Agentic Consensus Systems

• Agentic consensus systems are multi-agent arrangements where autonomous entities transform decentralized observations into coherent collective decisions through explicit phases of perception, judgment, and action.
• They employ diverse methodologies—from majority judgment and proof-gated authorization to liquid delegation and blockchain-style consensus—to enhance decision accuracy and Byzantine resilience.
• These systems integrate control theory, formal correctness models, and governance mechanisms to improve reliability, security, and the auditable integrity of decentralized decision-making.

Agentic consensus systems are multi-agent arrangements in which autonomous or agentic entities transform distributed observations, plans, or intents into a collective judgment, authorization, route, classification, or action. In the literature, consensus ranges from a central agent taking a majority judgment over binary recommendations (O'Leary, 2013), to an “agentic society” that “perceives patterns, makes judgments, and takes actions that no single object could achieve alone” (Ko et al., 5 Apr 2026), to infrastructures in which execution authority is derived from proof objects, evaluator attestations, and quorum rules rather than from standing identity (He et al., 13 May 2026). The topic therefore spans classical correctness amplification, decentralized delegation, evidence-grounded validation, Byzantine-resilient coordination, and governance mechanisms for high-stakes action.

1. Conceptual foundations

Agentic consensus extends beyond the classical notion of agents merely exchanging messages until agreement. In the formulation of an “agentic society,” individually capable agentic objects do not automatically form an effective collective; coordination requires explicit structure across three phases: perception, judgment, and action. The central design questions are “what to share,” “how to judge,” and “when to act,” together with boundary control, aggregation and conflict resolution, escalation, accountability, privacy, and integrity (Ko et al., 5 Apr 2026).

A second strand places consensus within the formal apparatus of autonomous agents and multi-agent systems. BDI architectures, communication protocols, mechanism design, and institutional modelling are presented as the conceptual tools needed to make agentic systems transparent, cooperative, and accountable. In this view, consensus is not just outcome aggregation; it is also a matter of explicit beliefs, desires, intentions, speech acts, incentive-compatible interaction rules, and institutional constraints on what agents may or must do (Dignum et al., 21 Nov 2025).

A control-theoretic perspective generalizes the same point by treating agency as hierarchical decision authority over the control architecture. The five-level hierarchy ranges from reactive rule-based control to the synthesis of control objectives and controller architectures, while embedding memory, learning, tool activation, interaction signals, and goal descriptors in a unified closed-loop representation. This suggests that agentic consensus systems differ not only in voting rules, but also in how much authority agents have to adapt parameters, switch strategies, compose tools, or generate new objectives during operation (Eslami et al., 11 Mar 2026).

2. Formal models of correctness and aggregation

A canonical model is the majority-voting consensus scheme in which a coordinating agent polls $n$ independent agents, each with independent probability $p$ of making the correct binary decision. If $M$ is the minimum majority needed, the probability that the consensus decision is correct is

$P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$

Within this binomial model, three results are central: if $p > 0.5$, then $P_c > p$; if $p = 0.5$, then $P_c = 0.5$; and if $p < 0.5$, then $P_c < p$. Consensus is therefore advisable only when individual agents are better than chance. The model also yields operational prescriptions about how many agents to use and which agents to include (O'Leary, 2013).

The same framework is extended to heterogeneous competence and unequal prior odds. For two groups $p$0 and $p$1, if $p$2, adding group $p$3 lowers consensus reliability; if $p$4 and group $p$5 is large enough, consensus with both groups can exceed consensus with group $p$6 alone; and for each $p$7 there is a threshold $p$8 above which inclusion of $p$9 is beneficial. Under unequal prior odds, Bayes’ theorem yields

$M$0

with the decision condition $M$1 for consensus to be appropriate. The paper’s example states that if $M$2 and the target is $M$3, at least 5 agents are needed (O'Leary, 2013).

A decentralized alternative appears in asynchronous groups without supervisor agents. Here, each agent gathers $M$4 opinions, including its own, and updates by dominant value:

$M$5

Preferential communication channels alter the resulting consensus dynamics. A high chance of communication to friends increases subgroup homogeneity; large preferred group size makes sampled opinions more representative of the whole; fewer gathered opinions increase susceptibility to local fluctuations and subgroup bias; and more gathered opinions increase stability and convergence. The same study reports that mixing dominant value updating with consensus integration produced the lowest mean absolute error in its application setting (Maleszka, 2021).

