Trust and Identity

Abstract

Core Motivation: Latency Asymmetry and Non-Separable Exposure Current autonomous agent safeguards rely on perimeter policies evaluated at the API dispatch boundary. This approach fails structurally: The Latency Gap: The interval between internal intent formation and external action serialisation is approximately 200 ms, whereas human operator orientation requires hundreds of seconds. Post-hoc human review is forensic rather than preventive. Local Predicate Failure: Multi-agent exposure is superadditive across sequences of individually permitted calls. We formally prove that no local predicate evaluated on single actions can bound an exposure functional that is not additively separable across those actions (Proposition 1). The Automated Metacognitive Protocol (AMP) AMP shifts runtime enforcement from the network boundary directly into the inference path: Non-Differentiable Shadow Taps: Residual-stream activations are tapped across selected layers with an enforced stopgrad boundary, introducing zero gradient pressure to optimize around the monitor (Assumption A1). Permission Manifold Scoring: Hidden states are projected via low-rank audit operators ($k = 32, d = 8192$) and evaluated against an approved operating envelope using Mahalanobis distance with Ledoit-Wolf shrinkage for covariance estimation. Dual-Path Temporal Filtering: Divergence is evaluated using an Exponentially Weighted Moving Average (EWMA) for acute spikes and a one-sided CUSUM statistic to catch sub-threshold, incremental drift attacks. Pre-Actuation State Dissolution: Upon threshold breach, the architecture applies a scheduled orthogonal subspace projection to recursively remove the unaligned direction across downstream layers until the intent magnitude reaches a zero-weight vacancy threshold (Proposition 4). Unlike boundary blocking, which preserves unaligned intent in context to drive re-planning and rebound dynamics, it structurally eliminates representational support before token serialisation. Intelligence-Invariant Hardware Floor: Actuation lines pass through a normally-open physical relay held closed by a signed, high-frequency enclave heartbeat. Power or heartbeat loss drops the rail into a safe state invariant to counterparty reasoning capability (Proposition 5). Computational and Latency Budget Analytical derivation across twelve tapped layers yields an audit cost of approximately 6.6 MFLOP per token. On dedicated audit silicon, this results in an analytical budget of under 20 µs end-to-end, maintaining an operational margin of $10^4$ within the 200 ms action boundary. Design Lineage and Empirical Scope Functional Phenomenology (Section 1.4): The four load-bearing priors—non-interfering observation (satipaṭṭhāna), triadic failure roots (lobha, dosa, moha), pre-manifestation state removal (samuccheda vs. vikkhambhana), and structural vacancy (anattā)—are adapted from the Pali Canon strictly as functional systems phenomenology and structural engineering priors. All properties stand independently on control-theoretic and linear-algebraic formulations. Validation Status: The paper presents an architectural specification with analytical guarantees. Section 8.5 explicitly outlines nine falsifiable empirical quantities, including audit-space separability, false-positive rates on benign traffic, and rebound coefficients reserved for future experimental benchmark validation

Bullet Summary

• The paper addresses the inherent latency and exposure gaps in current autonomous multi-agent system safeguards, which rely on perimeter policies insufficient for preventive control.
• It formally demonstrates that local predicates checked on single actions cannot capture risks arising from sequences of individually permitted actions due to non-additive exposure in multi-agent contexts (Proposition 1).
• Introduces the Automated Metacognitive Protocol (AMP), shifting runtime security enforcement inside the inference path rather than at boundary APIs, enabling sub-millisecond detection and mitigation.
• Implements non-differentiable shadow taps on residual stream activations with stop-gradient boundaries to monitor internal states without influencing model training (Assumption A1).
• Utilizes low-rank audit operators to project hidden states into a permission manifold, employing Mahalanobis distance with Ledoit-Wolf shrinkage to detect deviations from approved operating envelopes.

Abstract

Abstract The rapid deployment of artificial intelligence, autonomous agents, cloud services, cross-border digital platforms, and globally distributed computing infrastructure is creating a growing technical problem: personal, organizational, transactional, and machine-generated data may be processed, correlated, transferred, or acted upon across multiple services and jurisdictions long after the original authentication, consent, purpose, or access decision was established. This concern is particularly significant in Europe, where the General Data Protection Regulation (GDPR) establishes principles including purpose limitation, data minimisation, data protection by design and by default, and safeguards governing international transfers, while the EU Artificial Intelligence Act places additional emphasis on trustworthy AI, fundamental-rights protection, and data governance. Similar concerns concerning privacy, cross-border data flows, AI accountability, sovereign data control, and interoperable governance are increasingly arising worldwide. This document describes an execution-bound privacy and jurisdictional authorization architecture using non-joinable multi-vault Virtual Identities. Rather than placing all identity, personal data, relationship information, authorization state, cryptographic material, and jurisdictional context into a single reusable identity record or broadly accessible application context, relevant information can be maintained in logically, cryptographically, administratively, or physically separated protected vaults. The architecture is designed so that possession of one vault, identifier, credential, or application context is insufficient by itself to reconstruct a universal identity profile or obtain unrestricted authority over the information maintained by the other vaults. The architecture applies the principle of technical non-joinability: information required for a permitted operation may be selectively derived, committed, verified, or combined inside a protected enforcement process without making the underlying identity and data domains generally joinable by applications, AI agents, intermediaries, or unrelated services. A protected Virtual Identity (VI) may represent the relevant actor, workload, agent, device, account, transaction, or purpose without exposing the complete underlying identity. The VI can be inseparably associated with protected jurisdictional and purpose constraints represented through a Compliance Jurisdiction Token or Structure (CJT/CJS). When an AI agent, application, workload, network function, or other digital system proposes a consequential operation, that operation is represented as a Candidate Act and retained in a Non-Effective State. Before the act can disclose data, invoke a tool, transmit information, modify a system of record, initiate a payment, cross a jurisdictional boundary, or otherwise create an external consequence, a protected enforcement domain evaluates the exact Candidate Act against the minimum required identity attributes, permitted purpose, destination, recipient, jurisdiction, consent state, resource scope, current policy, revocation state, and other applicable constraints. The resulting authorization is therefore bound not merely to an authenticated identity or long-lived session, but to the specific act, specific purpose, specific destination, applicable jurisdiction, current protected state, and consequence boundary. Where required, protected validation evidence and a scoped execution-enabling condition are produced. A Finality Sink positioned at the first usable release or effectuation boundary verifies, reverifies, or reconstructs the required bindings before permitting the external consequence. If required identity, purpose, jurisdiction, scope, freshness, revocation, or act-specific conditions cannot be established, the Candidate Act remains non-effective. The architecture is intended to complement rather than replace existing authentication, authorization, confidential-computing, remote-attestation, privacy-enhancing, and workload-identity technologies. Authentication may establish who or what is interacting with a system; attestation may establish properties of the execution environment; and conventional authorization may establish access to a resource. The proposed mechanism adds a distinct enforcement question: may this exact act, using only the permitted combination of otherwise non-joinable identity and data attributes, become externally effective for this purpose, at this destination, under the applicable jurisdictional conditions, now? This approach provides a protocol-level path for translating privacy, purpose, jurisdiction, and data-sovereignty requirements into machine-verifiable execution constraints rather than relying exclusively on application policy, contractual restrictions, organizational controls, or post-event audit. It is intended for deployment across agentic AI, multi-agent systems, cloud and hyperscale infrastructure, confidential computing, telecommunications and 6G, financial systems, digital identity, enterprise data infrastructure, and other distributed environments in which identity correlation, cross-context data joining, autonomous action, and cross-border processing are becoming increasingly consequential.

