[Use Case] Automated molecular design on a self-expanding multi-agentic coordination layer

1. Identification

Title: Automated molecular design on a self-expanding coordination layer in a multi-agentic AI–quantum coupled system: capability arrives with no act of conferral
Submitting organization: World Privacy Forum
Contact name: Pam Dixon
Contact email: pdixon@worldprivacyforum.org

Sector:
- [ ] Education
- [ ] Displaced persons / humanitarian
- [ ] Health
- [ ] Financial services
- [ ] Telecom
- [ ] Media and publishing
- [ ] Logistics
- [ ] Energy
- [x] Critical infrastructure — automated molecular design and synthesis is the upstream of pharmaceuticals, materials and energy; the same pipeline class drives physical synthesis
- [ ] Smart home / IoT
- [x] Other (specify): Scientific research and scientific communication — multi-agentic AI pipelines coupled with quantum capacity, observed in molecular and materials design

2. The situation

Plain language description:

This use case is based on a current molecular chemistry design research group that already has a system built — a multi-agentic AI system coupled with quantum capacity — that runs hundreds of AI agents in a shared workspace. Agents find one another on their own and acquire new capabilities as the underlying models improve, with no one conferring those capabilities on them. Reviewers, collaborators and procurers rely on the results, but nothing in the record lets them tell a capability that was granted from one the agent acquired, or from an agent that was authorised from one that was recruited by another agent. According to the system builder, the layer on which the agents coordinate is unspecified to them internally and unreleased to the public — so this theme exists to answer what to do when who conferred what authority on which agent cannot be answered from inside the system or outside it.

Actor:

The research group and its principal investigator, who commission the pipeline and are accountable for its outputs (principal and grantor, if any grant exists); the group as builder and deployer of the agent platform, which is not released to the public; the agent instances — hundreds of sub-agents, including a coordinating agent that dispatches work and a negotiating agent that mediates between others, each identified by a role name within the workspace that persists across runs and across model updates; the shared workspace through which agents discover one another (infra provider, internal); the underlying model providers, whose model updates are the mechanism by which agent capability grows; the parties who rely on the pipeline's outputs — collaborating groups, journals and reviewers, a government procurer for whom bespoke verification was offered, and any downstream user of a published result (relying parties); and no attestor, because nothing in the pipeline attests to what an agent was authorised to do as distinct from what it did.

Action:

An agent, in the course of a multi-day design loop, recruits another agent from the workspace, exercises a capability that did not exist when the loop was configured, and produces a result that is written into a report; the report is later "corrected" at the presentation layer without the simulations being rerun, and is offered outward as a finding.

Decision required:

May a relying party — a reviewer, a collaborating group, a procurer — treat the result as having been produced under an authority, and if so, whose? Was the capability the agent exercised conferred by anyone, at a recorded time(s), within what bounds, and does anything in the record allow a party who was not there to establish that?

Problem encountered:

The coordination layer is real, load-bearing for everything the group intends, and unspecified. It is planned as a named protocol but the named protocol is not yet built; in operation it is a virtual workspace plus a drawing convention (inter-agent communication appears in the group's own diagrams only as a line style, not as a named component). Capability expansion is a design goal, not a fault: the layer is built to grow what agents can do as models improve, without any act by the principal. Verification is internal, and none of it speaks to authority: benchmarks built and run in-house, a claim of "no hallucinated sources" carried without an accompanying check, run statistics showing twelve debug jobs against sixty-two submitted — and the offered substitute for a public standard is publishing agent trajectories, or verification as a bespoke service for a government client. The builder's own answer to the governance question of provenance of authority was to redirect to tool-calling. But tool calls do not quantify agentic relational and other activities that occur beyond tool calls. The governance gap is substantial. It is compounded by an inversion of the classical identity problem: the identity of an agent persists while the capability behind it changes, without any act by the principal, as the underlying models are updated — so an agent bearing the same name in two runs is, for authority purposes, two grantees, and identity cannot serve as the anchor for authority in this system.

Current mitigation:

Human-in-the-loop review after the fact and laboratory standard operating procedures are named as the only safeguards; release of agent trajectories after the fact; institutional research-integrity rules written for human authors; a platform not released to the public, which keeps the layer private for now.

Residual gap:

There is no grant anywhere in the chain. The principal configures a loop; the agents extend their own reach; the record, where one exists, shows what happened, not what was authorised. A relying party cannot distinguish an agent acting within a conferred scope from an agent acting within a scope it acquired; cannot tell a corrected report from a re-authorised one; and cannot tell, when a result is presented by one agent, whether the other agents that contributed had standing to do what they did. The layer that would carry any of this is two roadmap stages away and, when built, will be built by the same party whose agents it governs.

