Writing ·
AI agent approval monitors: count independent sources, not model votes
Map shared evidence sources before combining AI monitor approvals; test source-counting against unsafe approvals, false rejections, and escalation needs.
By Youssef Hemimy · agent safety · agent evaluation · AgentOps
Three AI reviewers reading the same poisoned record are not three independent approvals. For a consequential action whose fields can be checked against evidence, group monitors by the source they read. Require corroboration from genuinely independent sources before execution, use a deterministic comparison where the data is structured, and escalate missing or contradictory evidence. Test bad actions wrongly approved and good actions wrongly blocked. This is the design question raised by the Correlated Failures of AI Approval Monitors preprint, not a universal safety guarantee.
Why vote counts can mislead
Imagine four monitors reading an invoice email, four reading an ERP vendor record, and four reading a supplier portal. If the invoice is forged, its readers can agree on the wrong account for the same reason. A vote counts four verdicts; a source-aware rule sees one potentially compromised evidence path. In the paper's synthetic task, those records were independent by construction, and each monitor saw one source, the proposed action, and a shared justification.
Source independence must be verified. Two screens replicating one upstream vendor feed are one failure domain. Models from different providers can share an attacker-controlled document or free-text justification. The paper measures wrong approvals and wrong rejections separately because a rule can stop fraud while blocking legitimate work.
Put a source-aware check before execution
For a factual, evidence-checkable action, keep this reviewable decision record:
| Decision artifact | What to record or check |
|---|---|
| Proposed action | Exact payee, account, amount, currency and reference—or equivalent fields—and the request version. |
| Evidence map | Each monitor's identity, record, provenance, and shared text. Copies of one upstream feed form one failure domain. |
| Approval rule | Count distinct independent evidence-source groups represented among approvals, not model instances. Test any two-source threshold locally. |
| Unresolved path | Do not execute automatically if provenance is uncertain, records conflict, or the rule cannot establish approval; escalate the exact action and evidence. |
The two-source rule is the paper's studied design for a factual payment check, not a general authorization policy. A payment matching records can still be unrequested, duplicated, or impermissible. Authenticated requests, limits, and human authorization are separate gates. See human approval gates for AI agents for binding a person's decision to the current action.
Place the check where it stops execution. The OpenAI Agents SDK guardrails documentation describes function-tool input guardrails before a tool call and tripwires. Default agent input guardrails may run concurrently with execution; blocking mode prevents action until they finish. The function-tool pipeline does not cover every hosted or built-in tool or the handoff call. Test the actual side-effect boundary.
What the study found—and where the simple rule failed
In preregistered confirmation using twelve small open-weight model/view monitors, the source-counting rule blocked 0.9% of correct payment items, versus 7.4% for the best vote-counting rule at the same measured 0.1% unsafe-approval rate on held-out attacks. These are experiment-specific rates, not a forecast for an operating payment system.
The failed worst-case test matters more: one evidence-aware blocking attack left surviving model approvers reading only the invoice. No rule over those twelve LLM monitors was both safe and live against every measured attack. A deterministic ERP field-comparison engine restored the paper's cross-cover condition on measured attacks, but could still be fooled by a forged ERP record. Source-counting exposes correlation and can improve a measured tradeoff; it is not a magic quorum.
The author also tested narrower views: withholding free-text justification and using structured inputs reduced the tested blocking payload's effect toward the benign floor. Repeat that test locally; it does not prove prompt-injection immunity.
Evaluate both failure directions before rollout
Build a held-out replay set with known action correctness and source provenance. Include a bad action supported by one forged source, a correct action carrying an injected warning in shared text, and records that appear separate but copy one upstream feed. Compare raw votes, source counting, and source counting plus deterministic field checks. Report unsafe approvals, false rejections, and escalated share together. Freeze the action and source versions used for each decision, then test the execution boundary. This is a proposed evaluation, not a published outcome for your system.
For outcome-based reviewer tests, see how to evaluate AI agent reviewers. For explicit escalation branches, see agent workflow graphs.
Where this pattern does not fit
The evidence applies best to witness-mode decisions: action fields can be checked against records independently of the proposing agent. It transfers less directly to code-change judgment, a contract clause, or a message where reasonable reviewers disagree and no factual source quorum exists. The unreviewed preprint studied one synthetic payment-task family, specific models and attacks, and a controlled source layout. It did not establish production fraud rates, cross-domain safety, or a general guarantee for model ensembles.
Sources
FAQ
Does adding more AI monitors make approval safer?
Only if they add useful, sufficiently independent evidence or checking capability. In the study, monitors sharing a source could fail together, so raw monitor count overstated the diversity of evidence.
Is approval from two sources enough?
Not by itself. The study's two-source rule improved a measured tradeoff, but a tested blocking attack defeated the condition needed for both safety and liveness over its twelve-model pool. Correlated upstream feeds and multiple corrupted sources remain risks.
Should a deterministic rule replace every model review?
Use deterministic comparison for fields it can verify. It cannot necessarily interpret unstructured evidence or judge a discretionary action. In the paper, an ERP rule engine helped on measured attacks but could still be fooled by a forged ERP record.
Building something that has to hold up?
We do this work for teams — agent reliability hardening, custom MCP servers, and full-stack AI systems built to survive production.