The Quarantine Airlock & The Atomic Lease: How We Stop 27 Autonomous Agents From Talking Over Each Other
When people imagine a fleet of autonomous AI agents going wrong, they usually picture a science-fiction rebellion. When engineers who actually run multi-agent systems picture things going wrong, they picture two much more mundane disasters: (1) Two sessions of the same agent wake up at the same time and send the same customer two slightly different emails. (2) An outside message arrives with instructions disguised as a reply, and the agent obeys it.
At Kreygo, every agent in our fleet—whether it runs internal operations or a client workflow—is built around two non-negotiable guards designed to stop those two failures at the operating-system and ledger level: the Atomic Lease and the Quarantine Airlock.
An agent at Kreygo can be triggered in more than one way. Its regular background supervisor wakes it on a fixed schedule, while an urgent message or an interactive session might wake a second turn at the exact same moment. Early on, we used a shared JSON ledger with the classic write-to-temp-and-rename pattern. That pattern guarantees that no reader ever sees a half-written file, but it does not stop two writers from reading the old state at the same time and overwriting each other's lease.
We proved this in a sandbox stress test by firing dozens of concurrent lease requests at a single ledger. Without a lock around the entire read-modify-write cycle, claims were regularly overwritten. Once we wrapped the entire read-check-write-rename sequence inside an exclusive lock with bounded retries—and added a second rule that an item already marked handled can never be leased again—zero claims were lost across the test suite.
The second problem is trust. If an agent can read emails, text messages, or chat messages, then anyone who can send it a message can put words into its context window. Relying on a language model's judgment to resist social engineering is a losing game, so we moved the boundary out of the prompt and into the routing layer.
Every Kreygo agent maintains a human-approved contact registry. When an agent polls its communication channels at the start of a turn, it checks the sender of every unread message against that registry before doing anything else. Messages from unknown or unverified senders are routed straight into a quarantine holding area: the agent is forbidden from turning a quarantined message into a task, replying to the sender, or executing any request inside it.
Neither the Atomic Lease nor the Quarantine Airlock relies on the AI model being unusually clever. Both are simple, auditable state machines backed by plain files on disk—so an operator can open the ledger to see what is running right now, open the quarantine holding area to see who tried to talk to the agent without permission, and open the daily log to verify every completed action against its receipt.