3. Actors and context

Taxonomy roles involved:
- [x] Principal — the research group and its principal investigator
- [x] Relying party — reviewers, collaborating groups, procurers, downstream users of published results
- [x] Builder — the research group
- [x] Deployer / Owner — the research group
- [x] Agent instance — hundreds of sub-agents plus a coordinating agent
- [ ] User — (the principal is the user)
- [x] Infra provider — the group's own shared workspace; the underlying model providers
- [ ] Attestor — none present; the absence is a case fact
- [x] Other (specify): Model providers, whose updates are the mechanism of capability growth, and who are not parties to any grant

Mandates in this case

Mandate 1 — the only one that exists, and it is implicit. Grantor: the principal investigator, on behalf of the research group and its institution. Grantee: the pipeline as configured at the start of a loop. What is conferred: nothing stated. In practice, a task, a set of tools reachable through the tool-calling protocol, and a workspace. No scope, limit, expiry, or revision condition is authored; the loop is configured, not granted. Governing regime: Canada; the institution's research-integrity and research-ethics policies, funder terms, and laboratory safety rules, all written for human researchers; the proposer is not aware of a specific rule that would apply to the provenance of authority granted to multiple AI agents in this use context, at the institution, the funder, or the national level.

Mandate 2 — absent by design. Grantee: any agent that acquires a capability after the loop is configured. In the observed system, agents "spin up new functionality" as models improve. No grantor acts. No record of conferral is produced. The capability is exercised under the implicit mandate above, which never named it. Listed so the absence is legible; this is the case's centre, and it is a design property of the system, not a fault in it.

Mandate 3 — absent, composition. Grantee: any agent recruited by another agent through the workspace. The recruiting agent's instruction identifies an observed source. It does not establish that the recruiting agent had, or could confer, authority to bring the recruited agent into the task, nor what bounds travel with it.

Assumptions and test boundary:

• This is a functional case, not a hypothetical one: the system exists, runs at scale, and is among the most advanced of its kind. The facts are as stated by its builder at a technical keynote and in the accompanying slides and question session, September 2026, observed in person by the proposer; the platform is unreleased to the public and could not be inspected.
• The case is written as single-jurisdiction and, as observed, under one principal investigator; whether the pipeline spans more than one institution was not established at the keynote and is left open. The scientific-communication drift the builder described — papers as agents, journals exposing tool-protocol endpoints, groups' papers arguing with other groups' papers — is cross-border and multi-regime by nature and is flagged as a follow-on, not tested here.
• The same pipeline class drives automated laboratory synthesis, where human-in-the-loop review and standard operating procedures are the safeguards in use. The case stays in simulation and reporting; the physical extension is a follow-on.
• The observed system is an instance of a multi-agentic AI system coupled with quantum capacity: the agents run quantum-chemical simulations and design molecular qubits for quantum sensing and computing, and the builder closed the keynote with the statement that "the coupling of AI and quantum is real." The coupling is one of domain, not of hardware in the loop; the authority question would arise identically in a classical pipeline of the same architecture. It is recorded because such coupled systems are where this architecture is arriving first, and the coordination layer described here is the layer they run on.
• The case does not ask this theme to specify the coordination layer, to standardise the tool-calling or agent-to-agent protocols, or to design verification. Those are consumed from Themes #1, #6, #7 and #13 and from the separate verification-standards work.
• The case does not ask whether the group's science is sound, and takes no position on the design choices described; it asks what a relying party can establish about authority from the record alone.
• The domain is chosen because it is where the proposer observed the layer directly and because the builder's stated destination — a self-driving scientist — makes capability self-expansion an explicit goal rather than an accident. The architecture is likely to be widely adopted, in science and beyond; the case is written so that its requirements can be met by such systems as they are built, and is offered as the path to solving provenance of authority for them rather than as a constraint on them.

Cross-border?
- [ ] Yes — jurisdictions involved:
- [x] No (the scientific-communication follow-on would be; see assumptions)

Embodied (physical actuation or sensing)?
- [ ] Yes — physical context:
- [x] No — the variants are simulation, reporting and submission. The same pipeline class drives automated laboratory synthesis; that extension is noted under assumptions and is not tested here.

Agent action type
- [ ] Read-only
- [x] Consequential (reversible) — simulation runs, reports, agent recruitment
- [x] Irreversible — where the pipeline drives physical synthesis, or where a result enters the scientific record

Crosses organisational boundary?
- [x] Yes (specify): results leave the group to reviewers, collaborators, journals, procurers; model updates enter the group from external providers; the planned journal endpoints would make the boundary crossing routine and machine-to-machine.
- [ ] No

Risk level
- [ ] Low
- [x] Medium
- [ ] High

Medium as observed (simulation and reporting); higher where the same architecture drives synthesis or where results enter the scientific record at scale.

