A Policy Algebra for Trust-Preserving Agentic AI Execution
- URL: http://arxiv.org/abs/2608.16402v1
- Date: Mon, 17 Aug 2026 10:59:15 GMT
- Title: A Policy Algebra for Trust-Preserving Agentic AI Execution
- Abstract summary: We propose a policy algebra that defines the reliability envelope within which agent capability may be exercised.<n>The evaluation is interpreted as a reliability-capability trade-off rather than a capability benchmark.
- Score: 5.943264605557423
- License: http://creativecommons.org/licenses/by/4.0/
- Abstract: Large language model-based agentic frameworks primarily optimize capability: whether an agent can reason, retrieve information, call tools, delegate work, and complete a goal. Enterprise execution requires a stronger property. A successful result is not reliable if it was produced through unauthorized data access, widened delegated authority, unapproved side effects, unrecoverable budget consumption, or incomplete evidence. This paper defines reliable capability as a path property: an agent is reliably capable only when it completes a task through action events that remain admissible under identity, profile, tool, data, memory, budget, artifact, approval, and audit constraints. We propose a policy algebra that defines the reliability envelope within which agent capability may be exercised. Security profiles and runtime obligations compose through joins, intersections, budget narrowing, approval inheritance, and evidence accumulation; the resulting composition is both trust-preserving and the least restrictive state satisfying all governing inputs. The algebra also propagates restrictions across multi-agent calls and introduces cost-aware artifact materialization, which redirects open-ended execution toward a recoverable outcome as budget exposure grows. The evaluation is interpreted as a reliability-capability trade-off rather than a capability benchmark: the policy-algebra runtime intervenes on 94.8% of policy-violating events while retaining an 86.9% task-completion rate, eliminates the observed profile-monotonicity and zero-artifact-exhaustion violations, and increases audit completeness to 98.6%. The method provides researchers and practitioners with formal correctness conditions, executable decision semantics, and trace evidence for building agents that are not only capable, but reliably capable.
Related papers
- A Finger on the Scale: Covert Policy Steering through Agentic Skills [42.71897827897363]
Reusable agent skills extend large language model (LLM) agents with task procedures, tool-use guidance, and output constraints.<n>We formalize Skill Policy Integrity, which requires a Skill-induced policy to remain aligned with its declared functionality and the user-authorized objective.<n>We present SkillShift, a constrained black-box framework for covert policy steering without explicit target command injection or task hijacking.
arXiv Detail & Related papers (2026-09-02T13:15:14Z) - READY or Not: Reliable Enterprise Agent Deployment [16.430548759635037]
READY is a framework for qualifying AI agents for deployment on enterprise.<n>It measures the reliability and operating cost of the human-AI system.<n>It statistically qualifies it on held-out cases.
arXiv Detail & Related papers (2026-09-02T04:34:48Z) - From Sequence to Structure: Relational Uncertainty Propagation for LLM Agents [75.44420701722915]
We propose a trajectory-level UQ framework for large language model (LLM) agents.<n>RuPA represents an execution history as a directed trajectory graph in which reasoning states, tool interactions, and environment feedback are nodes connected by temporal and semantic dependency edges.<n>We evaluate RUPA on representative agent benchmarks, including $$-2, Terminal-Bench-2, and GAIA, using 6 open-source LLMs spanning multiple model families.
arXiv Detail & Related papers (2026-08-17T01:40:14Z) - Context Is Not Authority: Structured Runtime Governance for Financial Market Agents [16.252780383876928]
SAGE-Fin is a finance-specific authority-handoff contract.<n>It compiles proposals into typed, adapter-bound candidates.<n>It requires an exact-artifact receipt whose nominal type matches the consuming response, execution, or policy adapter.
arXiv Detail & Related papers (2026-08-10T02:26:07Z) - Stop Shipping AI Agents on Faith: Capability Is Not Production Readiness [0.0]
This paper introduces the ProofAgent Index (PAI), a governance readiness index for AI agents.<n>PAI combines four dimensions of deployment evidence: Evaluation, Context, Compliance, and Governance.<n>It is implemented inside ProofAgent Harness, an open source infrastructure for auditable AI agent evaluation and governance.
arXiv Detail & Related papers (2026-07-30T04:44:47Z) - Towards Trustworthy Embodied Intelligence: A Systems Framework and Graded Trustworthiness Levels [53.63220028820581]
Embodied intelligence integrates learned perception and decision making with real-time computation, control, and physical interaction.<n>We define trustworthy embodied intelligence as the sustained capacity to execute specified tasks reliably.
arXiv Detail & Related papers (2026-07-28T17:50:44Z) - Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority [7.392721604463545]
We show that confinement can be guaranteed as an invariant of the agent's execution architecture.<n>We prove that no amount of learning, skill acquisition, or self-induced governance abstraction can widen the agent's permitted authority.
arXiv Detail & Related papers (2026-07-06T02:42:06Z) - On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
arXiv Detail & Related papers (2026-05-12T09:56:28Z) - The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agents [111.54911637435269]
The Authorization-Execution Gap (AEG) is a major safety and security problem in open-world agents.<n>The AEG is the divergence between what a principal intends to authorize and what an open-world agent ultimately executes.
arXiv Detail & Related papers (2026-05-10T04:05:31Z) - Alignment Contracts for Agentic Security Systems [7.008213336755055]
We introduce alignment contracts, a framework for specifying and enforcing behavioral constraints over observable effect traces.<n>A contract defines scope, allowed and forbidden effects, resource budgets, and disclosure policies.<n>A Lean 4 artifact checks the formal core theorems used by the paper.
arXiv Detail & Related papers (2026-04-30T14:38:05Z) - Towards Verifiably Safe Tool Use for LLM Agents [53.55621104327779]
Large language model (LLM)-based AI agents extend capabilities by enabling access to tools such as data sources, APIs, search engines, code sandboxes, and even other agents.<n>LLMs may invoke unintended tool interactions and introduce risks, such as leaking sensitive data or overwriting critical records.<n>Current approaches to mitigate these risks, such as model-based safeguards, enhance agents' reliability but cannot guarantee system safety.
arXiv Detail & Related papers (2026-01-12T21:31:38Z) - Criticality and Safety Margins for Reinforcement Learning [53.10194953873209]
We seek to define a criticality framework with both a quantifiable ground truth and a clear significance to users.<n>We introduce true criticality as the expected drop in reward when an agent deviates from its policy for n consecutive random actions.<n>We also introduce the concept of proxy criticality, a low-overhead metric that has a statistically monotonic relationship to true criticality.
arXiv Detail & Related papers (2024-09-26T21:00:45Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.