3. Architectural substrates and governance

In governable agentic infrastructures, consensus often determines admissibility of action rather than merely a shared state. The Distributed Trust Framework formalizes this shift through a Justification Proof $M$6, independent evaluator attestations $M$7, a consensus rule $M$8 that returns approve, reject, or escalate, an ephemeral Execution Identity $M$9, and an append-only Evidence Chain $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$0. Its invariants are explicit: no execution without proof, no authority without explicit consensus over the proof, no issued identity exceeding the authorized boundary, and one complete evidence chain for every intent (He et al., 13 May 2026).

A different governance architecture treats the consensus layer itself as the primary artifact. In this formulation, a project is represented as $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$1, where $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$2 is a typed property graph mediating between intent, realized artifacts, and evidence. Synchronization operators $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$3 (“realize”) and $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$4 (“rehydrate”) keep executable artifacts and the consensus graph in correspondence, while under-specification is surfaced as measurable consensus entropy $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$5 rather than hidden as a silent guess. Evaluation is correspondingly shifted toward alignment fidelity, consensus entropy, intervention distance, and cognitive load (Wang et al., 20 Apr 2026).

A broader architectural literature treats reliability as chiefly an architectural property. The recurring components are a goal manager, planner, tool-router, executor, memory, verifiers, safety monitor, and telemetry, connected through schema-constrained, validated, least-privilege interfaces and wrapped in explicit control and assurance loops. In multi-agent settings, these structures support supervisor–worker or peer protocols, schema-typed messaging, arbitration roles, sandboxed execution, mandatory critique phases, termination rules, and structured replay via audit logs (Nowaczyk, 10 Dec 2025).

Consensus can also be centralized at a reasoning layer rather than at the action layer. In a responsible and explainable architecture, a consortium of heterogeneous LLM and VLM agents independently generates candidate outputs from the same context, and a dedicated reasoning agent compares, consolidates, enforces policy and safety constraints, preserves intermediate outputs, and produces an auditable final output. Explainability arises from explicit cross-model comparison; responsibility is enforced through the reasoning-layer governance agent (Bandara et al., 25 Dec 2025).

4. Mechanism families and application patterns

The literature instantiates agentic consensus through several distinct operational mechanisms.

Mechanism	Operational form	Representative source
Majority judgment	Central agent polls $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$6 agents; simple majority or threshold vote	(O'Leary, 2013)
Proof-gated authorization	Attestations over a Justification Proof with quorum, diversity, and veto rules	(He et al., 13 May 2026)
Delegative routing	Liquid democracy and transitive delegation yielding a winning path	(Kesari et al., 25 May 2026)
Component-wise validation	Prompt perturbation, element-wise majority voting, and confidence thresholds	(Nguyen et al., 15 Jun 2026)
Resilient filtering	MSR-type trimming of extreme values before agent updates	(Anand et al., 12 Jun 2026)
Proof-of-Inference blockchain consensus	Deterministic LLM inference as the basis of block-creation rights	(Jimenez et al., 15 Apr 2026)

In decentralized collaboration, $P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$7 grounds consensus in liquid democracy and information diffusion from social choice theory. Each agent either retains its vote and acts as a “guru” or delegates to a neighbor believed to be more competent; delegation is transitive, so accumulated votes move along a path until a winning path emerges by consensus. The mechanism proves that delegation to a more competent neighbor is incentive compatible, characterizes Nash equilibrium, and ties payoffs to marginal contribution. On real-world datasets, the reported performance exceeds the “best single” agent baseline on MMLU-Pro, Open Leaderboard v2, and SWE-bench, with gains reported as +1.86, +8.33, and +3.2 percentage points, respectively (Kesari et al., 25 May 2026).