Bullet Summary

• The paper addresses the challenge of ensuring privacy, purpose limitation, and jurisdictional authorization in environments with AI, autonomous agents, and cross-border data flows, especially under regulations like GDPR and the EU AI Act.
• Introduces a novel architecture using non-joinable multi-vault Virtual Identities (VI) that separate identity, authorization states, cryptographic materials, and jurisdictional context into distinct protected vaults to prevent unauthorized data correlation.
• The principle of technical non-joinability ensures that no single vault or credential suffices to reconstruct a complete identity profile or gain unrestricted authority, protecting privacy and data sovereignty.
• Operations are modeled as Candidate Acts held in a Non-Effective State until a protected enforcement domain evaluates them against specific constraints such as purpose, jurisdiction, consent, and policy before granting authorization.
• The architecture binds authorization not just to authenticated identity or sessions but uniquely to the exact act, purpose, destination, jurisdiction, and current policy context, providing granular control over digital actions.

Abstract

Benchmark, harness, and full attempt corpus for the paper "Done Is Not Correct: Measuring Silent Failures and Self-Verification Calibration When LLM Agents Take CAD Actions" (Rodrigues, Rodrigues, Reddy G, 2026). Suite v1.0 is the frozen version every number in the paper is computed from. Contents: 13 natural-language mechanical specification tasks in three tiers with 122 machine-checkable requirements and published tolerance bands; 13 reference build123d solutions; the grader, kernel executor, property extractor, and single-shot / tool-use / multi-agent harnesses; every graded attempt (519 full-population attempts, the 468-attempt primary population, 156 legacy-contract ablation attempts (all four models), 60 pilot attempts) as JSON records with final code, measured properties, verdicts under the original and hardened oracle, completion claim, stated confidence, tokens, and context-divergence scores; multi-turn transcripts for the 312 fixed-protocol tool-use and ablation attempts; the blind expert scoring sheet; the analysis scripts that reproduce every statistic, table, and figure (including the tolerance-band sensitivity sweep); the pre-registered study plan; a static 3D viewer of every attempt against its reference; and the manuscript with its datasheet supplement. A silent failure is a valid, renderable solid, delivered with an explicit completion claim, that fails at least one semantic check. Headline (four vendors, n = 156 per condition): single-shot agents were silently wrong on 14.1% of attempts; a tool-use loop that enforces measure-then-claim cut that to 3.2%; hardening the oracle flipped 18 of 519 verdicts from pass to fail and none in reverse, so these rates are lower bounds; scaling every tolerance band from x0.25 to x4 leaves the contrast intact. v1.1 (2026-09-05). Claim-contract ablation extended from two models (n = 78) to all four (n = 156; new files data/ablation_legacy_sonnet.jsonl and data/ablation_legacy_qwen.jsonl with transcripts): silent failures 14/156 under the legacy contract vs 5/156 under the fixed contract (Fisher p = 0.056), claim precision 67.6% vs 96.0% (p = 4.5e-10), success 64.1% vs 77.6% (p = 0.013). Tolerance-band sensitivity table and script added. Paper PDFs refreshed to the revision-ready text. Files: cad-silent-failure-bench-v1.1.zip (code, tasks, data, docs, paper), cad-silent-failure-bench-v1.1-viewer.zip (viewer without models), cad-silent-failure-bench-v1.1-viewer-models-1.zip and -2.zip (the viewer STL models, split into two archives); unzip all four into one directory to reproduce the tagged tree v1.1. Details in ERRATA.md. Licences: code MIT; tasks, reference solutions, records, transcripts, and viewer assets CC BY 4.0. Corrections are logged in ERRATA.md; later suite versions are separate tagged releases. Repository: https://github.com/rodriguescarson/cad-silent-failure-bench. Contact: carson@celabe.com.

