Structured Authority Injection (SAI) is a protocol that enables persistent human control over large language model (LLM) agents by routing operator corrections through typed, schema‑validated Model Context Protocol (MCP) tool calls and maintaining a ranked authority context in each prompt. It defines three override classes—Constraint, Priority, and Strategy—each with distinct persistence semantics and a strict precedence order enforced via a directed authority channel. Evaluations across nine LLMs and eight scenarios show reduced ambiguous directive interpretation, mitigated authority decay, and lower prompt overhead in the strongest models, though benefits vary by model.
arXiv:2608. 13574v1 Announce Type: new Abstract: LLM agents increasingly operate as execution systems that invoke tools, modify local state, use persistent memory, and interact with external protocols.
The paper introduces the Symbolic Guidance Taxonomy (SGT) to regulate the autonomy of large language model agents in distributed multi‑agent coordination. By providing symbolic guidance—ranging from open‑ended reasoning to fully prescriptive algorithmic steps—the authors find that intermediate levels of autonomy consistently outperform both unguided agents and fully prescriptive specifications. These results suggest that carefully controlling agent autonomy is a crucial design principle for effective LLM‑based coordination.
The paper introduces a hierarchical feedback framework that guides large language models (LLMs) to produce executable plans for cyber‑physical systems (CPSs) from natural language commands. It prompts LLMs to generate both a structured task plan and signal temporal logic (STL) constraints, then uses a sound algorithm to detect contradictions and provide feedback for plan revision. At execution time, diagnostic information from failed control synthesis—such as violated constraints and conflicting component assignments—is fed back to the LLM to enable task replanning, achieving an 87.9% success rate on seven heterogeneous CPS scenarios.
SecureGARD is a dynamic ontology‑guided governance framework designed to secure tool‑using large language model agents. It grounds heterogeneous tool calls in a shared semantic representation, using an executable ontology combined with episode‑level task state to make deterministic ready, waiting, and forbidden decisions. The system evolves its ontology offline from verified training executions, ensuring logical consistency and protecting entailments, and achieves a 0% attack success rate across multiple benchmarks while improving task utility under attack.
arXiv:2604.08567v3 Announce Type: replace Abstract: Large language models (LLMs) and LLM-based agents are increasingly deployed as assistants in planning and decision making, yet most existing system...
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
The paper introduces control‑data flow separation to improve prompt optimization in multi‑agent large language model systems. By representing execution protocols as typed, validated program objects and keeping task‑relevant content as unstructured language, the method prevents prompt edits from corrupting critical routing, formatting, or termination signals. Experiments on synthetic reasoning, collaborative review generation, and insurance rating workflows show that this approach maintains 100% protocol validity while consistently enhancing task performance.
The paper argues that the architecture of multi‑agent large language model (LLM) frameworks, rather than just the intelligence of the underlying models, largely determines system performance. It introduces a taxonomy of architectural dimensions—such as orchestration, memory, planning interfaces, specialization, and communication topology—and presents MAFBench, a unified evaluation suite. An empirical study across nine frameworks, keeping the LLM constant, reveals six design principles and shows that choices like orchestration and communication topology can dramatically affect latency, accuracy, and coordination success.
The paper reviews how large language models have evolved into agents that can influence external environments through tool use, interface operation, delegation, state retention, virtual world inhabitation, and robotic control. It critiques the narrative of a single march toward autonomy, distinguishing model competence from system integration, persistence, and safe authority. The authors find that action-interface expansion is well documented, while robust completion, recovery, authorization, and independent verification remain less proven, and they propose a framework of justified delegation to guide future research.
arXiv:2608. 09857v1 Announce Type: cross Abstract: Advances in advanced artificial intelligence tools have sparked research in robot autonomy, but the development of such systems has largely focused on execution rather than verifying the feasibility actions planning models propose.
arXiv:2604. 14401v2 Announce Type: replace Abstract: Agentic AI systems are becoming commonplace in domains that require long-lived, stateful decision-making in continuously evolving conditions.
ContrAgent is a contract‑based framework that provides symbolic temporal supervision for large language model agents. It records an agent’s tool‑call sequence as a trace of checkable predicates and formalizes desired behaviors with assume‑guarantee contracts expressed in linear temporal logic over finite traces (LTLf). Each contract is compiled into a deterministic finite automaton that both gates actions online and evaluates recorded traces offline, enabling deterministic, reproducible verdicts and significantly lower per‑call latency compared to existing LLM‑judge and rule‑based guardrail baselines.