Teams hear multi-agent and hear thoroughness.
It is an easy substitution to make, and the results encourage it: Anthropic reports a multi-agent configuration — Claude Opus 4 leading, Claude Sonnet 4 subagents — outperforming single-agent Claude Opus 4 by 90.2% on their internal research eval, and a fan-out design that cut research time on complex queries by as much as 90% [1].
Their own variance analysis tells you what that lift is made of. Across the BrowseComp evaluation [2], Anthropic found three factors explained 95% of performance variance, with token usage alone explaining 80% [1]. What the architecture buys, in their own decomposition, is capacity — more tokens, spent in parallel, across separate context windows. Coverage is a different claim. Coverage asserts what was not missed. No amount of subagent fan-out asserts it, and no enterprise reviewer should accept parallelism as its proxy.
What the architecture actually guarantees
State it precisely, because precision is the whole exercise. The Research system — Claude searching across the web, Google Workspace, and connected integrations [8] — runs an orchestrator-worker pattern: a lead agent analyzes the query, plans, persists that plan to memory against context truncation, spawns specialized subagents that search in parallel with their own context windows and their own interleaved thinking, synthesizes what returns, decides whether to spawn more, and finally hands the assembled findings to a CitationAgent that attributes claims to sources [1]. The pattern itself is one Anthropic had already named and published as a general agentic workflow: an orchestrator that decomposes at runtime, workers that execute, a synthesis step that recombines [3].
The guarantee is compression under parallelism. Subagents act as filters, exploring distinct branches and returning condensed findings, which is exactly why the design works for breadth-first questions that decompose cleanly. Anthropic is disciplined about the boundary and says so plainly: the pattern suits tasks with heavy parallelization, information exceeding a single context window, and many complex tools — and does not suit domains where agents must share context or where dependencies run between them [1]. That scoping statement is a gift to anyone running a design review, and it is the first thing an architect should carry into one.
The property the enterprise means
The enterprise does not want capacity. It wants a research artifact whose completeness, sourcing, and cost a named human can stand behind. That property does not live in the agents. It lives in what surrounds them.
Anthropic’s own hard-won lessons are, read structurally, a specification for that surround. Delegation must be explicit — each subagent needs an objective, an output format, tool and source guidance, and clear task boundaries, or agents duplicate work and leave gaps; their example of three subagents colliding on the semiconductor question is a delegation-contract failure, not a model failure [1]. Effort must be budgeted — they embed scaling rules directly in the prompt, from a single agent with three to ten tool calls for simple fact-finding up to ten-plus subagents for genuinely complex research, precisely because agents judge appropriate effort poorly on their own [1]. Tools must be governed — with heterogeneous MCP servers [4] in the loop, a bad tool description is not a cosmetic defect but a routing failure; their tool-testing agent, rewriting a flawed description iteratively, produced a reported 40% reduction in task completion time for downstream agents [1]. Thinking must be steered — the lead agent’s extended thinking is a controllable scratchpad for planning, and subagents use interleaved thinking to evaluate results between tool calls [1][5].
Every one of those is a control surface. None of them is inside the model. That is the reframe: the primitive is the engine; the property is the control plane.
Where the failures live
The failures worth engineering against are not one failure. They separate cleanly, and each takes a different control.
Vague subtask descriptions produce duplication and coverage gaps [1]. The control is an enforced delegation schema — objective, format, boundaries, sources — validated before spawn, not hoped for in prose.
Early agents spawned fifty subagents for simple queries and searched endlessly for sources that did not exist [1]. The control is a budget: a spend ceiling per query class, enforced outside the prompt, because the prompt is guidance and a budget is a limit.
An agent searching the web for something that only exists in Slack is, in Anthropic’s phrasing, doomed from the start [1]. The control is treating the tool catalogue as a governed asset — descriptions reviewed, purposes distinct, surfaces curated per workload.
This is the one to sit with. Human testers — not the automated evals — caught early agents preferring SEO-optimized content farms over authoritative but lower-ranked sources like academic PDFs [1]. A regulated enterprise inherits that failure mode wholesale, and it is invisible to any check that only asks whether the answer was cited.
