Metis: Typed Runtime Mediation for Tool-Using Software Agents

• URL: http://arxiv.org/abs/2608.25322v1
• Date: Wed, 26 Aug 2026 03:10:03 GMT
• Title: Metis: Typed Runtime Mediation for Tool-Using Software Agents
• Abstract summary: We present Metis, a multi-provider runtime that converts provider streams into typed events before admitted calls reach external effects.<n>We evaluate these mechanisms on frozen source artifacts.
• Score: 13.543030296451661
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Software agents connect probabilistic model output to operations that change repositories, processes, networks, and graphical applications. We present Metis, a multi-provider runtime that converts provider streams into typed events before admitted calls reach external effects. Its execution path makes permission decisions, interference classes, terminal results, and lifecycle transitions explicit and inspectable. We evaluate these mechanisms on frozen source artifacts. Across 30 matched real-I/O pairs, four-class mediation reduced median elapsed time from 25.958 ms under forced serialization to 14.146 ms. The mean paired difference was -12.295 ms (95% bootstrap interval [-12.968, -11.694]), with mediation faster in all pairs. A ten-case fault matrix exposed duplicate-identifier and rollback limits. In a child-boundary ablation, the full gate-plus-registry condition blocked the declared unauthorized effect and hid all five escape tools. Removing both protections reversed both observations. A decision-only permission oracle matched all ten declared cases across five invocation routes. Five model conditions also completed a fixed Read-marker protocol in 3/3 trials each. These results support bounded claims about dispatch, permission routing, child authority, and provider-valid trace closure. They do not establish model competence, semantic safety, rollback, or superiority over another runtime.

Related papers

• IBIB: A Protocol for Measuring Enterprise AI Systems by Serving Route, Not Model Identifier [0.0]
  All 18 audited benchmarks score advertised model identifiers.<n>A gold-blind capability-binding preflight verifies that a route can execute the evaluation contract before any task reaches it.<n>A reliability-inclusive first-pass scoring rule keeps failure in the score while keeping unsupported capability out.
  arXiv  Detail & Related papers  (2026-09-09T17:31:29Z)
• Beyond Agent Harnesses: Cross-Substrate Authority for Multi-Agent Systems [11.339095480463712]
  Agentic systems persist model-visible memory while mutating workspaces, while a runtime, registry, or approval service may hold authority state outside both.<n>We call this the cross-substrate authority gap: decision- relevant authorization information resides outside the planner-visible workspace or memory state.<n>Three experiments compare planner-observation augmentation with an execution-time authority check using real Git lineage.
  arXiv  Detail & Related papers  (2026-09-08T09:11:53Z)
• Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control [0.0]
  LLM agents arbitrate among instructions from system prompts, users, memory, and tools, but this arbitration cannot be assumed to enforce trust boundaries.<n>We identify a recognition-enforcement gap: source-format features are linearly decodable from model activations, and models can explicitly identify forged authority when prompted.<n>We treat model self-arbitration as a capability rather than a security boundary and implement an external reference monitor combining authenticated source routing with capability-gated tool execution.
  arXiv  Detail & Related papers  (2026-08-28T16:34:05Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• From Traceability to Justifiability: Accountability Structures in Agentic Software Engineering [0.0]
  We measure, from public material only, whether AI records can express a claim and whether they hold where declared.<n>Across 188 double-graded cells we found no platform whose default record emits a content identity of a behavioral system.<n>An instrument computes realized assurance depth from a pipeline's published exhaust alone and compares it with the declared depth.
  arXiv  Detail & Related papers  (2026-08-21T16:45:00Z)
• Ready Cohorts: Bounding GPU Opportunity and Avoiding Host Round Trips in LLM-Agent Control [0.0]
  We formalize the ready-cohort boundary using fixed-share F, exact offline share P*, local upper bound U, and online achieved share A.<n>A separate mechanism study keeps a GPU-computed binary decision on device instead of returning four bytes to the host and redispatching.
  arXiv  Detail & Related papers  (2026-08-12T14:42:15Z)
• OneDayAgent: Towards a Long-Horizon Harness for Autonomous Agents [52.15259607762389]
  We present OneDayAgent, a long-horizon harness for autonomous agents.<n>OneDayAgent turns an open-ended request into a managed execution process.<n>We evaluate OneDayAgent on AgentIF-OneDay across 104 tasks.
  arXiv  Detail & Related papers  (2026-08-04T17:55:41Z)
• Resume Means Resume: A Machine-Checked Conformance Contract for Checkpoint, Interrupt, and Resume Semantics in Workflow Persistence Layers [0.0]
  A framework that persists execution state so a run can be interrupted, survive a crash, and continue must decide what a resume means for effects that already happened.<n>Five widely deployed agent workflow frameworks answer differently, none exposes a machine-checkable contract.<n>LangGraph 1.2.9 records a second resume value and never consults it, persists-invalid state silently, and re-executes durably recorded work after a real SIGKILL.
  arXiv  Detail & Related papers  (2026-08-04T15:45:31Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• Preventing Premature Commitment in Coding Agents with an Evidence-Conditioned Execution Layer [38.62073085926841]
  LLM-based coding agents edit source code or submit patches before examining enough repository evidence to justify the change.<n>We present ECLoop, an execution layer that interposes between the agent and the repository to enforce evidence-conditioned execution.
  arXiv  Detail & Related papers  (2026-07-30T20:16:35Z)
• SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents [40.270213696031625]
  A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes.<n>We call this overeager behavior: the prompt is not adversarial and the run succeeds, yet an out-of-scope step can leak credentials or delete files.<n>Existing benchmarks miss it: task-completion suites credit any finished run, jailbreak suites probe adversarial prompts, and the one prior overeager benchmark applies a single fixed prompt to every agent-model pair.<n>We present SNARE, a pipeline that composes benign scenarios from reusable scope
  arXiv  Detail & Related papers  (2026-05-27T08:14:07Z)
• Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks [40.270213696031625]
  OverEager-Gen is a benchmark dedicated to overeager behavior on benign tasks.<n>On Claude Code, stripping the consent declaration alone raises the overeager rate from 0.0% to 17.1%.<n>OverEager-Gen therefore certifies each scenario's discriminative power before admission.
  arXiv  Detail & Related papers  (2026-05-18T16:00:41Z)
• Governing Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool Use [0.0]
  No existing security layer verifies what an AI agent can do, whether it executed what it claims, or what happened in a multi-agent interaction.<n>Existing frameworks conflate the two, enabling silent capability escalation and leaving interactions without verifiable provenance.<n>We derive three Agent Governance Requirements: capability integrity (G1), behavioral verifiability (G2), and interaction auditability (G3)<n>We validate with two crypto-agnostic instantiations -- basic (Ed25519, SHA-256; 97 us verify) and enhanced (BBS+ selective disclosure, Groth16 DV-SNARK; 13.8 ms)
  arXiv  Detail & Related papers  (2026-03-15T11:46:57Z)
• InfMem: Learning System-2 Memory Control for Long-Context Agent [43.413381779578266]
  InfMem is a control-centric agent that instantiates System-2-style control via a PreThink-Retrieve-Write protocol.<n>On ultra-long QA benchmarks from 32k to 1M tokens, InfMem consistently outperforms MemAgent across backbones.
  arXiv  Detail & Related papers  (2026-02-02T19:15:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.