Multi-agent LLM systems delegate through natural language, creating trust boundaries that single-agent safety hierarchies were not designed to preserve. We identify provenance erasure as a multi-agent safety failure mechanism: even in the minimal two-agent case, delegation strips trust metadata—98% of format markers, 100% of authority entities, and 44% of source attribution across 460 pairs—while often preserving the actionable payload. This lossy transform enables Trust Cascade, amplifying system-channel attacks from 0% to 33–63% cascade ASR across eight open-weight models; a delegation-as-user control isolates channel trust escalation rather than content reformulation. Because the failure occurs at the delegation boundary, we propose the Trust Boundary Auditor (TBA), a zero-inference provenance diagnostic achieving 86–100% conditional detection with 0% false positives across four domains. Training, scale, and closed-source evaluations show that stronger models can interrupt different cascade stages but do not remove the boundary problem, suggesting that multi-agent safety requires delegation gating plus provenance auditing.