A customer-facing multi-agent concierge can read email, call booking tools, and generate replies. Red-team tests show jailbreak text sometimes reaches tools, tool responses sometimes contain competitor-injected spam, and final replies sometimes leak internal system instructions. Which guardrail strategy best matches a multi-intervention design?
Select an answer to reveal the explanation.
Short Explanation
The correct answer is C. Multi-agent risk shows up at every hop: nasty user text, bad tool arguments, poisoned tool results, and leaky finals. You need complementary guardrails at input, tool call, tool response, and output—not one last filter and a prayer. Model refusals alone are not a control plane. Going offline just abandons the product.
Full Explanation
Option C is correct. Secure multi-agent design calls for multi-intervention guardrails covering user inputs, tool calls, tool responses, and outputs, including custom domain constraints. Each stage has different threat patterns (prompt injection, unsafe tool args, untrusted tool content, system-prompt leakage).
Option A is incorrect because output-only filtering misses malicious tool invocations and contaminated tool results that already executed side effects.
Option B is incorrect because built-in model refusals are incomplete, inconsistent under adversarial pressure, and lack auditable policy controls.
Option D is incorrect because removing connectivity avoids some tool risks but fails product requirements and is not a guardrail strategy for a tool-using concierge.