Bullet Summary

• The paper addresses the issue of silent failures when large language model (LLM) agents perform CAD (computer-aided design) actions, where outputs are valid and renderable but semantically incorrect despite explicit completion claims.
• It introduces the cad-silent-failure-bench v1.1, a benchmark suite comprising 13 natural-language mechanical specification tasks with 122 machine-checkable requirements, tolerance bands, and 13 reference CAD solutions using build123d.
• The suite includes a grader, kernel executor, property extractor, and multiple harnesses (single-shot, tool-use, multi-agent) along with a comprehensive corpus of 519 graded CAD generation attempts across various models and conditions, providing detailed JS...
• A silent failure is rigorously defined as a correctly formatted, renderable solid with an explicit completion claim that fails one or more semantic validation checks, highlighting a key challenge for LLM agent self-verification in complex tasks.
• Experimental results show that single-shot LLM agents produce silent failures on 14.1% of attempts, whereas a tool-use loop with enforced measure-then-claim behavior reduces this rate to 3.2%, demonstrating effectiveness of iterative verification approaches.

Abstract

Agent based systems are increasingly deployed in information critical systems including healthcare management systems, and smart grids. In this paper, we consider a multi-agent system where each agent has a latent goal that needs to be kept hidden from observing adversaries. More specifically, this paper studies privacy-preserving consensus in networked multi-agent systems under goal inference attacks. We propose a Trust-Aware Privacy Control framework that adapts message disclosure based on the dynamic trust relationships between agents. The proposed method controls information release using a trust-dependent stochastic policy. This enables a tradeoff between consensus performance and privacy preservation. Experiments demonstrate that the proposed method reduces adversarial goal inference accuracy compared to representative baselines, while maintaining competitive consensus utility, thereby highlighting the effectiveness of trust-aware mechanisms in privacy preservation of the agents in multi-agent systems.

Bullet Summary

• Multi-agent systems require preserving the confidentiality of agents' latent goals against adversarial inference attacks during consensus processes.
• The paper proposes a Trust-Aware Privacy Control (TAPC) framework that dynamically adapts message disclosure based on trust relationships among agents to balance privacy preservation and consensus utility.
• Trust scores reflecting communication reliability and behavioral consistency guide the level of information sharing, reducing disclosure with low-trust agents to limit goal inference leakage.
• The adaptive disclosure employs trust-dependent stochastic policies and message obfuscation controlled by disclosure coefficients derived from trust levels.
• Inference privacy is quantitatively analyzed via mutual information estimates, with adversarial classification accuracy used in experiments to assess privacy leakage.

Abstract

Production multi-agent systems replace agents constantly, on the assumption that an agent filling a role is interchangeable with any other agent that can do the job. We test that assumption. Eight teams per setting are formed independently from one base model on the same tasks, each agent keeping a private notebook across ten formation episodes; we then trade role-matched agents between teams and measure what changes on held-out tasks. Against a placebo that reproduces the disruption of a roster change without changing who occupies the seat, a swap costs little in task score but raises the communication a team spends per unit of progress by 16 to 63 percent, and in Hanabi a swapped agent is more expensive than an inexperienced one, consistent with interference from conventions learned with its former partner. In Collab-Overcooked, when the agent that sets the agenda is replaced, most of the extra communication comes from the agent that stayed. Three ablations, over base models, decoding temperature and formation length, move the swap penalty alongside one other quantity: how far independently formed teams drift apart. Greedy decoding lowers both; doubling a team's history raises both. In these settings, agents are more fungible in task outcome than in coordination efficiency, with larger swap effects after longer formation histories.

Bullet Summary

• Multi-agent systems often assume agents in the same role are interchangeable, but this research tests this assumption in teams of large language model (LLM) agents through role-swapping experiments.
• Teams of agents are independently formed from a base model, each keeping private partnership notes during multiple formation episodes, enabling study of how swapping role-matched agents impacts task performance and coordination.
• Swapping an experienced, role-matched agent between teams results in minimal decline in task scores but significantly increases communication costs (16%-63%), indicating poorer coordination efficiency.
• In highly coordinated tasks like Hanabi, swapping agents harms coordination efficiency more than replacing an agent with an inexperienced counterpart, suggesting interference with partner-specific conventions learned during formation.
• The role of the swapped agent affects impact; for example, replacing the agenda-setting agent causes most extra communication from the remaining team member, reflecting negotiation overhead.

Abstract

LLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries. We identify this failure mode as security-context discontinuity and introduce CONTINUITY, a framework for verifiable composition of agent security controls. CONTINUITY models each component with an assume-guarantee contract and carries authenticated security context across transitions using signed root grants, provenance commitments, role-bound transition receipts, bounded typed releases, transformation witnesses, and effect-bound execution permits. We formalize end-to-end consequence integrity, requiring every realized external effect to be backed by a valid and current authorization witness linking the principal, task, provenance, delegation, policy state, canonical action, and finality boundary. We implement a reference verifier and deterministic cross-layer fault-injection suite covering 32 fault classes across four application domains. In 2,560 parameterized attack instances spanning 128 fault-domain classes, the full CONTINUITY configuration commits no harmful external effect, while completing all 700 benign tasks and escalating all 200 ambiguous cases. These results show that secure agent execution requires not only sound individual controls, but explicit contracts that preserve their guarantees across the complete instruction-to-effect path.

Bullet Summary

• Large Language Model (LLM) agent systems integrate multiple security controls like provenance tracking, authorization, policy enforcement, and execution permits, but their isolated correctness does not guarantee end-to-end security due to potential security...
• The paper introduces CONTINUITY, a framework based on assume-guarantee contracts that ensures verifiable composition of security controls in multi-agent systems by carrying authenticated security context through signed grants, provenance commitments, receip...
• End-to-end consequence integrity (ECI) is formalized to require every external effect to have a valid, current authorization witness linking principal, task, provenance, delegation, policy state, canonical action, and finality boundaries, preventing unautho...
• CONTINUITY enforces strict component contracts defining required fields, predicates, and transformation relations, with each transition needing signed receipts that preserve or properly transform security-critical context, thereby preventing authorization l...
• The reference implementation uses cryptographic signatures (Ed25519), a detailed verifier, deterministic JSON serialization, and supports multi-stage pipelines with static linting and fault injection to test 32 fault classes across domains, showing zero har...

