Before you add another agent, freeze the facts

Two agents review the same operating problem and disagree. One recommends action. The other says nothing needs attention.

Before asking which agent is smarter, check whether they saw the same records. If one read the account before an update and the other read it afterward, their disagreement may be about inputs.

Collect a versioned snapshot first, then ask reviewers to interpret that same evidence. Preserve what is missing alongside what is present.

What changed

In an October 7 engineering post, Cloudflare described an agentic security-operations system whose initial reconnaissance uses deterministic code before model inference.

The company says it stores collected evidence with source, version, and timestamp. Specialist agents analyze the admitted evidence, and a synthesis agent combines typed findings without fetching new evidence.

That is Cloudflare’s account of its security workflow. It does not establish that the design will improve every business process. The useful pattern to test is the separation between collecting facts and interpreting them.

Give disagreement a fair starting point

Imagine a hypothetical review of overdue customer requests. One reviewer checks whether follow-up is needed. Another checks whether the customer already received an answer.

If each reviewer fetches records independently, one might miss a recent reply, use a different time window, or stop after the first page of results. Their recommendations can sound like a reasoning dispute while the underlying record sets differ.

Instead, prepare one packet: the request IDs, allowed conversation history, relevant status changes, reporting window, and collection time. Include which sources were unavailable and whether any result was incomplete.

The reviewers can now disagree about interpretation while sharing a visible starting point.

A snapshot is a record of scope

“Frozen facts” does not mean the business stops changing. It means this review refers to a specific collected state.

A useful packet has a snapshot ID, a clear subject, stable record identifiers, timestamps, and known gaps. Store the evidence required for the review under the access rules that already apply to it.

If more evidence arrives, create a new version or explicitly append it with provenance. Do not silently alter the original packet and then pretend two reviews used identical inputs.

For a small workflow, a structured record or a simple saved report may be enough. The point is inspectability, not an elaborate storage architecture.

Keep each reviewer’s job narrow

For the overdue-request example, one reviewer could identify requests missing a promised follow-up. Another could look for evidence that the customer’s need was already resolved.

Require each finding to name the records supporting it. A combining step should preserve disagreements and missing evidence. It should not manufacture certainty merely because two outputs were requested.

Begin with one reviewer and a straightforward rule-based check where that covers the job. Add another agent only when a distinct review question earns the cost and complexity.

Run a replay test

Use a sanitized historical packet containing a normal case, a resolved case, and an intentionally missing source. Write down the expected handling before running the review.

Run the same review twice against the unchanged packet. Compare supported findings, unresolved cases, execution cost, and human correction time. Then add one clearly identified piece of evidence as a new version and inspect what changes.

A useful result is that the team can explain whether a changed conclusion came from new evidence or a different interpretation. Also check that the missing source stays visible in both runs.

This is a proposed experiment. Repeated agreement alone does not prove the reviewers are right; compare their findings with an independently checked answer set.

Separate the review from the action

A snapshot suitable for analysis can become stale before an action is taken. If the recommendation would change a live customer record, recheck the relevant state and authorization before acting.

The original snapshot remains the explanation for the recommendation. The fresh check establishes whether that recommendation still applies.

This boundary lets an operator understand a decision without assuming that yesterday’s evidence is permission to act today.

Start with one messy recurring review

Choose a review your team repeats and define its evidence packet before adding more agents. Make the reporting window, record scope, and missing inputs visible.

For the longer-term role of retained operating context, read Your Company Needs Memory. This article focuses on the smaller unit: a replayable packet for one decision.

Source and scope

Cloudflare: Building an evidence-grounded agentic security operations harness, October 7, 2026. Architecture details are vendor-reported. The overdue-request review is illustrative; no Xovion production result, automatic integration, or customer data is presented.