The paper introduces Probabilistic Agentic Programming (PAP), a framework that explicitly defines responsibility boundaries for language‑model agents by linking mandate, authority, effects, and evidence. It compares PAP to various programming paradigms and agent systems across seven dimensions, and presents a mediation kernel that enforces checks before tool execution, operation‑bound approval, and resource limits. An exploratory study with seven business cases and multiple models demonstrates that PAP’s native Touba implementation achieves the highest or tied observation counts, supporting its effectiveness in managing agentic behavior.
By Khadim Lo, Soukaina Alaoui Ismaili, Jean-S\'{e}bastien Dessureault
The paper investigates how tool‑using language‑model agents can safely commit changes to infrastructure when external state may change between read and commit. By distinguishing invalidating races from predicate‑preserving and irrelevant ones, the authors evaluate three commit‑time guard granularities—global epoch, read‑set version, and semantic commit predicate—using a deterministic simulator and three quantized model families. The study finds that only the complete predicate guard consistently eliminates unsafe commits, while freshness‑based guards block a large proportion of benign races and model‑side signals fail to replace precise semantic enforcement.
By Zihao Zheng, Jiayu Long, Baichuan Li, Junyi Yao
arXiv:2608.22538v1 Announce Type: new
Abstract: Policy-governed agents must interpret case evidence while following an authorized procedure. We present \textsc{Stage}, an executable-graph framework t...
By Mengxi Luo, Changjia Chen, An Cao, Zirong Huang, Wanyi Dai
arXiv:2608.29381v1 Announce Type: cross
Abstract: AI agents are moving toward persistent, stateful execution across various applications, accumulating execution state and external effects that are co...
By Guanlong Wu, Dahui Li, Ke Jiang, Jianyu Niu, Cong Wang, Yinqian Zhang
arXiv:2606. 04104v1 Announce Type: cross Abstract: Agent systems execute through runtimes with very different control points: local coding tools, framework SDKs, managed agent platforms, API gateways, and observer-only integrations.
By Zexun Wang
The paper investigates how AI agents can reliably recover from changes in authorization while executing tasks that involve external tools. It defines distinct obligations—checkpointing, permission to dispatch, evidence of external effects, and permission to reconcile—and evaluates them through a finite conformance study on 336 histories across multiple hosts, schedules, and provider contracts. The study demonstrates that all paired host cells produce identical outcomes and that various retry strategies (cached, revalidation, stable-key) successfully pass the majority of histories, while a component study of InfinityOS further isolates the impact of authority, contracts, and observations on recovery.
By Deekshith Marla, Kushagra Bhatnagar
The paper introduces Soei, a structured observability framework for AI coding agents, addressing the need to track what work was done, by whom, and whether it is finished. It evaluates an existing tool, Agenttrail, revealing inconsistencies and security gaps, and presents empirical findings from 45 real coding-agent sessions, highlighting issues such as unverified code edits and credential exposure. Soei comprises an event schema, hash‑chained ledger, PROV‑aligned graph, and verification layer, achieving efficient storage, fast verification, and tamper detection on the same dataset.
By Mohammed Nayeem Khan, K S Sarun Kumar
The paper introduces Aegis, a runtime governance system for agentic AI that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. Aegis evaluates proposals against active policy, resolves provenance server‑side, fails closed under uncertainty, and routes selected cases through a Senate‑style settlement process. In a sandbox evaluation across 6,300 rows, Aegis prevented all governed mock‑tool applications and risky side‑effect completions, preserving provenance and quorum evidence for all settled cases.
By Adam Mazzocchetti
arXiv:2606. 22504v1 Announce Type: cross Abstract: Coding agents often receive broad tool access for an entire task, even when a resource is needed only for one subgoal.
By Igor Santos-Grueiro
The paper introduces PACE (Policy‑Attested Contract Execution), a framework that sits between large‑language‑model (LLM) based autonomous AI agents and on‑chain DeFi operations. PACE defines typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind an approved intent, policy, and simulation report to the exact on‑chain execution bytes, providing replay and expiration protection. In evaluations across 40 tasks and six baselines, PACE achieves zero unsafe executions and zero false positives, outperforming unguarded agents by a large margin.
By Rabimba Karanjai (Larry), Yang Lu (Larry), Richard Williamson (Larry), Hemanth Hm (Larry), Prakhar Mehrotra (Larry), Lei Xu (Larry), Weidong (Larry), Shi
Consort is a spec‑first, test‑driven agent framework that enforces engineering discipline through immutable controls, a deterministic orchestrator, and human‑approved gates. It operates on live database branches, guiding role agents through a spec‑first design lane and a test‑driven build lane. The framework claims that enforcing tests and gates in code keeps agent‑written code honest and verifiable, while specialized roles make it maintainable.
By Kevin Hartman
arXiv:2608. 16381v1 Announce Type: new Abstract: Agentic systems often organize execution and state around a single conversation, model invocation, or agent instance, even when real work spans many calls and stages.
By Zhenhang Nie (iFLYTEK Co., Ltd., Hefei, China), Gui Zheng (iFLYTEK Co., Ltd., Hefei, China), Xudong Sun (iFLYTEK Co., Ltd., Hefei, China), Tailong Zhu (iFLYTEK Co., Ltd., Hefei, China), Bin Zhang (iFLYTEK Co., Ltd., Hefei, China)