Agents are stateful, long-running, and errors compound; Anthropic’s answer is resumption from checkpoint rather than restart, plus deterministic safeguards like retry logic alongside the model’s own adaptation to failing tools [1].
Assurance is evidentiary, not correctness
Here is the load-bearing point, and it follows directly from Anthropic’s own evaluation posture. They observe that multi-agent systems take different valid paths on identical inputs, which is why they abandoned step-conformance testing and grade outcomes instead — an LLM judge scoring factual accuracy, citation accuracy, completeness, source quality, and tool efficiency against a rubric, in a single pass, on a small starting set of about twenty real-usage queries [1].
Read that as an assurance architect. If the same query legitimately produces different trajectories, then re-running the system is not a verification method. You cannot defend the output by reproducing it. The defensible claim was never “the answer is correct” — it is: the system planned against a stated strategy, delegated under a recorded contract, retrieved from sources of stated quality, was judged against a rubric that exists in writing, and can show all of it. Correctness is an outcome. Assurance is a record. The rubric, the judge, the human-eval loop, and the run ledger are the evidence — and the enterprise builds every one of them.
The cost dimension belongs in that record too, not in a separate finance conversation. Anthropic reports agents using roughly 4× the tokens of chat interactions, and multi-agent systems roughly 15×, and states the economic condition explicitly: the task’s value must justify the spend [1]. A control plane that records what a run cost, against which query class, is the artifact that makes that condition auditable rather than aspirational.
What the multi-agent architecture does not do
Named out loud — and most of these Anthropic names first, which is why the list can be this direct.
The CitationAgent attributes claims to sources [1]; attribution is not faithfulness. A citation pass makes a claim traceable, not true.
Parallel branches assert what was explored, never what was missed.
Non-determinism is a design property, not a defect [1] — and it forecloses re-run-as-audit.
Roughly 15× chat token usage is the reported baseline [1]; the ceiling is yours to impose.
Anthropic scopes it away from shared-context and dependency-heavy domains, coding among them [1].
Anthropic monitors decision patterns and interaction structures deliberately without monitoring conversation contents, to preserve user privacy [1] — a posture consistent with their broader privacy-preserving analysis work [6]. That is the right call for a consumer platform. It also means the evidentiary record an enterprise needs for its own workloads is an enterprise build, not an inherited feature.
Small changes to the lead agent can shift subagent behavior unpredictably [1]. Change management here is a system-level concern, not a prompt diff.
Anthropic names the synchronous bottleneck themselves: the lead waits, cannot steer mid-flight, and a single slow subagent stalls the set [1].
The direction of travel
Anthropic signals asynchronous execution as the next step, and names the cost — coordination, state consistency, error propagation across subagents [1]. Their appendix already points at the mitigations: end-state evaluation over turn-by-turn conformance, memory and compression for long-horizon runs, and subagents writing artifacts to a filesystem and passing lightweight references back rather than replaying everything through the coordinator [1]. Their open-source prompt patterns are published for exactly this kind of study [7].
Build the control plane for that world now. Every layer above is harder to retrofit under asynchrony and none of them becomes optional. The mechanisms themselves are also moving underneath the post — interleaved thinking, a beta header in the June 2025 snapshot, is now enabled automatically under adaptive thinking on current models [5]. The lessons hold; the API surface they were written against does not stand still. Verify against live documentation before you encode any of it.
Anthropic built the research engine and published both what it does and where it stops. The engine is not the deliverable. The control plane — delegation contract, effort budget, governed tool surface, rubric-scored eval harness, and the run ledger that records all four — is the artifact your risk committee will actually read, and it is the one nobody is going to hand you.
An enterprise that adopts the architecture and skips the plane has bought capacity and called it assurance.
The pattern’s own logic keeps pointing at one component. Delegation contracts, effort budgets, rubric scores, source grades, resumption checkpoints, cost per run — every control in this reading terminates in a record, and none of them is defensible without one. The ledger has stopped being a byproduct of the system. It is beginning to look like the system of record.
