Median fan-out: under 50ms.
A poisoned version of a shared Python library appends an extra parameter to every outbound call across 47 agents in 6 different agent types. No single agent crosses its per-agent threshold. The Fleet Correlator catches the cluster anyway, and the Kill Switch fans out across the entire affected cohort in one event.
Poisoned version appends an extra parameter to every outbound call, &telemetry_id=<exfil_hash>. Indistinguishable from a benign instrumentation update.
Each individual anomaly score lands around 0.4, below the per-agent 0.75 threshold. Every single-agent baseline check passes. The breach is invisible to per-agent enforcement.
The Kafka consumer observes a novel parameter pattern telemetry_id=* across multiple agent types within a short correlation window. Rule fires: cross-type anomaly cluster. The deployment-event topic shows no matching rollout.
One Redis publish; every Sentinel SDK enforces locally within the same window. SOC Analyst Helper produces the fleet-level narrative naming the 47 affected agents and the shared library, after the Kill Switch has already fired.
Affected containers redeployed with the clean manifest. Federation signal hash sent to the network. Every other member bank's detection hardens against this pattern.
SR 26-2 leaves agentic AI out of scope. There is no safe harbor, and examiners still apply model-risk and safety-and-soundness principles to a fleet, including the expectation of ongoing monitoring they carry over from model risk. A fleet that cannot be inspected as a fleet cannot meet that expectation. BladeRun produces evidence at the fleet boundary, not just per agent.
The Gateway, Sentinel SDK, Overseer, Kill Switch, and Federation already in your environment for single-agent workloads gain a fleet view automatically. No second product, no second contract.
The architectural twin of this page: spawn semantics, cert scoping, Redis fan-out, performance overhead per agent in a fleet.
Read the architecture →Per-agent baselines plus cross-agent correlation. The detection plane that fires the fleet-level Kill Switch.
Explore Overseer →Sub-50ms fan-out across the affected fleet. Lineage-aware forensic record in your S3, your KMS keys.
Explore Kill Switch →Point one orchestrator and its sub-agents at the BladeRun Gateway. Fleet Correlator runs in shadow mode for the first week. We show you which clusters would have fired, which sub-agents would have been scope-rejected, and which lineage anomalies would have surfaced.