A multi-agent system uses specialized sub-agents for different domains (medical, legal, financial). The orchestrator receives user queries, classifies them by domain, and routes to the appropriate specialist. A security audit reveals that a malicious user could craft a query that appears to be a medical question but contains embedded financial instructions designed to manipulate the financial agent if the orchestrator misclassifies it. What architectural control mitigates this?

The correct control is a re-classification checkpoint inside each specialist agent: before executing its domain task, the specialist independently verifies that the query belongs to its domain and refuses to process queries it determines are misrouted, returning a classification-mismatch signal to the orchestrator. This provides defense-in-depth for routing attacks. Even if the orchestrator misclassifies a crafted query, the financial agent refusing to process a query it determines is not a financial question provides a second line of defense. The classification-mismatch signal back to the orchestrator also creates an anomaly detection signal. Increasing the orchestrator's classification accuracy by adding more domain examples to its prompt is wrong because higher classification accuracy reduces the probability of misrouting but does not eliminate it — the attack surface is never zero, and a purely accuracy-based defense is not defense-in-depth. Encrypting all inter-agent messages is wrong because encryption protects message confidentiality in transit; it does not prevent a user from crafting a query whose content is designed to exploit domain routing — the user constructs the query before encryption. Rate limiting the number of queries per user per hour is wrong because rate limiting slows an attacker but does not prevent a well-crafted single query from achieving misrouting — many attacks require only one successful attempt.