A city agent graph shows a low-trust FAQ bot can invoke a high-trust finance agent. What should reviewers map first?

When a city agent graph shows a low-trust FAQ bot can invoke a high-trust finance agent, reviewers should map cross-agent trust boundaries in the municipal multi-agent system first. Multi-agent civic deployments require explicit trust boundaries so low-trust assistants cannot invoke high-impact finance or records agents without mediation, authentication, purpose checks, and often human approval. Mapping who can call whom, with which scopes and data classes, reveals privilege bridges that look like helpful orchestration but function as lateral movement inside the agent graph. Input sanitization routines applied to FAQ bot citizen queries, citizen identity verification steps for finance agent payment requests, and logging retention policies for completed municipal agent sessions do not define those boundaries, as they address data handling and audit trails rather than the authorization and mediation required between trust tiers. Exam questions ask what to map first in such graphs; answer cross-agent trust boundaries, not input sanitization routines applied to FAQ bot citizen queries, since those routines only sanitize data and don't govern cross-agent invocation rights. Caveat: a shared message bus without per-call authorization recreates the same bridge even if individual agent system prompts say they should refuse finance tasks. Operational check: produce a call-graph of agent-to-agent tools, mark trust tiers, and attempt a FAQ-originated finance action to confirm brokers enforce authentication, purpose limitation, and human approval where required.