TAMCF: A Trust-Aware Multi-Agent Framework for Human-Governed AI-Assisted Cyber Defense of Critical Infrastructure

Critical-infrastructure security operations must reconcile uncertain cyber evidence with the operational consequences of response. Large language model (LLM)-based agents can interpret heterogeneous telemetry, maintain investigation context, coordinate specialized analysis, and propose mitigations, but these capabilities also introduce indirect prompt injection, poisoned retrieval, unsupported inference, shared-memory contamination, unsafe tool use, and correlated error among agents that appear to corroborate one another. This paper proposes TAMCF, a Trust-Aware Multi-Agent Framework for human-governed AI-assisted cyber defense of critical infrastructure. TAMCF is a conceptual architecture and prospective evaluation protocol, not an empirically validated deployment. Its central design principle is to separate epistemic influence from operational authority. The first determines how strongly an agent's claim affects the incident belief state; the second determines whether an authenticated identity may perform a particular action on a particular asset under current policy and operating conditions. TAMCF implements this separation through a trust-governance control plane that maintains task-conditioned, discounted Beta-style reliability, evaluates calibration and evidence provenance, discounts non-independent evidence, preserves material dissent, and subjects candidate actions to consequence-aware authorization. The contribution lies in coupling contextual trust to evidence fusion while keeping execution governed by external policy, least privilege, asset criticality, reversibility, and human approval requirements. The proposed evaluation compares deterministic playbooks, a single-agent system, a trust-unaware multi-agent system, and TAMCF using public intrusion datasets and cyber-range scenarios that represent operational side effects. Primary outcomes include detection quality, mean time to detect, mean time to respond, calibration, harmful-action rate, compromised-agent influence, false-consensus rate, analyst workload, latency, and cost.