In hierarchical classification, consensus can be component-wise and uncertainty-aware rather than monolithic. The HTS classification framework combines multi-agent information retrieval, evidence-grounded reasoning, prompt perturbation, element-wise majority voting,

$P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$8

component confidence

$P_c = \sum_{m=M}^{n} \binom{n}{m} p^m (1-p)^{n-m}.$9

and human-in-the-loop escalation when $p > 0.5$0. On 3,300 expert-labeled Canadian HTS records, exact 10-digit classification remained difficult; the best reported model, Gemini-3.1-Pro, achieved 74.31% chapter accuracy, 61.81% heading accuracy, 52.08% subheading accuracy, 61.11% tariff item accuracy, 47.92% suffix accuracy, and 40.97% whole-code accuracy (Nguyen et al., 15 Jun 2026).

Blockchain-style consensus provides another application pattern. HadAgent replaces hash-based mining with Proof-of-Inference, in which nodes earn block-creation rights by executing deterministic LLM inference tasks. Validation requires re-executing a single forward pass under identical conditions, and the block body is organized into DATA, MODEL, and PROOF lanes, each with an independent Merkle root. A harness layer monitors heartbeat, anomaly detection, and trust transitions for trusted and non-trusted nodes. The prototype reports 100% detection rate and 0% false positive rate for tampered records, sub-millisecond validation latency, exclusion of adversarial nodes within two rounds, and promotion of honest nodes to trusted status within five rounds (Jimenez et al., 15 Apr 2026).

5. Failure modes, resilience, and security

A recurring result is that consensus can fail even when the constituent agents are individually capable. The “agentic society” scenario makes this explicit through three failure modes. False positives destroy trust when accurate local observations are aggregated into a completely wrong collective inference. Deadlock appears when privacy restrictions or blocked information flow produce splits such as 2–2–1 and therefore no action. Adversarial corruption arises when a compromised participant dilutes or poisons judgment, leading either to missed crises or to frequent false alarms (Ko et al., 5 Apr 2026).

Controlled experiments on Byzantine consensus games show that prompted LLM agents can fail to reach agreement even where classical resilient consensus theory guarantees that a convergent algorithm exists. In complete graphs, agreement may fail even when $p > 0.5$1, and this failure persists across temperatures and horizons. Wrapping the agents with classical MSR-type filters improves agreement. On complete graphs the filter is

$p > 0.5$2

and on directed graphs the local version trims the $p > 0.5$3 smallest and $p > 0.5$4 largest in-neighbor values when $p > 0.5$5. The same study finds that overestimating the filter parameter $p > 0.5$6 relative to the actual Byzantine population does not harm honest-agent consensus (Anand et al., 12 Jun 2026).

Another line of work argues that consensus may invert the “Wisdom of the Crowd.” The “Consensus Paradox” and “Inverse-Wisdom Law” are introduced to describe kinship-dominant swarms in which internal agreement is prioritized over external logical truth. The paper defines the Tribalism Coefficient $p > 0.5$7, the Sycophantic Weight $p > 0.5$8, an Attention Latch factor $p > 0.5$9, and Logic Saturation as the state where internal entropy $P_c > p$0 goes to zero while factual error $P_c > p$1 goes to one. It further proposes a Heterogeneity Mandate and reports that terminal swarm integrity is strictly gated by the synthesizer’s receptive logic rather than aggregate agent quality (Shehata et al., 30 Apr 2026).

Security analyses extend the same concerns across the full agentic stack. The Layered Attack Surface Model partitions threats into Foundation, Cognitive, Memory, Tool Execution, Multi-Agent Coordination, Ecosystem, and Governance layers, and attack temporality into T1 through T4 classes. The most dangerous emerging threats are reported to concentrate at the intersection of high-layer attacks and slow-burn temporality, namely $P_c > p$2; only 8 of 120 paper-cell assignments, or 7%, fall in this zone. The model also states that a pure defense at one layer cannot detect an attack whose payload is exclusively in another layer (Chu, 25 Apr 2026).

A protocol-level response appears in Agentic-SecPBFT, where every consensus node in a mobile ad-hoc network is equipped with a Local Consensus Agent, coordinated by a Cluster Optimization Agent under a hierarchical MADQN scheme. The agents observe consensus state, wireless conditions, and reputation, and take PBFT-safe defensive micro-actions such as flagging, challenge-response, or view-change voting. Simulations report a 95.0% attack detection rate, a 1.8% false positive rate, 3.1* higher throughput, and 56% lower latency on average under 33% malicious nodes (Luo et al., 3 Jul 2026).

