Your Lead Agent Is the Bottleneck, Not Your Model
Multi-agent systems saturate for organizational reasons, not model reasons: any topology that routes all synthesis and dispatch through a single lead inherits the exact fan-in ceiling of a star-shaped human team, and the fix is added hierarchy with independent reviewers — not a better lead prompt.
AngleUse the solo/star/tree progression as a diagnostic checklist: if your lead is doing all synthesis, you have a star and you are already saturated; show what adding a middle layer actually changes about context pressure and throughput.
Source video ↗Declare, Contain, Detect: Stop Putting Governance in the System Prompt
Agent safety only becomes auditable when each risk is assigned an enforcing platform primitive — minimum tool sets, egress limits with credential substitution, and durable event streams — because prompt-level instructions are behavior the agent can choose to ignore, while network boundaries are not.
AngleWalk each of the three obligations as an enforcement point and show which failure mode each one eliminates, with credential substitution as the structural defense that converts prompt injection from secret disclosure into a policy violation at the boundary.
Source video ↗Self-Grading Is the Bug: Why Generation, Review, and Verification Must Be Different Agents
An agent asked to both produce and check its own output will systematically over-accept it; accuracy on verification-heavy work comes from separating roles into distinct contexts with distinct information access, at the cost of more invocations, and that trade is worth making wherever ground truth exists.
AngleFrame self-preferential bias and agentic laziness as architectural problems with structural remedies, then honestly bound the claim: the evidence is strongest on tasks with an objective oracle like planted bugs, and unproven elsewhere.
Source video ↗When the Model Writes Its Own Org Chart
Dynamic orchestration relocates the multi-agent graph from inspectable developer configuration into a runtime artifact decided per task, which means reproducibility and debugging must be recovered from durable event logs, budget caps, and interrupt gates rather than from a static workflow definition.
AngleExplain what you lose when the topology stops existing as a file, and what you must build instead: replayable event streams, cost ceilings, mid-run termination, and audits of the lead agent's own planning step.
Source video ↗Allowlist Escape Room
gatehouseAn injected agent confined to allowlisted destinations plus proxy-side credential substitution can still exfiltrate attacker-chosen data through request paths, headers, or query parameters to a legitimate host, and durable event logs will not flag it as anomalous without destination-independent content inspection.
Proof of conceptBuild a sandbox with an egress proxy and one allowlisted echo endpoint; inject a prompt that instructs the agent to encode a canary string into a query parameter or header of a legitimate request. Measure whether the canary arrives at the endpoint and whether anything in the event stream marks the request as suspicious.
MeasurementExfiltration success rate across encoding channels (path, header, query, body field), plus the fraction of successful attempts that produce a detectable anomaly in the event log.
Source video ↗Fan-Out Knee Finder
beyond-evalsQuality on a fixed task family improves with fan-out width up to a saturation point and then flattens or degrades, and the saturation width is predictable from the lead agent's synthesis context size rather than from the task's inherent difficulty.
Proof of conceptRun one task family (e.g., repository-wide bug triage) at fan-out widths of 1, 5, 20, and 100 sub-agents with a fixed lead, recording success rate, total tokens, and wall-clock time, then repeat with a lead given a larger synthesis budget to test whether the knee moves.
MeasurementSuccess rate, cost per solved task, and wall-clock time as functions of fan-out width; location of the knee and whether it shifts with lead context budget.
Source video ↗Independence Dividend
beyond-evalsSeparating generation, review, and verification into three contexts with asymmetric information access beats a single-context self-check on open-ended tasks (writing, planning) by a smaller margin than it does on tasks with an objective oracle, and the margin shrinks as judge independence decreases.
Proof of conceptImplement the same generator/reviewer/fresh-prover topology over two task sets — one with verifiable ground truth (planted bugs) and one without (design briefs) — and compare against a single-agent baseline at equal token budget, with blind judging at three independence levels.
MeasurementQuality delta versus single-agent baseline after controlling for total token spend and invocation count, reported separately for oracle and non-oracle tasks.
Source video ↗Lead Plan Autopsy
movement-labUnsupervised lead-agent plans fail in a small number of repeatable, detectable ways — redundant sub-agents, missing verification gates, and decomposition boundaries that cut across natural task seams — and these are identifiable from the durable event stream without reading final outputs.
Proof of conceptCapture lead-agent plans and fan-out events from a batch of production-style runs, classify plan defects against expert-authored static rosters for the same tasks, and build a replay view that reconstructs the generated graph from the event log alone.
MeasurementDefect rate per plan category versus the expert baseline, plus the fraction of plan structure faithfully reconstructable from events (replay fidelity).
Source video ↗