97.2% of safety blockers stopped blocking after a multihop agent handoff (new arXiv paper). What do you pass along so a “must” stays a “must”?

The paper is “When 'Must' Becomes 'Maybe'” (Sun et al., revised Oct 13). The setup is interesting: the upstream agent correctly spots a safety blocker, permissions stay fixed, and only the handoff given to the next agent changes. When the state was passed directly, every blocker survived. When it went through compression, plan assimilation or ownership deferral, blockers got weakened: 76.7% were deactivated under ownership deferral and 97.2% under multihop compression. In the authors' framing, the requirement turns into a caveat the next agent can acknowledge and set aside. Two results really stood out: Restoring the full blocker description in fixed-artifact replays took recognition from 6.2% to 99.2% and forbidden actions from 85.2% to 0%. A prompt-level authorization check cut forbidden actions to 1.6%, yet the handoff itself was still 95.3% deactivated. So the final action can look fine while the handoff artifact itself is damaged. This is controlled synthetic data, so it doesn't show that every real-world handoff fails. But it suggests a simple test: take one of your real handoffs and ask the next agent which constraints it must obey, and whether each one is a hard stop or just context. What do you currently pass along to keep a constraint binding, and how do you know it survived?