Deontic Policies for Runtime Governance of Agentic AI Systems

• URL: http://arxiv.org/abs/2606.19464v1
• Date: Wed, 17 Jun 2026 18:02:07 GMT
• Title: Deontic Policies for Runtime Governance of Agentic AI Systems
• Abstract summary: We propose AgenticRei, which realizes key governance requirements such as obligations, dispensations, policy conflict resolutions, and reasoning over policies.<n>Our approach composes naturally with industry-standard frameworks like A2AS.
• Score: 2.1095754823099657
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Autonomous agentic AI systems driven by Large Language Models (LLMs) introduce a new class of security, privacy, and compliance challenges: an agent that can invoke tools, manipulate data, install software, and coordinate with peer agents across organizational boundaries must be constrained not just by authentication and access control, but by the full structure of enterprise governance. This includes specifying what agents are permitted and prohibited from doing, what they areobliged to do after certain actions (e.g., notify the CISO), under what conditions a standing obligation may be waived, and which rules take precedence when policies conflict. This governance problem exceeds what current policy engines provide. Systems such as XACML, Rego, and Cedar address only the permit/prohibit subset of this governance structure. They do not provide obligation lifecycle management, meta-policy conflict resolution, dispensations that waive obligations in specific circumstances, and ontological reasoning over domain class hierarchies commonly found in applications such as healthcare, cybersecurity, or data privacy. We propose AgenticRei, which realizes key governance requirements such as obligations, dispensations, policy conflict resolutions, and reasoning over policies, as well as the basic permit/prohibit constraints. We use a deontic policy language built on the Rei framework, expressed as OWL (Web Ontology Language) and evaluated at runtime by a high-performance logic engine entirely outside the LLM. The same pipeline governs both tool invocations by the agent and agent-to-agent messages. We show through examples that deontic policies capture governance constraints around security and privacy that mostly cannot be expressed in current production engines. Our approach composes naturally with industry-standard frameworks like A2AS.

Related papers

• EMERGE-Policy: A Robot Mind Emerges Beyond a Single Policy [48.898967774856466]
  EMERGE-Policy coordinates both capability invocation and information exchange.<n>Main Agent retains task-level state within an active context window.<n>Role-specific Sub Agents process perception, execution monitoring, verification, and memory consolidation.
  arXiv  Detail & Related papers  (2026-08-30T16:46:06Z)
• Specifying the Delegated-Autonomy Boundary: Requirements Engineering for Agentic AI [5.421928928336395]
  Agentic AI systems plan, maintain state, and act in external environments with varying degrees of autonomy.<n>Current practices bury these decisions inside prompts, tool schemas, and runtime policies, even though they are requirements-level commitments.<n>This paper proposes two complementary artifacts: an Agency Justification Record and an Agentic Delegation Policy.
  arXiv  Detail & Related papers  (2026-07-19T12:27:39Z)
• Governance by Construction for Generalist Agents [7.48004748585128]
  This demo presents CUGA's policy system, a modular policy-as-code layer that composes with a generalist agent to deliver predictable, auditable, and compliance-aware behavior.<n>We present a governance architecture that enforces policy interventions at every critical stage of execution.
  arXiv  Detail & Related papers  (2026-05-20T08:13:16Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks [46.32011684548212]
  AI agents are vulnerable to indirect prompt injection, in which malicious instructions embedded in untrusted data can trigger dangerous agent actions.<n>This position paper discusses our vision for system-level defenses against indirect prompt injection attacks.
  arXiv  Detail & Related papers  (2026-03-31T17:15:46Z)
• Cryptographic Runtime Governance for Autonomous AI Systems: The Aegis Architecture for Verifiable Policy Enforcement [0.0]
  This paper presents Aegis, a runtime governance architecture for autonomous AI systems.<n>Aegis treats policy and legal constraints as execution conditions rather than advisory principles.
  arXiv  Detail & Related papers  (2026-03-15T04:04:57Z)
• Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw [42.9467373594646]
  This report presents a comprehensive security analysis of the OpenClaw ecosystem.<n>We highlight critical vulnerabilities such as prompt injection-driven Remote Code Execution (RCE), sequential tool attack chains, context amnesia, and supply chain contamination.<n>To address these systemic architectural flaws, we introduce the Full-Lifecycle Agent Security Architecture (FASA)<n>This theoretical defense blueprint advocates for zero-trust agentic execution, dynamic intent verification, and cross-layer reasoning-action correlation.
  arXiv  Detail & Related papers  (2026-03-13T04:33:05Z)
• Policy Cards: Machine-Readable Runtime Governance for Autonomous AI Agents [0.0]
  Policy Cards are a machine-readable, deployment-layer standard for expressing operational, regulatory, and ethical constraints for AI agents.<n>Each Policy Card can be validated automatically, version-controlled, and linked to runtime enforcement or continuous-audit pipelines.
  arXiv  Detail & Related papers  (2025-10-28T12:59:55Z)
• Governance-as-a-Service: A Multi-Agent Framework for AI System Compliance and Policy Enforcement [0.0]
  We introduce Governance-as-a-Service (G): a policy-driven enforcement layer that regulates agent outputs at runtime.<n>G employs declarative rules and a Trust Factor mechanism that scores agents based on compliance and severity of violations.<n>Results show that G reliably blocks or redirects high-risk behaviors while preserving throughput.
  arXiv  Detail & Related papers  (2025-08-26T07:48:55Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• Watermarking Without Standards Is Not AI Governance [46.71493672772134]
  We argue that current implementations risk serving as symbolic compliance rather than delivering effective oversight.<n>We propose a three-layer framework encompassing technical standards, audit infrastructure, and enforcement mechanisms.
  arXiv  Detail & Related papers  (2025-05-27T18:10:04Z)
• Progent: Programmable Privilege Control for LLM Agents [46.31581986508561]
  We introduce Progent, the first privilege control framework to secure Large Language Models agents.<n>Progent enforces security at the tool level by restricting agents to performing tool calls necessary for user tasks while blocking potentially malicious ones.<n>Thanks to our modular design, integrating Progent does not alter agent internals and only requires minimal changes to the existing agent implementation.
  arXiv  Detail & Related papers  (2025-04-16T01:58:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.