CLSOM: Closed-Loop Security Orchestration for Multi-Agent Systems with Trust Scoring, Policy Adaptation, and Runtime Evaluation

Abstract

Multi-agent systems (MAS) require runtime security mechanisms that continue after authentication and connect detection to enforcement. Existing deployments often treat telemetry collection, anomaly detection, trust scoring, and policy enforcement as separate functions, increasing response delay and leaving thresholds manually managed. This paper presents the Closed-Loop Security Orchestration Model (CLSOM), an implementation-oriented architecture that links telemetry, trust-state updates, adaptive policy decisions, peer meta-agent coordination, and enforcement actions. CLSOM specifies a telemetry data model, trust update rule, feature-computation procedure, graduated enforcement semantics, coordination algorithm, deployment mappings, and runtime overhead analysis. We evaluate CLSOM on simulated MAS workloads with 50–500 agents under impersonation, behavior manipulation, collusion, and gradualdrift attacks. In detection-only replay, CLSOM achieves an F1 score of 0.89, compared with 0.78, 0.75, and 0.70 for IDS-only, trust-only, and static-policy variants, and 0.81 and 0.80 for risk-adaptive access-control and SOAR-style response comparators. In closed-loop runs, CLSOM reports 79% attack reduction, 119 ms mean post-window processing latency in the single-process simulator, and 7–31% monitoring overhead. Containment metrics, false-actuation rates, per-attack confidence intervals, adaptive-adversary stress tests, and meta-agent failure cases are also reported. The results show that coupling trust adaptation and policy actuation can improve simulated MAS security response, while further testbed validation is needed for deployment claims.