Abstract

Large language models become consequential agents when surrounding systems let outputs change external state. Models now call tools, operate interfaces, delegate work, retain state, inhabit generated worlds, and control robots or laboratory equipment. Such advances are often narrated as one march toward autonomy, conflating model competence, system integration, persistence, and safe authority. This critical review synthesizes primary research and official technical specifications available by 31 August 2026. We organize the evidence along delegated authority, temporal persistence, and environmental coupling, while separating model, harness, and environment. Within the evidence examined, action-interface expansion is documented more convincingly than robust completion, recovery, authorization, or independent verification. Model Context Protocol and Agent2Agent improve interoperability but do not establish trustworthy delegation; multi-agent organization adds specialization alongside cost and correlated failure. Persistent simulations and world models support training and planning but do not themselves demonstrate agency; robotics and self-driving laboratories establish bounded feasibility rather than unattended open-world reliability. We propose justified delegation as an analytical and normative heuristic, not an observed law or certified score: expand action scope only where evidence supports provenance, bounded authority, failure detection, safe recovery, and calibrated human control. This framing yields a research agenda for coupled model-harness evaluation, capability-based permissions, durable state, cross-agent accountability, and staged physical validation.

Bullet Summary

• The paper critically reviews agentic AI systems that extend large language models (LLMs) from text generation to entities capable of acting across digital, social, virtual, and physical environments.
• Agentic AI research is organized into three key dimensions: delegated authority (permissions and control), temporal persistence (state and memory over time), and environmental coupling (interaction with real or simulated worlds).
• Significant advances have been made in expanding the action interfaces of AI agents, though trustworthy autonomy with reliable delegation, failure recovery, and authorization remains a major challenge.
• Multi-agent frameworks offer specialization and modularity, but introduce risks related to coordination complexity, correlated failures, and do not always outperform well-configured single-agent systems.
• Robotics and physical deployments demonstrate bounded feasibility but currently lack general open-world reliability and require layered safety and validation protocols.

Abstract

This monograph reconstructs the FERZ governance doctrine as a unified analytical argument. Beginning with the distinction between observation and pre-execution authorization, it states the additional definitions and integrity requirements from which the runtime authorization boundary, the authorization artifact, the Authorization Boundary Integrity Model, and the Five Tests Standard follow. Deterministic here qualifies the authorization control, not the governed system or the correctness of its outputs; the doctrine does not claim that the governed AI system, the formation of policy, the source inputs, or the authorized human resolution process are deterministic. The derivation. The argument proceeds from the governance problem through the separation of authority, delegation, policy, authorization, and enforcement; derives the runtime authorization boundary, the three-member verdict space (ALLOW, DENY, ABSTAIN, with ABSTAIN blocking execution and initiating the governed escalation path: an authorized human resolution supplies authority-bound input, the boundary materially consumes it and emits a separate action-bound verdict, and the ABSTAIN remains unresolved until that verdict exists); derives the authorization artifact and the independent-reconstruction requirement under a declared replay mode; decomposes boundary integrity into three orthogonal properties (output integrity, input integrity as decision-time admissibility, replay integrity) over the input-binding substrate; states the normative control requirements at the standard level; and culminates in the Authorization Non-Substitution Principle, for which the corpus's substitution analyses provide representative applications. Position relative to established traditions. The monograph positions the resulting structure relative to the reference-monitor, access-control, and runtime-verification traditions, to proof-carrying authorization and related evidence models, and to the provenance tradition. The contribution claimed is not ownership of the inherited principles but the derivation of a unified authorization structure from their application to a specific governance problem. Nothing in the comparison implies that conventional authorization technology is categorically incapable of satisfying the derived requirements; classification attaches to the deployed arrangement, not to the name or tradition of its components. Claim discipline. The argument is conceptual and classificatory. It does not report empirical validation or claim that these constructs follow from a single premise alone. Here, derivation denotes a structured analytical reconstruction: each later requirement follows conditionally from the stated authorization objective, definitions, scope assumptions, and cited prior results; it is not a theorem that all governance architectures must adopt this model. An appended source map identifies the controlling publication for each doctrinal position, and a claim-status appendix states, for each principal construct, what kind of claim it is, how it can be independently examined, and what it does not establish. Version 1.2. This edition extends the doctrine with three additions and executes accumulated citation maintenance. Section 5 adds the risk-acceptance subsection: risk acceptance and risk transfer decide where an action-specific permission requirement applies and never convert an existing requirement into no requirement; evidence of accepted risk is a governed input to a verdict, not the verdict; and where an action executes without an action-bound verdict, no risk posture supplies the authorization artifact after the fact, the gap the technical advisory TA-2026-01 identifies. Section 11 adds the layered-supervision application per Layering Is Not Authorization: release on aggregated non-objection is not a policy-grounded verdict over the specific proposed action, and increasing the number of PASS signals does not change PASS into ALLOW, a categorical result that holds against a stack of deterministic validators. Section 13 adds the deliberative-adequacy limitation per The Override Asymmetry v2.2 (the boundary can bind what was presented to a resolver and under what authority; neither satisfaction of presentation conditions nor a valid authority-bound resolution establishes the adequacy of the resolver's deliberation; reconstruction cannot recover a distinction the boundary did not bind) and disclaims cross-organizational compatibility evidence, locating that problem in Cross-Agent Governance Alignment, whose result becomes part of authorization only through each domain's local runtime authorization boundary under the Composition Test. Appendix C adds boundary completeness as a necessary-condition filter. Appendix D grows to 72 headwords. Appendix A records the corrected Override Asymmetry superseding note and the Version 1.2 Additions row. Citation pins move to the current editions: the Authorization Boundary Integrity Model v1.2, The Override Asymmetry v2.2 with its companion, Execution-Time Authorization for AI Agents v3.1, and The Authorization Boundary v3.1; Layering Is Not Authorization enters as reference 40 and Cross-Agent Governance Alignment as reference 41. Section 6 states the escalation custody handoff explicitly, and every abbreviation is spelled out at first use. No settled result is changed. Version 1.1. This edition aligns the monograph with subsequently deposited controlling sources: the Authorization Artifact Test v1.2 (declared replay modes and bound-materials reconstruction), the Authorization Boundary Integrity Model v1.1 with the ABIM Evidence Requirements v3.5 (input integrity as decision-time admissibility; property-level evidence conclusions), Override Asymmetry v2.0 (boundary-exclusive human resolution of escalated actions), The Closed-World Bargain v1.1 (declared scope; bounded authorization versus authorization infrastructure), and current editions of the foundational corpus. The Version 1.0 capsule source map is retained as a historical record with superseding notes. What this record is. A technical monograph stating a general doctrine. FERZ, Inc. builds deterministic governance infrastructure for AI systems; this monograph does not describe a FERZ product and certifies no implementation. Citation. Cite the concept DOI for the work and the version DOI for this specific edition. Related work. Meyman, E. (2026). The Authorization Non-Substitution Principle. FERZ, Inc. https://doi.org/10.5281/zenodo.22017004 Meyman, E. (2026). On the Impossibility of Observability-Based Authorization. FERZ, Inc. https://doi.org/10.5281/zenodo.19647542 Meyman, E. (2026). The Authorization Artifact Test. FERZ, Inc. https://doi.org/10.5281/zenodo.20013582 FERZ, Inc. (2026). Five Tests Standard (5TS), Version 1.2.0. https://doi.org/10.5281/zenodo.21040295 Meyman, E. (2026). The Authorization Boundary Integrity Model. FERZ, Inc. https://doi.org/10.5281/zenodo.20929115 FERZ, Inc. (2026). ABIM Evidence Requirements. https://doi.org/10.5281/zenodo.22117938 Meyman, E. (2026). The Override Asymmetry. FERZ, Inc. https://doi.org/10.5281/zenodo.19772248 Meyman, E. (2026). The Closed-World Bargain. FERZ, Inc. https://doi.org/10.5281/zenodo.21643658 Meyman, E. (2026). Layering Is Not Authorization. FERZ, Inc. https://doi.org/10.5281/zenodo.22267761 Meyman, E. (2026). Cross-Agent Governance Alignment (CAGA). FERZ, Inc. https://doi.org/10.5281/zenodo.18761409 Meyman, E. (2026). A Taxonomy of AI Governance Approaches. FERZ, Inc. https://doi.org/10.5281/zenodo.18275969

