A watchdog can produce a convincing report while watching the wrong system. It can identify a problem and lack the ability to stop it. It can also block useful work because it misclassified a harmless difference.
The recovered Guardian research distinguishes detection, classification, enforcement, scope, and authority failures. That is a more useful starting point than assuming a second agent automatically makes the first reliable.
Connect the control to the actual path
One archived example describes a guard function that existed and had tests while the active API path called a different function that only logged a message.
A structural review could confirm the guard’s presence and still miss the failure. A behavioral check needed to attempt the prohibited action through the real entry point and inspect the resulting state.
Review the route people use, not only the module whose name sounds correct.
Give the monitor independent evidence
Separate review context can reduce some shared assumptions, but independence requires more than a second conversation. Use an acceptance criterion grounded in the user’s request and the authoritative source.
The MAST research organizes multi-agent failures around system design, inter-agent misalignment, and task verification. Its findings reinforce the need to inspect coordination and validation, rather than attributing every failure to model capability.
Do not apply a distributed-systems fault-tolerance threshold to a collection of language-model judges without establishing the assumptions that make that threshold valid.
Make enforcement proportionate
Some findings need an immediate stop. Others need a warning or a correction before the next release. Define the consequence with the rule.
A monitor should report the observed action, the expected boundary, and the evidence of the difference. Avoid moralizing about the worker. An apparent violation may originate in a stale specification or conflicting configuration.
Provide an appeal or correction path. A watchdog that cannot be challenged becomes another unreviewed authority.
Monitor the monitor
Check whether its inputs are fresh, whether it is observing the intended environment, and whether its alerts reach an accountable person.
Track missed incidents and false alarms. Repeated low-value alerts teach people to ignore the system. A quiet dashboard is ambiguous if the monitor itself has stopped.
Test the monitoring failure path deliberately: disable a dependency in a controlled environment and verify that its absence becomes visible.
Give the watchdog a test suite of its own
The MAST research identifies task-verification failures as one category in multi-agent systems. A watchdog can reproduce that failure if it evaluates only the worker’s explanation instead of the resulting state.
Build fixtures where the worker claims success but the artifact is absent, the output belongs to an older revision, or the operation exceeded its permitted scope. The monitor should identify the specific mismatch. Pair them with successful tasks so unnecessary intervention is measured too.
Use independent observations where possible: a saved artifact, authoritative operation status, or a replayable test. Agreement between two generated summaries is weak evidence when both read the same mistaken status message.
Bound the monitor’s own failure effects
A watchdog needs a deadline, an owner, and a defined response when it cannot reach the system it observes. Google’s SRE overload guidance is relevant here: retry behavior can intensify the failure it is meant to repair.
Test loss of telemetry, a delayed heartbeat, and an unavailable dependency in isolation. Decide which conditions justify an alert, a pause, or a restart. Do not let every missed signal trigger an unbounded chain of restarts.
Microsoft’s June 2026 agentic failure taxonomy also motivates testing whether delegated actions bypass a control placed only on the primary route. Follow the actual tool path and inspect the denied effect.
Report missed failures, false alarms, intervention latency, and recovery outcome separately. A monitor that catches every error by stopping all work has not met the product’s reliability goal.
Keep the evidence attached
The archive’s historical violation totals are not a measurement of current safety. The lasting lesson is procedural: an enforced rule must be observable at the point where it matters.
A dependable watchdog makes work easier to trust because its findings can be reproduced, its authority is bounded, and its own mistakes can be corrected.
Keep a good idea close.
Follow Signal Tower
