A Valid Control Path Is Not a Valid Outcome

Editorial clarification: September 8, 2026

The summary and builder explanation now use direct language for routing and coordination. The study's reported values, limitations, and proposed WTK comparison are retained.

A multi-agent system can complete every routing step cleanly and still produce the wrong, unsafe, or unauthorized outcome. Successful routing alone does not establish that the result is correct or that the action was authorized.

For a concrete example, picture a claims workflow. A coordinator can hand a case to the right specialist and terminate on schedule. If the specialist used the wrong policy rule, or was never permitted to make the decision, the tidy handoff has not made the outcome acceptable.

The signal

Control-Data Flow Separation studies a simple boundary for prompt-optimized multi-agent systems. Each response has a typed control object for routing and termination plus a free-form data message for the task content. The optimizer may change the data-facing prompt, but not the control schema or its validation logic.

Across four offline tasks, the authors report 100% eventual protocol validity for their separated design. In their definition, an episode reaches a valid control state without an unhandled parse, validation, or routing error, with bounded retries permitted. Their main table reports 78.3% BBH accuracy, 44.4% MARG review Jaccard, 50.0% synthetic-underwriting accuracy, and 36.7% industry-verified-synthetic underwriting accuracy, each averaged over three random seeds.

The sharpest contrast is the multi-agent review task. Naive TextGrad reached 0% stability and 0.0 Jaccard there after prompt edits corrupted the embedded control instructions. In the paper's smaller MARG cross-family subset, naive optimization also reached 0% stability for the evaluated OpenAI, Anthropic, and Google model families, while the separated design reported 100% stability for each. That supports testing control rules that are enforced separately from editable task instructions.

The boundary

The paper is a preprint about Python-controlled systems, fixed schemas, the authors' retry and fallback policy, selected prompts and models, small task splits, and offline measurements. Its MARG score is an LLM-as-judge alignment metric. The industry partner inputs and manual are synthetic but not available for independent reproduction.

Most importantly, the paper's lemma excludes unhandled parsing, validation, and routing errors. It does not establish semantic correctness, factual grounding, fairness, authorization, or a better user outcome. The authors did not evaluate dynamic agent creation or runtime schema evolution. A controlled failure can be the safe response to malformed control, but it is still a failed goal that a builder must retain and evaluate.

The builder impact

WTK proposes keeping rules for assigning work, passing results between roles, combining their outputs, stopping, and permitted actions in structured contracts. The execution environment should enforce those rules independently of editable task instructions. A target should reject an out-of-contract route or turn it into a visible controlled failure rather than silently accept it.

That addresses routing, not the whole task. WTK's evidence lifecycle separates a valid package adapted for an execution environment from evaluation of its behavior and authorization to replace an accepted version. The research and falsification method adds the next question: did the fixed package, target, and evaluator reach the stated goal under declared conditions? A valid trace is evidence for one property, not a shortcut around the rest.

The WTK test

We propose one static-team qualification fixture. Hold a package and target projection fixed, then compare instruction-only routing with contract-enforced routing while freezing the package digest, contract digest, model bindings, goals, evaluator, budget, retries, and permissions. Retain every malformed control event, fallback, controlled failure, handoff, final target state, and held-out outcome.

Measure protocol errors separately from goal completion, policy outcomes, cost, and latency. The hypothesis fails if the contract-enforced arm only produces cleaner traces while hiding failed goals or weakening permission checks. External research gives WTK a testable design question, not a WTK finding or a maturity promotion.

Source

Primary research: Control-Data Flow Separation: Stable Prompt Optimization in Multi-Agent LLMs, arXiv: 2609.00621. WTK reviewed the canonical 23-page arXiv v1 paper and treats it as external evidence for a proposed qualification experiment.