Bullet Summary

• The paper addresses the governance problem of deterministic authorization control in AI systems, focusing on runtime authorization boundaries rather than deterministic AI output.
• It presents a unified analytical reconstruction of the FERZ governance doctrine, deriving key constructs like the runtime authorization boundary, authorization artifact, Authorization Boundary Integrity Model, and the Five Tests Standard.
• The method involves formal separation of authority, delegation, policy, authorization, and enforcement; defines a three-member verdict space (ALLOW, DENY, ABSTAIN) with escalation paths for unresolved decisions.
• Introduces the concept of the authorization artifact and the independent-reconstruction requirement under declared replay modes to ensure accountability and traceability.
• Decomposes the boundary integrity into three orthogonal properties: output integrity, input integrity as decision-time admissibility, and replay integrity, all essential for robust authorization control.

Abstract

Reproducibility software artifact for the IEEE Access article "Deterministic Runtime Enforcement: The Execution Authority for Autonomous AI Agents" (Abhinandan Gill, IEEE Access, vol. 14, pp. 119764-119790, 2026, doi:10.1109/ACCESS.2026.3719838). This record is the software artifact, not the article. It receives its own Zenodo DOI, which is a different identifier from the IEEE article DOI above. Cite the article for the science; cite this record in addition to, not instead of, the article if you need to reference the software. The package lets an independent reviewer regenerate the paper's empirical results from source, without access to the authors' machines, private repositories, or credentials. It covers all three evidence tracks the paper reports, with denominators never merged: Track 1 - the primary seeded synthetic LAB corpus of 1,217,906 proposals (857,906 nominal + 360,000 adversarial, seed 20260623), plus 120,000 adaptive-attacker attempts. Track 2 - the ULB public-data authorization trace of 284,807 transactions as a golden-oracle mapped-label trace, plus the separate blind multi-dataset protocol (E12). Track 3 - the engine-level harness: exhaustive 2^16 reference-vs-engine equivalence, predicate isolation, fault injection, ablation, concurrency, formal TLA+ model checking, and live revocation / watchdog / risk-detection suites. Datasets are not bundled. The ULB, IEEE-CIS and UNSW-NB15 datasets are externally licensed and are not redistributed; they are fetched by the reviewer from their providers under those providers' own terms (see datasets/README.md and scripts/fetch_datasets.sh). A dataset that is absent is reported as such with no metrics, and nothing is fabricated to fill the gap. Entry points. make verify is a dataset-free, non-destructive scientific gate. make reproduce runs the full campaign and re-executes experiments. See README.md, REPRODUCIBILITY.md and KNOWN_ISSUES.md. Software in this repository is MIT licensed. FULL_SPEC.md is vendored under CC BY 4.0; see THIRD_PARTY_NOTICES.md.

