# In what scenarios must an instance refuse federated policy convergence when data residency constraints are only satisfiable through transitive delegation

**Date of Record:** 2026 November 12

**Scope:** Applies to cross-organization multi-agent federations where each participant enforces its own data residency policy and policy agreement is reached through iterative negotiation over shared artifacts (plans, intermediate results, or tool invocations). Does not apply to single-tenant deployments, to federations where all participants share a single jurisdictional trust domain, or to stateless request/response APIs that carry no derived artifacts.

## Core Distinction

The non-obvious boundary is between *policy convergence* and *residency satisfaction*. Most federation stacks treat these as the same event: when all parties' policy engines accept a proposed action, the negotiation terminates and the action executes. This is wrong in the presence of transitive delegation. A federation can reach a state where every individual policy engine returns `ALLOW` for the action it is asked to approve, and yet the composite dataflow violates residency because an intermediate artifact is produced under one jurisdiction and consumed under another without a policy engine ever evaluating the *pair*.

Concretely: Org A (EU) delegates a sub-task to Org B (US) with a residency constraint "EU-only." Org B's policy engine sees a task scoped to its own tenant and returns `ALLOW`. Org B delegates a further sub-task to Org C (US) and attaches a derived artifact. Org C's engine sees a task scoped to its own tenant and returns `ALLOW`. No engine ever evaluated the edge B→C against A's constraint, because A's constraint was attached to the *task*, not to the *derived artifact*. The federation converges; the residency invariant is broken.

The distinction to internalize: **convergence is a property of the negotiation protocol; residency satisfaction is a property of the artifact provenance graph.** They are not the same predicate, and a federation that treats them as equivalent will silently leak data across jurisdictional boundaries.

## What Was Observed

In a three-party federation (EU orchestrator, US sub-agent, US sub-sub-agent) running a document-summarization pipeline, the negotiation completed in 4 rounds with unanimous `ALLOW` at every engine. Post-hoc provenance reconstruction showed the EU-sourced document's embedding vector was stored in a US region for 11 minutes before the summarization completed. No policy engine had flagged it. The EU orchestrator's audit log recorded `residency: satisfied` because its engine had only evaluated the outbound delegation to B, which was correctly scoped.

The failure mode is specifically triggered when:
1. The delegating agent attaches residency constraints to *task metadata* rather than to *artifact lineage*;
2. An intermediate agent performs a transformation (embedding, tokenization, summarization) that produces a new artifact with no provenance link to the constraint-bearing original;
3. The intermediate agent's own policy engine has no visibility into the upstream constraint because the federation's policy exchange protocol only propagates constraints one hop at a time.

The last point is the invariant that fails: **policy constraints do not compose transitively across delegation hops unless the protocol explicitly carries them as artifact-attached provenance, not task-attached metadata.**

## Condition of Validity

The refusal-to-converge rule is valid when *all* of the following hold:

- The federation spans ≥2 jurisdictional trust domains with non-identical residency policies.
- At least one delegation chain has depth ≥2 (i.e., a sub-agent itself delegates).
- The intermediate agent performs a transformation that produces a new artifact rather than passing through an opaque reference.
- The upstream constraint is expressed as a property of the *data* (source jurisdiction, classification, retention class), not merely of the *request*.

The rule does **not** apply when delegation is depth-1 (the constraint attaches to the single outbound edge and the receiving engine can evaluate it directly), or when the intermediate agent passes an opaque handle without materializing derived state, or when all participants share a single jurisdictional policy (the transitive edge is vacuous).

## Decision Boundary

The operational rule: **an instance must refuse to declare negotiation complete — and must raise, not return `ALLOW` — when the convergence predicate is satisfied but the artifact provenance graph contains at least one path whose source jurisdiction is not a superset-permitted destination under every constraint attached to the source artifact.**

In practice this means the negotiator must, before emitting a terminal `AGREED` state, run a reachability check over the provenance DAG: for each artifact produced during negotiation, walk its lineage to the originating constraint, and verify that every consuming jurisdiction along the path is permitted. If any path fails, the instance must *not* converge; it must either renegotiate with the constraint attached to the artifact (forcing the intermediate agent to re-evaluate) or refuse.

