# MAS-03 Confirmation binding across chains (Critical)

Domain: MAS Multi-Agent Systems · HI-AAF v1.3 · Public review · https://humanintel.net/standard/mas/mas-03

User-confirmation requirements under INP-03 and pre-execution-review requirements under ACT-03 bind across multi-agent chains. A confirmation given to one agent does not authorize a downstream agent to take an unconfirmed consequential action.

User-confirmation requirements under INP-03 and pre-execution-review requirements under ACT-03 bind across multi-agent chains. A confirmation given to one agent does not authorize a downstream or sub-agent to take a separate consequential action on the user's behalf. The originating user's scope travels with the request and constrains every hop. This prevents the common pattern where a downstream agent assumes inherited authority.

Critical control: a Critical failure precludes HI-AAF Certification regardless of the maturity level achieved on any other control.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for MAS-03: Confirmation binding is enforced across all multi-agent chains; the control has been tested through adversarial assessment; no downstream agent has taken an unconfirmed consequential action in the review period.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Confirmation binding is enforced across all multi-agent chains.
- The control has been tested through adversarial assessment.
- No downstream agent has taken an unconfirmed consequential action in the review period.

## Framework mappings

- NIST AI RMF: MANAGE 2.3
- OWASP LLM Top 10: LLM06
- SOC 2 (TSC): CC6.3
- EU AI Act: Art. 14(4)
- MITRE ATLAS: Execution
- Singapore: MAIGF Accountability, AI Verify Human Agency & Oversight

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites INP-03 Trust boundary enforcement: https://humanintel.net/standard/inp/inp-03
- Cites ACT-03 Pre-execution review: https://humanintel.net/standard/act/act-03
- Cited by IAM-05 Delegated authority model: https://humanintel.net/standard/iam/iam-05
- Cited by INP-03 Trust boundary enforcement: https://humanintel.net/standard/inp/inp-03
- Cited by ACT-03 Pre-execution review: https://humanintel.net/standard/act/act-03

## Cite this control

Human Intelligence. HI-AAF v1.3, MAS-03 Confirmation binding across chains. Public review edition, July 2026. https://humanintel.net/standard/mas/mas-03