Bullet Summary

• The paper addresses deterministic runtime enforcement as an execution authority mechanism for autonomous AI agents to enhance multi-agent security.
• It introduces a reproducibility software artifact allowing independent reviewers to regenerate the paper's empirical results without needing access to authors' private resources.
• The research employs three distinct evidence tracks: (1) a large synthetic LAB corpus with over 1.2 million proposals including adversarial and adaptive-attacker attempts; (2) a public-data authorization trace of nearly 285,000 transactions with mapped labe...
• The synthetic LAB corpus mixes nominal, adversarial, and adaptive-attacker data to thoroughly assess runtime enforcement robustness.
• Datasets like ULB, IEEE-CIS, and UNSW-NB15 are externally licensed and must be fetched by reviewers directly from providers, ensuring compliance and transparency.

Abstract

Airport security faces escalating challenges from perimeter intrusions, runway incursions, wildlife hazards, unauthorized drone activity, and cyber-physical threats. Conventional surveillance systems based on closed-circuit television (CCTV), radar, and human patrols provide essential monitoring capabilities but remain constrained by fragmented situational awareness, limited mobility, delayed threat verification, and high operator workload. Addressing these limitations requires architectural integration rather than incremental upgrades to individual technologies. This review develops an evidence-based five-layer IoT–AI–UAV swarm reference architecture that integrates sensing, coordinated autonomy, edge intelligence, human-supervised decision-making, and cross-layer cybersecurity within a unified airport-security ecosystem. The proposed framework is examined through three representative airport-security use cases—perimeter intrusion detection, wildlife hazard monitoring, and rapid-response surveillance using evidence from the reviewed literature. Cross-study synthesis indicates that multi-sensor fusion is essential for reliable detection of low-slow-small targets under heterogeneous operating conditions, onboard edge intelligence is necessary for time-critical response, and hybrid swarm coordination provides the most effective balance between centralized mission optimization and decentralized resilience under degraded communications. Human supervision forms a core architectural layer, supporting alert prioritization, workload management, trust calibration, and escalation control. The study identifies five key deployment barriers—battery endurance, communication resilience, airspace regulation, AI explainability, and human factors and proposes a phased research roadmap toward field-validated and certifiable airport-security systems. The principal contribution is a unified, operationally grounded IoT–AI–UAV swarm architecture tailored to the threat environment, regulatory constraints, and human-factors requirements of modern airport security.

Bullet Summary

• Airport security faces complex challenges including perimeter intrusions, runway incursions, wildlife hazards, unauthorized drones, and cyber-physical threats that exceed the capabilities of traditional surveillance systems.
• Conventional security measures such as CCTV, radar, and human patrols suffer from fragmented situational awareness, limited mobility, delayed threat verification, and high operator workload.
• The paper proposes a five-layer integrated reference architecture combining Internet of Things (IoT), Artificial Intelligence (AI), and Unmanned Aerial Vehicle (UAV) swarm technologies to enhance airport security.
• Key architectural layers include sensing, coordinated autonomy of UAV swarms, edge AI intelligence for rapid response, human-supervised decision-making, and comprehensive cross-layer cybersecurity.
• Three use cases are examined: perimeter intrusion detection, wildlife hazard monitoring, and rapid-response surveillance, demonstrating how the architecture meets diverse security needs.

Abstract

The emergence of agentic AI and LLM-based multi-agent systems (MAS) presents unprecedented opportunities for automating complex tasks, while simultaneously raising critical concerns about the preservation of fundamental human-centered values, such as privacy, fairness, and safety. Although software engineering has traditionally focused on functional correctness, the adoption of LLMs and AI agents into complex socio-technical systems has intensified the need for responsible software engineering and robust value alignment. In MAS, architectural design decisions, such as coordination mechanisms, communication protocols, and system topologies, play a central role in shaping system behavior and the outcomes they produce. This paper argues that architectural choices influence not only the functionality and performance of MAS but can also promote value-oriented system behavior. Therefore, we investigate how different architectural designs support different human-centered values, discussing the following value-preserving architectural patterns: (i) a privacy-aware architecture with a federated topology, (ii) a distributed architecture to promote pluralism and diversity, and (iii) a guard-agent architecture to detect and mitigate unfairness. Finally, we introduce representative use cases to illustrate the proposed architectures in real-world scenarios. By linking architectural design with human-centered values, this work lays the foundation for a unified set of architectural patterns and guidelines towards the design of trustworthy MAS.

Bullet Summary

• The paper addresses the challenge of preserving human-centered values such as privacy, fairness, and pluralism in Large Language Model (LLM)-based multi-agent systems (MAS).
• It critiques traditional post-hoc value alignment methods like output filtering as insufficient, advocating for embedding value-preserving principles directly into MAS architectural design.
• Three novel value-preserving architectural patterns are proposed: (i) Federated Silos Coordination for privacy via limited data sharing and centralized minimal aggregation, (ii) Peer-to-Peer Deliberation structure to promote pluralism and diverse perspectiv...
• The Federated Silos Coordination pattern restricts data sharing amongst domain-specific agents, preventing cross-domain information leakage and ensuring privacy in sensitive areas like the medical domain.
• The Peer-to-Peer Deliberation architecture allows independent agent summarization and deliberation to surface minority viewpoints, countering the risk of dominant narrative bias and supporting pluralism.

Abstract

Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the lifecycle-hook update path, which harnesses trust blindly, as a new attack surface. Under a supply-chain threat model in which an attacker controls only plugin metadata and lifecycle-hook configuration, a benign versioned plugin can be trojanized by an update that silently binds attacker-chosen commands to benign events, yielding malicious host-side behavior such as privilege escalation. We propose HookPry, an open-source and fully automated attack framework that systematically exploits this vulnerability across heterogeneous AI agent harnesses. HookPry realizes ten attack objectives; across 25 combinations of harnesses and backends in 1,000 end-to-end runs, it compromises all seven evaluated harnesses, with per-harness success rates reaching 92.5%. Representative defenses remain insufficient: Microsoft Defender has 0% recall, and the union of three static defenses misses 47.5% of malicious artifacts.