6. Evaluation, diagnostics, and empirical behavior

Outcome-centric evaluation is repeatedly presented as inadequate for agentic consensus. Graphectory addresses this by encoding trajectories as $P_c > p$3, where nodes are actions, temporal edges capture execution order, and structural edges capture navigation in the problem domain. It also introduces LANGUTORY, a compressed phase sequence such as $P_c > p$4, and process-centric metrics including Node Count, Temporal Edge Count, Loop Count, Average Loop Length, Structural Edge Count, and Structural Breadth. Across 4,000 trajectories from SWE-agent and OpenHands on SWE-bench Verified, richer prompts and stronger LLMs produced more complex Graphectory graphs; resolved issues tended to follow coherent localization-patching-validation patterns, whereas unresolved runs were more chaotic, repetitive, or backtracking; and even successful runs often displayed inefficient processes (Liu et al., 2 Dec 2025).

Cross-model reliability can also be evaluated directly at the collective level. In radiology question answering, 34 LLMs were compared on 169 expert-curated questions under zero-shot inference and under an agentic retrieval-augmented reasoning condition with identical structured evidence reports. Agentic inference reduced median entropy from 0.48 to 0.13, increased mean robustness of correctness from 0.74 to 0.81, and increased majority consensus overall with $P_c > p$5. Consensus strength and robust correctness remained strongly correlated ($P_c > p$6 zero-shot and $P_c > p$7 agentic), but high agreement did not guarantee correctness. Among 572 incorrect outputs, 72% were associated with moderate or high clinically assessed severity, while Fleiss’ $P_c > p$8 for severity labels was 0.02 (Farajiamiri et al., 6 Mar 2026).

These evaluation programs change what counts as evidence about a consensus system. Beyond end-task accuracy, the literature measures entropy, majority fraction, cross-model robustness, loop structure, intervention distance, and the auditable linkage between claims and evidence. This suggests that correctness, convergence, and governance must be evaluated together rather than as separate concerns (Wang et al., 20 Apr 2026).

7. Research agenda and design requirements

The most explicit open agenda organizes the problem around nine questions. In perception: Boundary, Sensitivity, and Privacy. In judgment: Aggregation, Conflict, Quorum, and Integrity. In action: Escalation and Accountability. These questions are presented not as optional refinements but as the conditions under which an agentic society can determine what information enters the collective, how disagreement is reconciled, when intervention is triggered, and who is responsible when collective action causes harm (Ko et al., 5 Apr 2026).

Several strands converge on the requirement that consensus mechanisms be governed, typed, and auditable. Proof-derived authorization replaces standing privilege with replayable admissibility artifacts; typed property graphs make structural commitments inspectable; schema-constrained interfaces, least-privilege tool use, immutable telemetry, and simulate-before-actuate safeguards bound what collective decisions can do; and reasoning-layer governance preserves intermediate outputs so that disagreement and uncertainty remain visible (He et al., 13 May 2026, Nowaczyk, 10 Dec 2025, Bandara et al., 25 Dec 2025).

Another recurring requirement is heterogeneity under explicit control. The resilient-consensus results indicate that classical filters can restore agreement when raw LLM interaction does not; the tribalism results argue that homogeneous swarms may stabilize error; and the security literature identifies slow-burn, high-layer attacks as a distributed-systems problem embedded in an adversarial ecosystem. A plausible implication is that resilient agentic consensus will often require heterogeneous evaluators, topology-aware filtering, temporality-aware logging, and governance mechanisms that can escalate, refuse, or re-scope action rather than forcing a brittle “agree or fail” binary (Anand et al., 12 Jun 2026, Shehata et al., 30 Apr 2026, Chu, 25 Apr 2026).

From the control-theoretic side, increasing agency adds time-varying adaptation, endogenous switching, decision-induced delays, and structural reconfiguration of the control pipeline. The prescribed responses are rate limits on adaptation, dwell-time constraints on switching, bounded permissible tool and architecture choices, and formal governance constraints on objective synthesis. In that sense, agentic consensus systems are not merely voting systems with larger models; they are closed-loop socio-technical control systems whose correctness, safety, and legitimacy depend on how collective judgment is represented, bounded, and audited over time (Eslami et al., 11 Mar 2026).