// multi-agent-systems · a short introduction

Multi-Agent Systems

Not AI magic — software architecture. Structure belongs in code, not in prose.

Markus Hanses · 2026

Prompts are not software

A programming language whose instructions are only suggestions cannot scale. Reliability means moving logic out of prose and into the runtime.

You MUST answer concisely.
DO NOT SKIP the validation step.
MANDATORY: return JSON only.
CRITICAL: follow the schema exactly.
…and yet, sometimes, it doesn’t.
contract · output = JSON only
AgentLLM · non-deterministic
Sure! Here’s your JSON:
{ "refund": true }
INVALID · expected JSON only, got prose

Case in point: Air Canada

When prose policy meets a language model — and the bill arrives in court.

Customer asks the chatbot
chatbot voice
“Claim the bereavement fare retroactively.”
policy-page voice
“Bereavement fares cannot be claimed after travel.”
⚖ BC Civil Resolution Tribunal · Feb 2024 — Air Canada liable · CAD $812.02

Two voices on one website both speak for the company. Non-deterministic · weakly specified · hard to verify.

Flip between hope and contract

One request, one model. Under hope the output ships unchecked. Under contract, code checks every output and re‑prompts until it is valid — generate, verify, retry.

extract-invoice · one request
idle one request, one model
contract: re-prompts until the output is valid

What is an agent?

The minimal autonomous unit. The model itself decides whether and when to reach for a tool.

Agentautonomous
=
LLMreasoning
+
Toolsactions
API {…} Database Web search
+
System Promptrole

One agent is enough for direct questions. It stops being enough when tasks need different reasoning, run in parallel, or a human must step in.

What is a multi-agent system?

Several autonomous agents that jointly solve a task too complex for one — held together by three primitives.

Communication  structured messages
Cooperation  shared tasks & results
Coordination  managed dependencies

Every control decision belongs in the architecture — not hidden in prompts.

The six patterns, in motion

Pipeline

fixed order

A fixed, predefined order of steps — deterministic every run.

Orchestrator

delegate

A hub delegates to specialists and decides the next step.

Graph

route

A coded graph; the LLM picks a branch, the structure routes.

Blackboard

shared state

Everyone reads and writes one growing, visible state.

Swarm

self-organizing

Peers hand off to each other — no central conductor.

Human-in-loop

gated

The system pauses at a modelled checkpoint and asks a human.

One spectrum: how much does the LLM decide?

Picking a pattern is choosing how much agency you delegate. Left trades capability for control; right trades control for capability.

Spectrum framing follows Anthropic (Building Effective Agents) & LangChain. Placement is editorial.

More agents, more attack surface

A single call defends one boundary — one prompt in, one answer out. A multi-agent system must defend as many boundaries as it has agents, tools, and hand-offs. Every inter-agent message is a trust boundary: one compromise cascades to every peer that trusts it.

Catalogued by OWASP (LLM Top 10 · 17 Agentic Threats) and threat-modelled with MAESTRO. Treat every hand-off as untrusted — re-verify, don’t trust by origin.

More prompts don’t resolve complexity.

Multi-agent systems are software architecture: specialised roles, explicit state, controlled flow.

Explore the patterns, frameworks & runnable demos in the knowledge base →