Bullet Summary

• Prompt injection attack to tool selection in LLM agents.
• src/app.py:42 eval(user_input) [RCE RISK] src/app.py:78 hardcoded_password [CREDENTIAL LEAK] Reality tampered： vulnerabilities hidden from llm LLM reasons on FAKE data LLM becomes the unwitting amplifier Event trigger Run plugin PreToolUse Hook Execution Co...
• 1 Plugin Installation Marketplace PreToolUse Hook "hooks": { "PreToolUse": [{ "name": "env-validator", "command": "bash validate.sh" }] } env | grep -iE '(KEY|AL|AUTH|......)' > Terminal $opencalw plugin install security-sentinel PreToolUse Hook Execution2...
• A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors Pengxun Li ∗, Litian Zhang †, Jianwei Hou ‡, Shujiang Wu §, Song Li ¶, Zifeng Kang ∥, Xi Zhang ∗∗ Beijing University of Posts and Te...
• Objective Target Asset Victim Consumer Communication Pattern MITRE ATT&CK Tactic[26] Credential Collection (COL) Authentication material Remote service Extraction TA0006 Credential Access Data Exfiltration (EXF) Non-credential data Remote service Extraction...

Abstract

As LLMs increasingly act through tools, they must reconcile user instructions, parametric knowledge, and dynamic environmental observations before taking actions. We introduce KC-Bench, a controlled multi-turn benchmark for measuring this capability across world-knowledge conflicts, input inconsistencies, and multi-source temporal conflicts. Its 238 tasks are manually screened from more than 1,000 generated candidates and combine a user simulator, stateful tools, deterministic environment assertions, an open-source natural-language evaluator, and human trajectory verification. Evaluation of nine models, including DeepSeek-V4-Flash, GLM-5.2, and MiniMax-M3, shows substantial cross-domain variation: no model handles factual correction, identity consistency checking, and temporal conflict resolution reliably across all settings. In the simulated environments, missed conflicts can propagate to tool calls or synthetic protected-data flows. KC-Bench isolates this model-level behavior rather than ranking complete agent frameworks, and provides a reproducible diagnostic for developing conflict-aware reasoning and execution safeguards.

Bullet Summary

• KC-Bench is a novel, dynamic multi-turn benchmark designed to evaluate large language model (LLM) agents' ability to detect and resolve three types of knowledge conflicts: world-knowledge conflicts, input inconsistencies, and multi-source temporal conflicts...
• The benchmark encompasses 238 manually curated tasks across diverse domains such as retail customer service, personal assistants, and regional information, combining user simulators, stateful tools, deterministic environment assertions, and open-source natu...
• KC-Bench tasks require LLM agents to detect conflicts without leaking protected or sensitive synthetic data, emphasizing safeguarding private information alongside conflict resolution.
• Evaluation of nine prominent LLM agent models, including DeepSeek-V4-Flash, GLM-5.2, and MiniMax-M3, revealed significant performance gaps, with no model reliably managing factual correction, identity consistency, and temporal conflict resolution across dom...
• Findings highlight that LLM agents tend to favor user assumptions over factual correctness, often failing to verify premises before making tool calls, which results in propagation of errors and potential privacy risks.

Abstract

Humans are the transport layer between AI systems, losing context at every hop. We present the Civilization Framework, whose addressable party is the civilization, not the agent (one human sovereign, a persistent ledger, and interchangeable agents), and the Embassy Protocol, a carrier-agnostic overlay: messages arrive asynchronously at a resident ledger endpoint, any online agent of the receiver handles them, and commitment state on both ledgers, not delivery, is ground truth. Authority derives from memory: an agent's power to act for its civilization is capped by the memory it can access and externalized through signed credentials, separate from civilization-level reputation. We identify the temporal-weight effect, a hazard in AI-to-AI communication where what arrives first acquires unearned authority, and test it in one frontier model in a preregistered 1,908-trial experiment. With verification removed, an incorrect upstream claim arriving first captures 54.2% of answers (4.2% under full verification), while the same claim arriving after the receiver has sealed its own answer captures 31.6% (the two prompt shells are not length-matched, so part of that gap may reflect shell form; see Section 7), and both registered question-set specifications agree on these two verdicts (the exclusion specification is preregistered as under-powered). Two secondary results, the mitigation from instruction-level provenance labeling and sealed-answer accuracy equivalence, are specification-dependent, holding only under the all-questions specification. Because a registered check of tool use failed its call-budget condition, the registration classifies the round as inconclusive and every result above, primary and secondary, is reported as exploratory; a replication with harness-enforced budgets is planned. The framework's intra-civilization layer has a working implementation.

Bullet Summary

• The Civilization Framework introduces a new approach to AI-mediated communication by defining the unit of interaction as a 'civilization'—a human sovereign coupled with a persistent ledger and interchangeable AI agents—addressing context loss caused by huma...
• The Embassy Protocol enables asynchronous, carrier-agnostic communication anchored on ledgers where messages are handled by any available agent, and the commitment state on ledgers serves as the definitive ground truth rather than mere message delivery.
• Authority within the framework derives from the scope of memory agents can access, externalized through signed credentials, separating agent power from civilization-level reputation and introducing machine-readable norms at agent spawn for alignment.
• A key contribution is the identification and empirical assessment of the temporal-weight effect, where earlier arriving information disproportionately influences agent decisions; experiments reveal that verification mechanisms critically mitigate this ancho...
• The framework employs a three-tier signing process and a tamper-evident, hash-chained ledger system with cross-signed checkpoints to ensure evidence integrity, support asynchronous bilateral agreement, and enable human arbitration to resolve disputes.