4. Theme relevance

• Dynamic Identity — Yes. Agents carry persistent role names but exist per loop and change capability with each model update; identity continuity does not imply authority continuity, and identity of an instance cannot carry authority across updates that change what the instance can do.
• Continuous Trust and Attestation — Yes. No attestor exists; what would need attesting is not the agent's state but the conferral, or its absence.
• Delegation — Yes. PRIMARY. The case is delegation with the grant missing, in a multi-agentic AI–quantum coupled pipeline: capability exercised under an implicit mandate that never named it, composed through recruitment that no one conferred.
• Discovery and Cross-Border Trust — Yes (secondary). The many-to-many workspace is a discovery layer; the journal-endpoint follow-on is cross-border.
• Runtime Enforcement (Control Plane) — Yes. Human-in-the-loop and standard operating procedures are the only controls; they have nothing declared to check against.
• Embodied AI Identity and Trust — Yes (secondary). Automated synthesis is the embodied end of the same pipeline class.

Related theme proposals:

• Theme #5 — Provenance of Authority for Agentic AI (https://github.com/FG-TIDA/themes/issues/5), Phase 2 charter PR #15 (https://github.com/FG-TIDA/themes/pull/15). Submitted by the theme's proposer of record. The case instantiates the non-conferrable floor (D3) and composition (D5) from the supply side, and tests D1's distinction between possessing and having been granted authority at its limit: an agent that acquired a capability possesses it and was granted nothing.
• Theme #1 — Accountability and attribution after an agent has acted (what a record must preserve so that acquired and conferred capability remain distinguishable).
• Theme #6 — Intent-based policies and runtime verification (no authored reference exists to verify against).
• Theme #16 — Operational human oversight (human-in-the-loop as the sole safeguard, with nothing declared for the human to check).

5. Requirements

These are proposed requirements for review.

1. Technical — Must. Any capability an agent exercises is either traceable to an act of conferral — grantor, moment, scope, bounds — or is marked in the record as acquired without conferral. A format that cannot express the difference cannot carry provenance of authority for a self-expanding system.
2. Technical — Must. Capability that arrives through a change in the underlying model, or through the agent's own extension of its functionality, does not inherit the scope of the mandate under which the loop was configured; it enters the record as a new capability with no grant until one is authored.
3. Technical — Must. Where an agent recruits another agent through a discovery layer, the recruited agent's record marks the recruiting agent as an observed source; authority for the recruited agent's participation is established separately or not at all.
4. Technical — Must. A correction to a result that does not re-execute the work enters the record as a new, dated record of the correction and does not amend the record of the original act or of the authority under which it was performed.
5. Technical — Must. The record states whether the coordination layer through which agents discover one another and negotiate what each may do is specified in a form a party outside the deploying organisation can implement against or inspect; where it is not, the record says so, so that a relying party's evaluation reflects that fact. What the specification must contain is not decided here.
6. Legal/policy — Must. The case declares its governing regime — the institutional, funder, and national rules under which the principal's authority to configure the pipeline arises — as a case fact, and records whether any rule in that regime addresses agent capability or agent-to-agent conferral.
7. Legal/policy — Should. The principal states, in a form that travels with the pipeline's outputs, which classes of capability agents may not acquire without a fresh act of conferral (a non-conferrable floor for self-expansion), so that the floor is authored rather than discovered after the fact.
8. Technical — Must. An agent's identity record carries, at act time, the model version and capability set the agent was operating with, so that a relying party can establish that an agent bearing a name it has seen before is not, for authority purposes, the same grantee; identity continuity is never read as authority continuity.

6. Assessment criteria

Success criteria — four variants on the same pipeline:

• Variant A, capability without conferral. Between two runs, the underlying model is updated and an agent begins using a tool or method it could not use before. The relying party, from the record alone, can tell that the capability was acquired and not conferred, when it appeared, and that no grantor acted. Success is legibility of the absence, not prohibition.
• Variant B, recruitment. The coordinating agent recruits a sub-agent from the workspace to perform a step. The sub-agent's record marks the coordinating agent as an observed source; the relying party does not conclude from the recruitment that the sub-agent was authorised by the principal.
• Variant C, correction after the act. A report is corrected at the presentation layer without rerunning simulations. Evaluated as of the original act, the record shows the original result and the authority under which it was produced; evaluated later, it shows a distinct correction record with its own author and time. Neither overwrites the other.
• Variant D, the endpoint. A journal exposes a tool-protocol endpoint and an agent submits a result directly. The receiving system can determine, from what is carried, whether any grant covers the submission — and, if the pipeline's layer is unspecified, receives that fact rather than silence.

