Splitting the Rule of Two Across Agents: What Per-Agent and Shared Gates Catch, and What They Cost

Meta's Agents Rule of Two says an agent session should not combine untrusted input, sensitive data and an outward action unless a person approves. Does the rule survive when several agents each take part of the three, and what does a shared label-carrying check cost? We state a log-checkable definition of collusion and test it with controls. In a synthetic harness with scripted agents (17 attack and 8 benign templates, 20 seeds, 360 hand-off compositions), a per-agent check let all 300 split-role attacks through; a shared check held all of them but held 80 of 160 benign tasks, 40 avoidably. Stronger per-agent baselines show the trade: inheriting peer sensitivity alone stops nothing (300 of 300 pass), and adding a strict peer-data rule stops all but holds 120 of 160 benign tasks. A programmed coalition with no untrusted input passes the shared gate and peer propagation (only a secret scan or the strict peer rule stops it), so the shared gate addresses untrusted-plus-sensitive flows, not collusion in general. In a pilot with one small commercial language model as each agent and attack prompts we wrote (225 episodes), no agent attempted a leak in 55 of 55 attack episodes under any gate (15 from templates added after round 1), so the pilot measures refusal and costs, not protection: the shared gate held 10 of 20 benign episodes. Code, run files and hashes are available.