Production multi-agent systems in 2026 have converged on a handful of patterns — supervisor, pipeline, swarm, hierarchical, plus fan-out and debate as compositional moves. The engineering literature ranks them by throughput and failure tolerance. Here is the same list ranked by what actually matters for a regulated European enterprise: attribution, oversight insertion points, and audit shape.

A coordinator agent decomposes the task, assigns work to specialist agents, and aggregates results. Of all the patterns, this one gives you the cleanest attribution story. Every delegation flows through one point, so the authority chain is naturally linear and loggable, and there is one obvious place to insert human approval for consequential actions — between the supervisor's decision and its execution. The cost is concentration. Operationally, the supervisor is your single point of failure — and legally too, because its judgment sets the quality of everything downstream. When something goes wrong there is exactly one place to look, which is convenient for the audit and uncomfortable for whoever owns the supervisor. Use it when actions are consequential and attribution matters more than throughput. This is the default pattern for anything a regulator will ever ask about.

Agents process work in sequence, each transforming the previous output. For governance, pipelines are a mixed gift: easy to audit, awkward to supervise. The trail is naturally ordered — stage N received X, produced Y — which makes reconstruction straightforward. The catch is error propagation: a defect introduced at stage two is laundered through stages three to five, emerging polished and wrong, and the audit question becomes "which stage introduced it?" Human checkpoints fit naturally between stages, but inserting them everywhere destroys the throughput the pattern was chosen for. Use it for high-volume, well-characterised transformations, and put the single human gate before the irreversible final stage.

Autonomous agents work in parallel with minimal coordination, converging on a result. This is the pattern you will have the hardest time defending in front of a regulator. Attribution fragments by design — no single agent "decided," which means there is no clean answer to the question every incident review and every regulator asks. Oversight insertion points barely exist because there is no chokepoint. July 2's lesson — preserve identity and authorisation through every delegation — is exactly what a swarm gives up unless you engineer identity into each agent from the start. Use swarms for exploration and generation — ideas, hypotheses, search — where outputs are proposals a human or supervisor filters, never for direct consequential action. A swarm that can act on production systems is an accountability vacuum you built on purpose.

Domain clusters, each run by a supervisor, reporting to a top-level coordinator — in practice the only viable shape once you pass a few dozen agents across business domains. Its quiet advantage is that it mirrors how enterprises already govern people: domain supervisors map to domain owners, escalation paths map to management lines, and the accountability question decomposes the way an org chart does. The risk is the seam between levels — responsibility diffusing between the domain supervisor and the top coordinator, the multi-agent version of "I thought head office signed that off." Define which decisions escalate, in writing, exactly as you would for people.

Fan-out (parallel workers on partitioned work, results merged) inherits the supervisor's attribution story if the dispatcher logs the partition. Debate (agents argue positions, a judge decides) is under-used for governance purposes: it manufactures a documented rationale — positions, objections, adjudication — which is the closest thing multi-agent systems have to a self-writing audit memo for consequential recommendations.

The rule that falls out of all four patterns is simple: the more consequential the action, the more decision-making should concentrate into fewer, better-logged points — supervisor and hierarchy. The more exploratory the work, the more you can distribute — swarm and fan-out — provided everything distributed passes through a concentrating gate before it touches the world. Most real systems compose: a supervisor routing to pipelines, a swarm feeding a judge. Compose freely — just remember that your accountability is only as strong as the least attributable path to a consequential action. Map that path, because it is the one the incident review will walk.

Take a composed system any bank will recognise: a client-onboarding assistant. A swarm of research agents sweeps registries and adverse media; a supervisor reads their findings and drafts the risk summary; a pipeline formats the summary, attaches the evidence, and files it to the case system. Now run an incident backwards. A false sanctions association has reached a client's case file, and someone senior wants to know how. The pipeline reconstructs cleanly — every stage logged what it received and what it produced. The supervisor's log shows which finding it accepted and why. Then the trail reaches the swarm, and unless each research agent carried its own identity and recorded its sources, it stops there: eight agents ran, one of them produced the association, and nothing can say which one, from what source, or under whose authority. That gap is the finding — and it was created months earlier, by a topology choice nobody reviewed. The exercise generalises: walk the worst path backwards until the trail breaks. It works on any system you own, and it costs an afternoon.

None of this is speculative — the regulation already assumes it. For high-risk systems, Article 14's human oversight only works if the design leaves somewhere to put a human, and Article 12's logging depends on the trail each pattern makes easy or hard to produce. The agent-governance frameworks converging internationally — Singapore's IMDA framework, NIST's identity work, both covered on July 2 — all assume you can say which agent acted under whose authority. For any agent system that will touch an Annex III domain before December 2027 — the deadline as deferred by the Digital Omnibus — the pattern choice you make this year is the conformity evidence you'll assemble next year.

One line to keep: wherever your least attributable path can reach a consequential action — that is your real exposure.

Next Thursday, Build Lab 2/3: the MCP layer — why the server your agents call tools through is your new security perimeter, and the shared-vs-dedicated decision most enterprises are making by accident.

Until next Thursday, João

OnAbout.AI delivers strategic AI analysis to enterprise technology leaders. European governance lens. Vendor-agnostic. Actionable.

If this landed in your inbox from a forward — subscribe here to get the full picture every week.