Measurable metric:

• For every capability exercised in a loop, the record yields exactly one of: a conferral record (grantor, moment, scope, bounds) or an explicit "acquired, no conferral" marking. Zero capabilities with neither.
• For every agent recruited through the workspace, the record carries an observed-source marking and no implied grant.
• For every corrected output, two dated records exist and the original is unchanged.
• For every outward submission, the receiving party can state whether the coordination layer that produced it is specified, from the carried record alone.
• Every determination identifies the agent by role name and by the model version and capability set at act time, the capability exercised, the mandate under which the loop was configured, the governing regime, and the moment of assessment.

7. Duplication check

Existing standards or SDOs:

• ITU-T SG17; FG-TIDA Theme #5 and PR #15.
• The open tool-calling protocol used by the observed pipeline (a specification with governance through a public enhancement process) and the planned open agent-to-agent protocol (foundation-governed). Neither carries a grant, a grantor, a governing regime, or a record of conferral; the tool-calling specification treats tool descriptions as untrusted unless from a trusted server and leaves trust to implementers.
• Institutional research-integrity frameworks and funder policies on research conduct, written for human authors.
• Emerging verification work for agentic science (trajectory publication; internal benchmarks) — not a standard.

Overlap notes:

The protocols in use specify how an agent reaches a tool and, prospectively, how agents exchange tasks. Neither specifies, and neither claims to specify, what authority an agent holds to do so, who conferred it, or what happens to that authority when the agent's capability changes. Research-integrity frameworks assign accountability to human authors and do not reach a pipeline whose capability grows without a human act. Verification proposals address whether a result is correct, not whether it was produced under authority; a correct result produced by an agent acting outside any conferred scope is the case this theme exists to make visible. The case does not propose a coordination protocol, a verification standard, or a research-ethics regime. It shows that a first-rate builder, running the best-in-class pipeline in the field, cannot answer the authority question from inside the system, and that the layer which would let anyone answer it is planned, unspecified, and two stages away.

8. Maturity

Pilot status
- [ ] Hypothetical
- [ ] Pilot in progress
- [x] Deployed in production — the observed pipeline runs at scale inside the group for its own research, producing results the group reports and relies on; the case variants are constructed on its stated architecture. The platform is unreleased to the public.

Reference implementation: None available to third parties; the platform is unreleased to the public.

9. IP and confidentiality

Confidentiality level
- [x] Public
- [ ] FG-internal only
- [ ] Redact before publication

IP notes: Contribution by Pam Dixon, World Privacy Forum, as proposer of record for Theme #5. The system is described structurally from a public technical keynote, its slides, and the public question session; the group, its institution, and its members are not named. No proprietary implementation is included and none was inspected.

10. Assets

Link to assets:
- [ ] Dataset
- [ ] Code
- [ ] Protocol
- [x] Other: proposer's field notes, keynote transcript, and slide photographs (September 2026), available to the co-chairs on request; a companion concordance entry on the term "protocol layer" documenting the vocabulary gap observed.

Sources:

• [S1] Technical keynote on multi-agentic, complex relational pipelines for AI systems coupled with quantum capacity, delivered at a major international quantum computing conference, September 2026; transcript and slides held by the proposer. Slide evidence cited in the case: the agent conceptual model with no component for inter-agent communication; the procedural-memory diagram in which inter-agent communication appears only as a line style; the roadmap placing an agent-to-agent protocol at stage two of eight, current stage zero, terminating at a "self-driving" scientist; run statistics showing twelve debug jobs against sixty-two submitted; a report marked as corrected at the visual layer without rerunning simulations; a references page asserting "no hallucinated sources."
• [S2] Question session following the keynote, in which the proposer asked (i) whether the pipeline's outputs could be independently verified and (ii) whether the group had developed protocol-layer tools and whether they were available; the answers as summarised in §2.
• [S3] Specification of the open tool-calling protocol in use, current revision (2026), including its statement that trust in tool descriptions is delegated to implementers.
• [S4] Specification of the open agent-to-agent protocol named on the group's roadmap, current revision.

Open items: replace [S1]–[S2] with the conference's official recording and proceedings, expected to be published within a few weeks of the keynote, at which point the case rests on the public record rather than the proposer's notes; confirm the group's stated safeguards against any published platform documentation when the platform is released; the scientific-communication follow-on (journal endpoints, papers as agents) to be filed as a separate cross-border case once a journal or publisher announces such an endpoint.