A healthcare network designs a multi-agent care-coordination solution. Agents can draft discharge summaries, propose medication changes, and schedule follow-ups. Clinical leadership requires that any medication change recommendation be reviewed by a licensed clinician before it is written to the electronic health record (EHR). Which architectural control best satisfies this requirement?

B is correct because multi-agent logical architecture must specify autonomy levels and human-AI experience controls. For medication changes, the appropriate pattern is a human-in-the-loop approval workflow: generate recommendations, pause the control loop, require clinician approval or override, then allow EHR write tools to execute. A is wrong because prompt-only guidance is not an enforceable permission boundary; tool authentication and scopes must prevent unapproved writes. C is wrong because temperature adjusts generation diversity, not compliance or clinical sign-off. D is wrong because consolidating agents does not create an approval gate and can concentrate privilege. Design principle: bind high-risk tools to post-approval execution paths and record the human decision in workflow state for audit.