One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

• URL: http://arxiv.org/abs/2608.18360v1
• Date: Tue, 18 Aug 2026 22:24:44 GMT
• Title: One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI
• Abstract summary: We show that a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment.<n>We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting.<n>This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Agentic AI systems take consequential actions governed by more than one pre-action control at once: authority, resource, and evidence gates that can admit, degrade, or remediate an action before it executes. This paper's central object is remediation-induced control coupling: a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment. We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting under its stated assumptions. We further show that the two implemented remediation operators (evidence substitution and resource-budget downroute) do not commute -- a finite-model checker finds concrete counterexample instances -- making remediation order part of the control-plane semantics rather than an implementation detail. A governed evidence buffer that trusts its own most recent admitted write is a further instance of the same problem at the level of state -- current admissibility does not imply future reference trustworthiness -- and is vulnerable to poisoning from declared-uncovered defect classes; two mitigations reduce, not eliminate, that exposure. Supporting results establish the exact condition under which positive-weight linear aggregation of gate outcomes can compensate a member veto, a unified cross-control Evidence Set, and that composition manufactures no new detection coverage, reported honestly. Empirically, on a deterministic open-data artifact composing three published engines unmodified, CH1-CH5 meet their registered decision rules across all 30 pre-registered seeds; CH6 does so under W1 but not under the smaller W2 workflow, reported as such. This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.

