Agentic safety reflexes based on Sequential Learning to Defer (SL2D) methods to prevent catastrophic irreversible actions by autonomous agents. Application context: multi-agent systems in Finance, Supply-chain, Health & Safety and Cybersecurity enterprise domains, with potential generalisation to other domains. This is a living systematic review to PRISMA-S standards.
Enterprise AI is moving from conversational assistants to autonomous multi-agent swarms with direct write-access to forklifts, freight routes, treasury accounts and network endpoints. Each agent is individually competent. The risk lies in their combination: dozens of agents acting on partial views of shared state, issuing tool calls that touch the same aisles, ledgers and network segments within seconds of one another. Once a single unsafe call can move a two-tonne vehicle, release funds or isolate a production server, the binding constraint on deployment is no longer reasoning quality but deterministic, millisecond-level safety.
PreCog is a 24-week MSc research programme (University of Bath, Bristol homelab) that builds and evaluates a two-tier safety layer for exactly this setting. A Fast Path, a non-generative Hyperbolic Graph-JEPA world model compiled to TensorRT on NVIDIA Jetson, scores each proposed tool call against a 3-hop multi-agent sub-graph streamed from a central TigerGraph cluster and halts the action when predicted latent divergence crosses a deferral threshold. That threshold tightens automatically as wireless jitter consumes the time left before the action becomes irreversible. Only after the hazard is frozen does a Slow Path, a quantised edge language model, produce a three-bullet situation-awareness brief for the human supervisor.
The design rests on one claim: that stopping a hazard and explaining it to a person are different problems on different timescales, and should be engineered as separate, co-designed tiers. The machine tier must be stateful over the multi-agent graph and fast enough to act inside the irreversibility window. The human tier must activate only once the world is stable, and deliver structured understanding rather than raw telemetry. Deferral never happens during an active emergency; the supervisor reviews a paused snapshot, not a falling knife.
Conventional guardrails and standard learning-to-defer fail in live multi-agent industrial settings for six reasons. The first two are fatal on their own; the other four each independently get a safety layer switched off in production.
Using a language model as a token-generating safety evaluator costs 50–300 ms+ per decision on real hardware and networks, beyond the reaction budget of most physical hazards and many transactional ones.
Per-call evaluators judge each input in isolation. Enterprise catastrophes emerge from compounding interactions across agents, so an evaluator can approve every individual step of a disaster.
L2D treats the cost of deferring as constant. In practice it depends on how much time remains before irreversibility and how long the safety signal takes to arrive; a threshold tuned at one point is wrong at every other.
Guardrails live where the state is, so every decision crosses a wireless round trip. The component with the most context is furthest from the actuator, and a dropped packet silently becomes a permit.
When guardrails do fire they stop at coarse granularity and report only that a policy tripped. Operators cannot learn from it, throughput loss is disproportionate, and the layer gets tuned down.
L2D assumes a competent, available expert. In a live multi-agent system the expert is out of the loop, under time pressure, and shown unexplained state; deferring to them in-window is not a safe fallback, it is a different failure mode. How RQ3 addresses this →