Abstract

Enterprise AI agents increasingly split a users request across subagents and merge their results. Each handoff is a point where a requirement can be summarized away, altered by an intermediate agent, rewritten by an indirect prompt injection, or ignored by the merger. We report a preregistered, controlled study with synthetic, exactly scorable tasks that compares three handoff forms. The first is a free-text summary. The second is a structured JSON handoff. The third is a _signed requirement manifest_ : the orchestrator extracts each requirement as a verbatim quote plus a checkable predicate, code signs the canonical JSON with HMAC-SHA256, and the mergers decision is verified by deterministic code rather than an LLM. With Qwen3-8B (1,440 trajectories over five threats), signed manifests cut _unsafe commits_ (decisions that violate an original requirement and are not flagged) under attack from 69.4% to 9.0% (paired difference 60.4 pp, 95% CI [51.4, 69.4]). Excluding in-transit mutation, where rejection is guaranteed by construction, the rates under injection and merger override are 58.4% versus 13.5%. This comes at no net loss of conformant commits relative to structured handoffs (-0.4 pp, [-14.2, 13.3]). Signing is what defeats in-transit tampering: an unsigned manifest committed violations in 79% of mutated runs, the signed one in none (79.2 pp). The price is that tampered runs abstain instead of completing. On identical trajectories, the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms. An oracle manifest removed all remaining unsafe commits: the residual risk (11.2 pp) comes entirely from extraction errors made before signing, mainly preferences extracted as mandatory items and missed requirements. In a second confirmatory family from a different vendor, gpt-oss-20b (432 trajectories at a preregistered cut), H1 was supported (36.1 pp), H2 descriptive ( _<_ 60 pairs) and H3a supported. There, however, the gain came only from tampering resistance: structured handoffs were already safe without an adversary and under injection, and manifest extraction failed in 22% of tasks, costing utility. A preregistered pre-signing injection attack (T5) confirmed this boundary. One adversarial line in the request context raised signed-manifest violations from 14.6% to 37.5% for Qwen3-8B, from 11.1% to 63.9% for gpt-oss-20b and from 8.3% to 75.0% for GPT-5.6-luna. Every such violation came from a manifest that was corrupted before signing, and the signature then authenticated it. Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary. In an exploratory frontier-model subset (GPT-5.6-luna), structured handoffs were already reliable except under tampering, where only the signed manifest prevented violations. The cryptography is standard; the contribution is the separation of loss from tampering and what each defense costs.