Medusa AHP — The Handoff Protocol

When an AI agent's confidence drops below threshold, it doesn't guess — it packages full context and hands off cleanly to another agent or a human. Zero hallucination, zero data loss.

Comment

Inspiration

Every agentic AI demo shows agents succeeding. None show what happens when they don't.

In production — finance, healthcare, compliance-heavy operations — agents will hit the edge of their competence. Today they have two bad options: hallucinate a confident answer, or fail silently and lose everything the system learned along the way. Neither is acceptable when the downstream decision touches money, medical risk, or regulatory exposure.

We'd already built governance and guardrail systems for agent behavior (rate-limiting, policy enforcement, sandboxing). What was missing wasn't another wall around the agent — it was a protocol for what happens the moment an agent decides it shouldn't proceed alone. That gap is Medusa AHP.

What it does

Medusa AHP ("Le Passeur") is a handoff protocol for multi-agent systems. When an agent's confidence drops below a calibrated threshold — or it hits a competence boundary it wasn't built to cross — it doesn't guess and it doesn't die silently. It packages everything: its context, its full reasoning trace, a calibrated (not self-reported) confidence score, and its attempt history, then hands the task off cleanly to another agent or a human, with zero information loss.

Core guarantees:

Guarantee How
No hallucinated confidence Score is computed from explicit weighted signals (rule engine, model judgment, data completeness) — never a number the LLM invents about itself
No context loss on handoff The receiving agent or human gets the full reasoning trace and facts, not a summary — zero re-execution
No silent failure Every handoff is a structured event with a declared handoff_reason (confidence threshold, competence boundary, policy requires human, tool failure)
No untraceable retries Every payload is hash-chained to the one before it — an auditable trail proving this was a documented handoff, not a loop
No PII leakage between agents Payloads carry pointers (txn://4471) to data, never the raw data itself

It's built for the moment right before an agent would otherwise say something it isn't sure of.

How we built it

The protocol centers on a single artifact: the Handoff Payload, a JSON contract shared between every agent (and human) in the system.

  • Confidence Engine: combines three weighted signals — rule-engine output, model judgment, data completeness — into one calibrated score, with the full breakdown preserved in the payload for auditability.
  • Reasoning trace: every tool call and observation the source agent made before escalating is captured step-by-step, not summarized away.
  • Escalation router: decides target_type (agent or human) and transfer_mode (warm — full context passed, cold — reset, supervised — human sign-off required) based on the declared handoff_reason.
  • Hash chain: each payload's hash is computed over its own content and references the previous payload's hash (prev_hash), producing a lightweight, verifiable audit trail without standing up a full ledger.
  • Two demo scenarios, executed end-to-end in a live terminal: (1) an AML triage agent hands off warmly to a specialist agent when confidence drops below 0.90, (2) a second agent defers to a human reviewer when the decision requires regulatory sign-off — with the second payload cryptographically chained to the first.

We deliberately scoped this as a protocol, not a platform: no database, no deployed infra, no UI dashboard. Every design decision was tested against one question — does this show up in the payload or the demo? If not, it didn't get built for Stage 1.

Challenges we ran into

1. Making "confidence" mean something, not just a number

PROBLEM: An LLM asked "how confident are you?" will answer — and that answer is itself an unverified hallucination. ✅ SOLVED: Confidence is computed externally from three independent signals (rule engine, model judgment, data completeness), each logged separately in the payload. RESULT: A CTO auditing the system can see why the score is 0.71, not just that it is.

2. Avoiding "just another guardrail"

PROBLEM: Our own portfolio already includes governance and firewall-style agent tools — it was easy to drift back into building another blocker. ✅ SOLVED: Reframed the entire design around collaboration and clean failure, not restriction. The protocol never stops an agent from acting within its competence — it only governs what happens at the edge of it. RESULT: A distinct product in a portfolio that already covers the guardrail space.

3. Proving "not a retry" without building a real ledger

PROBLEM: A single handoff looks identical to a routine retry unless you can show provenance. ✅ SOLVED: Lightweight hash-chaining — each payload references the SHA-256 hash of the one before it. Two chained handoffs are enough to demonstrate the pattern without over-engineering a full immutable ledger for a Stage 1 prototype. RESULT: A visibly verifiable audit trail in under 30 lines of code.

Accomplishments that we're proud of

🏆 Protocol design

  1. A payload schema every agent in a system can speak, regardless of which model or framework built it
  2. Calibrated, multi-signal confidence — not a self-reported LLM number
  3. Cryptographic hash-chaining proving handoffs are documented, not silent retries

🚀 Execution discipline

  1. Zero infrastructure theater — no database, no deployment, nothing that doesn't appear in the payload or the demo
  2. Two full end-to-end scenarios (agent→agent, agent→human) running live in a terminal, not mocked screenshots
  3. PII-safe by construction — every payload references data by pointer, never carries it

📊 By the numbers

  • 2 live handoff scenarios, fully chained
  • 3 confidence signals combined per decision
  • 0 hallucinated scores, 0 raw PII in any payload, 0 context lost on handoff

What we learned

The hardest part of building for trustworthy AI isn't stopping agents from doing the wrong thing — it's giving them a dignified way to say "I don't know" that a system can actually act on. Most agent failures aren't caught because the failure mode itself has no standard shape. Once failure has a schema, it becomes something you can audit, route, and improve — instead of something you can only hope doesn't happen.

We also learned that in a hackathon format, restraint is a feature. The instinct is to build the full ledger, the dashboard, the multi-hop escalation cascade. The protocol is stronger for showing exactly two clean handoffs and nothing else.

What's next for Medusa AHP — The Handoff Protocol

  • Full immutable ledger: move from a 2-node hash chain to a verifiable, tamper-evident audit log suitable for regulatory review (AMF, HIPAA, GDPR-adjacent contexts)
  • Real calibration pipeline: replace mocked confidence signals with production logprob calibration against historical outcome data
  • Human review interface: a lightweight dashboard for the supervised transfer mode, replacing the terminal simulation
  • Recursive escalation handling: agent → agent → agent → human cascades, with loop detection and SLA enforcement
  • Vertical deployments: first target verticals are financial compliance (AML/KYC triage) and healthcare intake — both domains where "hand off cleanly" already has a real human process to plug into

Built With

  • agentic-ai
  • ai-governance
  • audit-trail
  • cli
  • compliance
  • confidence-scoring
  • fintech
  • hashlib
  • human-in-the-loop
  • json
  • llm
  • multi-agent-systems
  • python
  • rich
  • sha256
Share this project:

Updates