Judgment Operators: A Composition-Invariant Substrate for Multi-Agent Action Spaces

As large language models (LLMs) are increasingly composed into heterogeneous multi-agent systems, a fundamental reliability challenge emerges: knowledge and governance **fragment** across agents, leading to composition-dependent behaviors and linear scaling of violations. Two empirical observations motivate our approach: internal correction methods (Reflexion, CRITIC, Self-Refine) fail to enforce execution-time constraints deterministically, and filter-based methods (LlamaGuard) sacrifice task utility without repair. We introduce **Judgment Operators (JO)**, a decision-time framework implementing four-way intervention semantics (*Allow, Edit, Escalate, Deny*) via a portable artifact $J=(\mathcal{C},\mathcal{P})$, enabling minimal repair without modifying agent internals. We establish: (1) **composition-invariant enforcement** with constant violation probability, motivated by a necessity lower bound showing no decentralized scheme achieves $O(1)$ violation probability; (2) **sublinear** mistake accumulation via JO-A; and (3) **semantic preservation** for code transformation. Programmatically verifiable constraints provide the formal foundation; empirically, robustness extends beyond this scope (partial mediation 3--5$\times$ better than theoretical worst-case). JO achieves 0\% observed violation rate (vs. 48--68\% baselines), 13.5--20.5\% zero-shot cross-model transfer where few-shot prompting fails, and provides a **portable, auditable, and composable** interface for governance and capability injection in multi-agent LLM systems.

When AI systems combine multiple specialized agents, a fundamental problem emerges: each agent only knows its own judgment criteria, so violations multiply as more agents are added. Current fixes—retraining agents or embedding judgment constraints in prompts—are fragile and don't transfer across systems. We introduce Judgment Operators (JO), a decision-time gateway that intercepts each proposed action before execution and either approves it, repairs it minimally, escalates it for human review, or blocks it. The judgment criteria and past repair examples are stored in a portable artifact that any agent or model can use without retraining. By centralizing judgment at a single checkpoint, violations no longer multiply with agent count. Repair knowledge learned from one model transfers zero-shot to five different AI families, improving task success by 13–20 percentage points where prompt-based approaches fail entirely. This points toward a future where judgment is an explicit, portable artifact—owned and audited by the people deploying AI, not buried inside model weights.