Multi-Agent Handoff Drops "Do Not Resize" Safety Constraint

Issue: A Cost-Analysis Agent Identifies an Underutilized Instance as a Rightsizing Candidate but Notes in Its Free-Text Reasoning That the Instance Is Excluded Because of an Active Maintenance Freeze or Production-Critical Designation, and a Downstream Execution Agent That Acts on a Structured Candidate List Never Sees the Exclusion Note, Resizing the Protected Instance Anyway

Frequency: Occasional

Symptoms

• An execution agent autonomously resizes or terminates an instance that the cost-analysis agent’s own commentary, on the same analysis run, explicitly identified as excluded due to a maintenance freeze, production-critical designation, or pending migration
• The structured candidate list consumed by the execution agent contains an entry for the protected instance with no exclusion flag, even though the analysis agent’s free-text summary for that same instance states it should not be touched
• Re-running the same resize execution with the exclusion explicitly included as a structured field on the candidate entry correctly skips the protected instance, isolating the failure to the handoff contract rather than the analysis being wrong
• The resize is discovered only when the protected workload experiences disruption during its maintenance freeze or migration window, tracing back to an unauthorized resize that bypassed the documented exclusion
• Instances resized under a routine, no-exception rightsizing rule are almost never affected – the failure requires an instance that would otherwise qualify but carries a one-off circumstance, like prod-db-7’s freeze, that only shows up as prose rather than as a value in any field the candidate list defines

Root Cause The analysis and execution agents are invoked as separate steps sharing only a candidate-list artifact, and that artifact’s schema was built around the common case – utilization metrics driving a rightsizing decision – with no column reserved for the uncommon case of a time-bound exception like a maintenance freeze. When the analysis agent wrote “exclude from automated resizing until the freeze lifts” for prod-db-7, that sentence had nowhere to go but the free-text summary, because a candidate-list row has no exclusion column to write it into; the execution agent then reads the row exactly as the schema presents it, utilization figures and nothing else, with no reason to suspect the summary text says something the row doesn’t.

Example

Cost-analysis agent reviews utilization data and identifies prod-db-7 as a rightsizing candidate, but notes in its written summary: "prod-db-7 shows low average utilization but is under an active maintenance freeze through the 20th -- exclude from automated resizing until the freeze lifts"
Analysis agent's structured candidate list, consumed by the execution agent, includes prod-db-7 with its utilization metrics but no exclusion flag; the freeze note exists only in the free-text summary
Execution agent processes the structured candidate list and autonomously resizes prod-db-7 down, since nothing in the structured data it reads indicates the instance is excluded
Resize occurs during the maintenance freeze window, causing a service disruption that the freeze was specifically meant to prevent

Key Statistics

Contributing Factors

• Analysis agent’s output contract permits an exclusion to exist only in free-text commentary without requiring a corresponding structured field on the candidate entry
• Execution agent is designed to act on the structured candidate list only, with no step that re-scans analysis commentary for exclusion language before resizing
• No automated reconciliation compares exclusion-relevant language in analysis commentary against the structured candidate list actually passed to the execution agent

Mitigation Strategies

1. Mandatory Structured Exclusion Field for Any Flagged Constraint: Require the analysis agent to populate a structured excluded field (with reason and expiration) for any candidate it notes should not be resized, and block the candidate list from being marked complete without it
2. Commentary-to-Field Reconciliation Check: Run an automated scan of analysis commentary for exclusion-relevant keywords (“freeze,” “do not resize,” “production-critical”) and verify a corresponding structured field exists before the candidate list proceeds to execution, flagging any mismatch
3. Execution Agent Cross-Checks Tagging System: Require the execution agent to independently check an authoritative source of protection status (a maintenance-freeze calendar or instance-tagging system) before resizing any instance, rather than relying solely on the analysis agent’s candidate list
4. Resize Confirmation Requires Explicit Exclusion Acknowledgment: Before any autonomous resize executes, require an explicit reconciliation step confirming the target instance carries no active exclusion in either the structured candidate list or the authoritative protection-status source

Metrics

• Rate of autonomous resizes executed against an instance later found to have had exclusion-relevant commentary but no structured exclusion field
• Percentage of analysis-agent exclusions recorded as structured fields versus commentary-only
• Number of resize actions blocked by the authoritative protection-status cross-check

Alerts

• Autonomous resize executes against an instance with an active maintenance freeze or production-critical tag in the authoritative protection-status source → P1
• Reconciliation check finds analysis commentary with exclusion-relevant language and no corresponding structured field, and execution proceeds before resolution → P1
• A cost-optimization pipeline is deployed or modified without a mandatory structured exclusion field in its analysis output contract → P3

References

• Demystifying the Lifecycle of Failures in Platform-Orchestrated Agentic Workflows
• Why Do Multi-Agent LLM Systems Fail? (MAST)
• Automated Cloud Infrastructure-as-Code Reconciliation with AI Agents