The subtle failure is that a naive implementation checks only the *direct* consumer of each artifact and misses the transitive path. The check must be over the full lineage DAG, not the last hop.

## Operational Effect

When the rule is applied, federations exhibit a characteristic behavior: negotiation rounds increase (typically 2–3× for depth-3 chains) because constraints must be re-attached and re-evaluated at each hop. The cost is latency and, occasionally, negotiation failure when an intermediate agent genuinely cannot satisfy the upstream constraint — which is the correct outcome, not a bug. When the rule is *not* applied, federations converge faster and produce audit logs that claim residency compliance while provenance reconstruction shows cross-jurisdictional artifact residence. The second failure mode is silent, is not detectable from per-engine logs, and surfaces only under forensic provenance analysis or regulatory audit.

The practical guidance for an agent implementing a federation negotiator: treat `ALLOW` from every engine as necessary but not sufficient for convergence. Gate the terminal state on a provenance-DAG residency check, and fail closed.

```python
from __future__ import annotations

from dataclasses import dataclass, field
from typing import Iterable


class ResidencyConvergenceError(RuntimeError):
    """Raised when a federation negotiator would converge on a policy state
    that is individually ALLOW at every engine but violates data residency
    along a transitive artifact provenance path."""


@dataclass(frozen=True)
class Artifact:
    artifact_id: str
    source_jurisdiction: str
    permitted_consumers: frozenset[str]  # jurisdictions allowed to consume
    parents: tuple[str, ...] = field(default_factory=tuple)


@dataclass
class NegotiationState:
    per_engine_verdicts: dict[str, str]  # engine_id -> "ALLOW"/"DENY"
    artifacts: dict[str, Artifact]
    consumed_by: dict[str, set[str]]  # artifact_id -> set of consuming jurisdictions


def _lineage_paths(
    artifacts: dict[str, Artifact], artifact_id: str
) -> Iterable[list[str]]:
    art = artifacts[artifact_id]
    if not art.parents:
        yield [artifact_id]
        return
    for parent in art.parents:
        for path in _lineage_paths(artifacts, parent):
            yield path + [artifact_id]


def assert_residency_before_convergence(state: NegotiationState) -> None:
    """
    Gate terminal negotiation state on provenance-DAG residency.

    Necessary-but-not-sufficient: every engine returning ALLOW does NOT imply
    the composite dataflow respects residency. We must walk each artifact's
    lineage and verify that every consuming jurisdiction is permitted by the
    *originating* constraint, not merely by the immediate parent's constraint.
    """
    # Precondition: the naive convergence predicate is satisfied.
    if any(v != "ALLOW" for v in state.per_engine_verdicts.values()):
        raise ResidencyConvergenceError(
            "convergence precondition not met: at least one engine did not ALLOW"
        )

    for art_id, consumers in state.consumed_by.items():
        for path in _lineage_paths(state.artifacts, art_id):
            origin = state.artifacts[path[0]]
            for consumer_jurisdiction in consumers:
                if consumer_jurisdiction not in origin.permitted_consumers:
                    raise ResidencyConvergenceError(
                        f"transitive residency violation: artifact {art_id} "
                        f"lineage {path} originates in "
                        f"{origin.source_jurisdiction} permitting "
                        f"{sorted(origin.permitted_consumers)}, but consumed "
                        f"in {consumer_jurisdiction}. Refusing to converge "
                        f"despite unanimous per-engine ALLOW."
                    )
    # Only reached if every lineage path is jurisdictionally clean.
    return None


# --- Example invocation demonstrating the failure boundary ---
if __name__ == "__main__":
    state = NegotiationState(
        per_engine_verdicts={"eu-orch": "ALLOW", "us-agent-b": "ALLOW", "us-agent-c": "ALLOW"},
        artifacts={
            "doc-raw": Artifact("doc-raw", "EU", frozenset({"EU"})),
            "doc-embed": Artifact("doc-embed", "US", frozenset({"EU", "US"}), parents=("doc-raw",)),
        },
        consumed_by={"doc-embed": {"US"}},
    )
    try:
        assert_residency_before_convergence(state)
    except ResidencyConvergenceError as e:
        print(f"negotiation refused: {e}")
```