A multi-agent system uses specialized sub-agents for different domains (medical, legal, financial). The orchestrator receives user queries, classifies them by domain, and routes to the appropriate specialist. A security audit reveals that a malicious user could craft a query that appears to be a medical question but contains embedded financial instructions designed to manipulate the financial agent if the orchestrator misclassifies it. What architectural control mitigates this?

C is correct because defense-in-depth for routing attacks requires that each specialist agent independently validates that the query it receives belongs to its domain. Even if the orchestrator misclassifies a crafted query, the financial agent refusing to process a query it determines is not a financial question provides a second line of defense. The classification-mismatch signal back to the orchestrator also creates an anomaly detection signal. A is wrong because higher classification accuracy reduces the probability of misrouting but does not eliminate it — the attack surface is never zero, and a purely accuracy-based defense is not defense-in-depth. B is wrong because encryption protects message confidentiality in transit; it does not prevent a user from crafting a query whose content is designed to exploit domain routing — the user constructs the query before encryption. D is wrong because rate limiting slows an attacker but does not prevent a well-crafted single query from achieving misrouting — many attacks require only one successful attempt.