Delegation-Aware Runtime Contracts for Open LLM Multi-Agent Systems: Constraint Preservation, Capability Revocation, and State Recovery

<title>Abstract</title> <p>Large language model (LLM)-based multi-agent systems routinely delegate tasks, spawn sub-agents, share memory, and grant tool access, yet safety controls are commonly applied to individual agents or communication patterns rather than to the transfer of authority itself. We argue that treating delegation as ordinary natural-language text is a modelling error: objectives tend to survive repeated handoffs while budgets, data restrictions, obligations, and revocation conditions can weaken or disappear. We introduce delegation-aware runtime contracts (DARC), machine-checkable artifacts that accompany each authority-bearing handoff and encode capabilities, data scopes, obligations, prohibitions, budgets, expiry, provenance, and revocation conditions. A deterministic core—capability attenuation, data-scope preservation, budget and expiry bounds, lineage integrity, and revocation closure—receives formal guarantees under complete mediation and interposition; meaning-dependent clauses remain explicitly semantic and receive no equivalent guarantee. The runtime architecture mediates delegation, tool use, communication, and governed memory, and supports transitive revocation and lineage-based quarantine after compromise. The deterministic implementation is supported by a mechanized conformance suite and adapter-bypass tests. Formalization exposed two implementation-level escalation defects caused by omitted numeric limits and budget axes, yielding a general design principle: optional keyed constraints must default to the most restrictive interpretation. We describe a provenance-gated evaluation methodology and an exploratory automated-judge pilot, but make no confirmatory empirical claim because independent judge validation is incomplete. DARC is positioned as a bridge between normative multi-agent systems, capability security, and runtime enforcement for open LLM agent systems, with recovery treated as a first-class part of the guardrail.</p>