Related papers

• Cognitive Admission Control: Risk-Conditioned Assurance for Consequential Actions in Agentic Distributed Systems [2.124730017640531]
  In agentic distributed systems, an agent may be authorized to mutate external infrastructure while lacking evidence that the mutation is ready to execute.<n> Cognitive Admission Control (CAC) makes this evidence requirement explicit.<n>A policy maps a typed action and its modeled risk to assurance obligations specifying predicates, evidence classes, scope, freshness, and witness-set constraints.<n>A successful admission produces a certificate binding the action, its witness manifest, and dispatch-time guards.
  arXiv  Detail & Related papers  (2026-09-14T20:20:54Z)
• HANSARD: A Reference Architecture for Forensic Readiness, Runtime Witnessing, and Graded Attribution in Autonomous Multi-Agent AI Systems [3.7015952547586832]
  An autonomous multi-agent system nowadays act in finance, software supply chains, and security operations.<n>No method can robustly establish what happened, what caused it, or who is accountable.<n>This is because provenance forensics works at the wrong abstraction, formal causality assumes the causal model, and agent auditing trusts self-recording.<n>The target failure mode is, thus, attribution laundering, spreading an act across redundant agents until none is a but-for cause.<n>This paper proposes HANSARD, a reference architecture treating accountability as a life-cycle property.
  arXiv  Detail & Related papers  (2026-08-23T17:18:22Z)
• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• From Trajectories to Evidence: Auditable Experimental Records for Industrial Research Agents [47.678562263387214]
  Research agents increasingly conduct multi-round machine-learning experiments in industrial recommendation settings.<n>Yet a completed trajectory is not automatically evidence: generated artifacts may be unsupported or incomplete, executed rounds may be invalid or confounded, and later modifications may obscure earlier findings.<n>We introduce an evidence-grounded framework that couples bounded verification of consequential artifacts with post-execution claim qualification.
  arXiv  Detail & Related papers  (2026-08-05T13:37:38Z)
• The SIGReg Objective as Variational Free Energy: A Theoretical Active-Inference Account of JEPA World Models [47.471225029744424]
  Joint-Embedding Predictive Architectures (JEPAs) are the dominant design for latent world models.<n>We show that the choice of anti-collapse regulariser determines whether a JEPA's training objective, a prediction loss plus a weighted embedding regulariser, is a valid Active Inference (AIF) variational free energy.
  arXiv  Detail & Related papers  (2026-07-15T08:59:36Z)
• ECO/CPO-DAG: A Contradiction-Based Accountability Layer for Adversarial Supply Chains [0.0]
  ECO/CPO-DAG is a domain-specific accountability protocol for adversarial supply chains.<n>It formalizes contradiction detection as a supplemental validation layer.<n>The protocol's boundary is explicit: it detects provable contradictions, not consistent lies.
  arXiv  Detail & Related papers  (2026-07-07T21:03:26Z)
• Verification of Adaptive Agentic Controllers through Finite Rule Revision [0.0]
  This paper formulates a bounded verification protocol for adaptive agentic controllers represented by finite symbolic rules.<n> diagnostic failures are mapped to predefined rule-level edits, including rule addition, rule deletion, and priority revision.<n> repaired controllers are then evaluated on held-out simulation seeds or cloned initial states.
  arXiv  Detail & Related papers  (2026-07-07T13:38:01Z)
• Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows [0.764671395172401]
  Agentic Transaction Processing treats generated actions as untrusted proposals until they pass deterministic admission under a declared, executable constraint set C.<n>We realize ATP in Mnemosyne, a runtime with an append-only transition log, effective-state projection, dependency-safe compensation, and active commitment records.<n>A reproducible artifact rejects the targeted violations across nine falsification tests while still admitting valid work, at under 6% overhead, and local repair edits an order of magnitude fewer operations than global recompute.
  arXiv  Detail & Related papers  (2026-06-30T23:33:16Z)
• What Accuracy and Gradient Cosine Miss: Evaluating Feedback Alignment via Scale Stability, Reference Validity, and Depth Utility [48.10132234701036]
  We propose a diagnostic evaluation protocol based on three checks -- scale stability, reference validity, and depth utility -- together with per-layer rather than aggregate cosine reporting.<n>Across multiple architectures and methods, our protocol identifies all failures with wide calibration margins.
  arXiv  Detail & Related papers  (2026-06-19T06:04:17Z)
• TAPO: Tool-Aware Policy Optimization via Credit Transfer for Multimodal Search Agents [54.08846865906602]
  We characterize credit misassignment as a systematic failure mode of GRPO in tool-augmented multimodal search agents.<n>We propose Tool-Aware Policy Optimization (TAPO), which exploits the parameter-determinism property of information-acquisition tools.
  arXiv  Detail & Related papers  (2026-06-04T07:15:43Z)
• IMPACT-CYCLE: A Contract-Based Multi-Agent System for Claim-Level Supervisory Correction of Long-Video Semantic Memory [73.22944697933603]
  Existing pipelines produce opaque, end-to-end outputs that expose no intermediate state for inspection.<n>We present IMPACT-Cycle, a supervisory multi-agent system that reformulates long-video understanding as a multimodal iterative claim-level maintenance.
  arXiv  Detail & Related papers  (2026-04-22T03:03:33Z)
• Preregistered Belief Revision Contracts [2.28438857884398]
  We introduce PBRC (Preregistered Belief Revision Contracts), a protocol-level mechanism that separates open communication from admissible change.<n>A PBRC contract publicly fixes first-order evidence triggers, admissible revision operators, a priority rule, and a fallback policy.<n>We show that auditable trigger protocols admit evidential PBRC normal forms that preserve belief trajectories and canonicalized audit traces.
  arXiv  Detail & Related papers  (2026-04-16T22:22:54Z)
• To Throw a Stone with Six Birds: On Agents and Agenthood [0.0]
  Six Birds Theory (SBT) treats macroscopic objects as induced closures rather than primitives.<n>We give a type-correct account of agency within SBT.<n>We operationalize this contract in finite controlled systems using four checkable components.
  arXiv  Detail & Related papers  (2026-02-03T10:46:23Z)
• Preventing the Collapse of Peer Review Requires Verification-First AI [49.995126139461085]
  We propose truth-coupling, i.e. how tightly venue scores track latent scientific truth.<n>We formalize two forces that drive a phase transition toward proxy-sovereign evaluation.
  arXiv  Detail & Related papers  (2026-01-23T17:17:32Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.