The paper introduces a runtime assurance layer for language‑model agents operating in operational workflows, addressing the evaluation–execution gap where approvals may become invalid after changes in facts, evidence, policy, or authority. The proposed state‑bound configuration separates probabilistic measurement from deterministic adjudication, binds execution allowances to the basis of an approval, invalidates them upon logged changes, and rechecks admissibility at dispatch. In a scripted 42‑case replay, the approach identified 15 later‑invalidated approvals that a non‑re‑evaluating comparator missed, holding 14 affected actions before dispatch and compensating one landed effect.
By Jayesh Bhadane, Ramachandra Yerramsetti, Rajesh Gupta, Sumit Kumar
arXiv:2608.21159v1 Announce Type: cross
Abstract: Tool-using AI agents turn delegated tasks into provider effects, yet authorization often ends at admission while provider state, delivery, retry, and...
By Yingzhe Tong, Leyu Dai, Songhui Guo
The paper introduces the concept of Cognitive Serializability for autonomous AI agents, ensuring that mutations derived from dynamic inputs—such as database reads, evidence, policy, beliefs, and delegated authority—are committed in a serial, logically consistent order. It presents a framework called Trusted Cognitive Transaction (TCT) that combines immutable executable definitions, sealed envelopes, guard-first commits, and receipt-driven reconciliation to enforce serializability and prevent anomalies. Experimental results show that the prototype implementation incurs minimal overhead while eliminating injected anomalies.
By Jun He, Deying Yu
CASEL (Consequence-Aware Selective Execution Layer) is a runtime allocation policy for tool‑using language agents that chooses among direct execution, verification, sandboxing, clarification, approval, and abstention for each proposed tool call. It combines calibrated failure probability, state‑dependent consequence, reversibility, ambiguity, and evidence freshness to minimize a per‑mode cost. In controlled simulations, CASEL cuts harmful‑side‑effect trajectories from 14.75 % to 7.02 % and reduces mean normalized harm from 0.184 to 0.123 compared to an uncertainty‑ranked gate.
By Yanyan Zhang, Fei Shen, Ting Yan, Hao Zhang
The paper introduces Probabilistic Agentic Programming (PAP), a framework that explicitly defines responsibility boundaries for language‑model agents by linking mandate, authority, effects, and evidence. It compares PAP to various programming paradigms and agent systems across seven dimensions, and presents a mediation kernel that enforces checks before tool execution, operation‑bound approval, and resource limits. An exploratory study with seven business cases and multiple models demonstrates that PAP’s native Touba implementation achieves the highest or tied observation counts, supporting its effectiveness in managing agentic behavior.
By Khadim Lo, Soukaina Alaoui Ismaili, Jean-S\'{e}bastien Dessureault
arXiv:2606. 08021v1 Announce Type: cross Abstract: As large language model (LLM) agents are integrated into autonomous cloud operations, distributed systems face a semantic reliability problem: proposer agents can generate production mutations, such as modifying IAM policies, opening firewall security groups, or executing data exports, that are syntactically valid and statically authorized but operationally unsafe.
By Jun He, Deying Yu
arXiv:2608. 04289v1 Announce Type: new Abstract: Long-horizon agents increasingly use persistent memory and tools to take actions with external side effects.
By Mayur Akewar, Ravi Ranjan
The paper introduces NAQD‑Env, a synthetic benchmark designed to test language agents’ ability to selectively withdraw and resume actions when new evidence, permissions, or stop instructions arise. It evaluates models against a deterministic reference policy across eleven dependency families, measuring policy agreement, task value, withdrawal, resumption, and event reporting. Experiments on 350 scenarios show low withdrawal recall, no valid resumption, and limited policy alignment, highlighting the need to treat selective withdrawal as a distinct reliability component.
By Mohamed Abouzahra
The paper introduces Runtime Assurance Contracts (RAC) as a formal policy framework for high‑risk AI agents, addressing the "assurance‑transition gap" by binding autonomy boundaries, component eligibility, evidence state, transition policy, human‑review capacity, and non‑compensatory gates. RAC allows soft metrics to influence routing while mandating retries, switches, escalations, deferrals, or stops when mandatory gates fail or are unknown, ensuring aggregate performance cannot alone authorize action. The authors define the contract, evidence record, permission rule, and five invariants, and evaluate RAC through deterministic failure‑injection studies, hand‑authored traces, and a prospective synthetic holdout, comparing it to score‑only and restricted protocol baselines.
By Serhii Zabolotnii
The paper introduces a self‑healing harness that enforces admission control over language‑model agents’ self‑modifications. The harness runs a Detect‑Notice‑Heal‑Validate loop, allowing agents to propose rule changes that are only granted persistent authority after demonstrating improvement on a failure case without regressing on protected cases. Across 16 benchmark runs, the harness rejected many locally beneficial proposals that caused collateral regressions, while improving task‑completion scores and reliability.
By Sina Tayebati, Divake Kumar, Nastaran Darabi, Ranganath Krishnan, Amit Ranjan Trivedi
arXiv:2606. 02965v2 Announce Type: replace Abstract: As large language models gain tool access and are deployed as autonomous agents capable of editing records, executing transactions, and modifying infrastructure, we still evaluate them based on the sole metric of task completion.
By Victor Ojewale, Suresh Venkatasubramanian
arXiv:2606. 02965v1 Announce Type: new Abstract: Benchmarks for autonomous agents measure whether agents complete tasks, yet this framing is systematically blind to whether an agent should have proceeded at all.
By Victor Ojewale, Suresh Venkatasubramanian