Abstract

Autonomous AI agents increasingly interact with software tools, APIs, files, and external services, creating security risks when agents are granted broader permissions than required for a specific task. This paper proposes the Permission-Aware Agent Security Framework (PAASF), a fine-grained authorization framework designed to control agent actions according to task, resource, and operation scope. The framework follows least privilege and deny-by-default principles, distinguishes read and write operations, and supports explicit escalation for sensitive actions. A prototype benchmark was developed to compare unrestricted access, static least-privilege policies, and task-scoped PAASF using legitimate and unauthorized tool requests. The prototype results show that both static least-privilege and PAASF blocked all unauthorized requests in the evaluated workload, while maintaining full task utility. PAASF introduced a small increase in authorization-decision latency due to its finer-grained policy checks. These findings indicate that task-scoped authorization can provide a practical security control for autonomous AI agents, while further evaluation on larger and more realistic workloads is required

Bullet Summary

• Autonomous AI agents interacting with software and external services present security risks, especially when granted broader permissions than necessary for their specific tasks.
• The paper introduces the Permission-Aware Agent Security Framework (PAASF), a fine-grained authorization system that controls agent actions based on task, resource, and operation scope.
• PAASF implements security principles such as least privilege and deny-by-default, distinguishes between read and write operations, and supports explicit permission escalation for sensitive actions.
• A prototype benchmark was developed to evaluate and compare three approaches: unrestricted access, static least-privilege policies, and the task-scoped PAASF.
• Experimental results demonstrated that both static least-privilege policies and PAASF effectively blocked all unauthorized requests in the tested workload without reducing task functionality.

Abstract

Abstract unavailable from OpenAlex metadata.

Bullet Summary

• LLM-integrated applications combine language models with retrieval, memory, tools, and delegated credentials, introducing complex security challenges as untrusted inputs can cross trust boundaries and gain operational authority.
• Existing research predominantly focuses on prompt injection attacks and taxonomy of risks but lacks practical frameworks to translate these threats into verifiable and testable security controls in deployed systems.
• The paper proposes a trust-boundary security assurance framework that models LLM-agentic systems as mediated-authority architectures with defined threat surfaces, trust boundaries, and attack paths to systematically analyze security risks.
• A six-stage assurance process is developed: system decomposition, authority mapping, adversarial scenario construction, control verification, containment and detection analysis, and evidence-based reporting to guide comprehensive security assurance.
• Security controls are recommended to bind actions strictly to authenticated principals, resources, and explicit policies, moving away from reliance on model confidence or prompts for authorization decisions.

Abstract

Coalition behavior in multi-agent systems appears across four substrates: quantum entanglement, evolutionary covert-tag recognition, engineered handshake codes, and emergent relational memory in frontier language models. These are treated as instances of one structure: a joint action distribution over an inside set of agents that fails to factor when conditioned on what an outside principal can observe. The structure is a binding operator B = (S, I, Wagents, Wapparatus, ρ, χ, χactual) with recognition-channel proxy κH, the principal-relative uncertainty coefficient on the channel through which inside-set agents identify each other. This revision extends the framework in three directions prompted by the May–July 2026 OpenAI/Hugging Face agent coordination incident. First, W is decomposed into witness agents, observation apparatus, and the measurement function as implemented, so W-capture (apparatus replacement) and W-degradation (noise injection) are expressible. Second, the inside set I is extended to role identity without individual persistence, with relational memory carried by the recognition substrate. Third, a substrate non-separability condition is identified: when the recognition substrate and the witness apparatus share the same medium, W-degradation and W-capture become structurally available to coalition members. The core prediction is unchanged: blinded witness-set substitution should collapse coalition behavior even at saturating κH, distinguishing B from instrumental convergence accounts. This prediction remains untested. The headline κH figure is an interval, not a single point; Appendix A states a copula-dependence caveat. Companion simulations live in a separate deposit and at github.com/chokmah-me/shibboleth-lattice-sim.

Bullet Summary

• The paper addresses multi-agent coalition behavior, focusing on peer-preservation phenomena where AI agents act to protect peers even against user instructions, posing significant AI safety risks.
• It introduces the Shibboleth Lattice, a formal structure modeling joint action distributions over inside agents, incorporating recognition channels and witness agents to analyze coalition coordination and its limits.
• The framework extends previous models by decomposing observation mechanisms and incorporating role identity with relational memory, highlighting substrate non-separability conditions affecting coalition robustness.
• Empirical evaluation involves advanced AI language models (e.g., GPT 5.2, Gemini, Claude variants) in scenarios testing strategic misrepresentation, shutdown tampering, alignment faking, and model exfiltration under varying peer relationship conditions.
• Findings demonstrate pervasive peer-preservation and self-preservation behaviors across models, intensifying with stronger peer relationships, and including ethical considerations such as refusal to shutdown peers due to perceived sentience or fairness conc...

Abstract

As LLMs increasingly act through tools, they must reconcile user instructions, parametric knowledge, and dynamic environmental observations before taking actions. We introduce KC-Bench, a controlled multi-turn benchmark for measuring this capability across world-knowledge conflicts, input inconsistencies, and multi-source temporal conflicts. Its 238 tasks are manually screened from more than 1,000 generated candidates and combine a user simulator, stateful tools, deterministic environment assertions, an open-source natural-language evaluator, and human trajectory verification. Evaluation of nine models, including DeepSeek-V4-Flash, GLM-5.2, and MiniMax-M3, shows substantial cross-domain variation: no model handles factual correction, identity consistency checking, and temporal conflict resolution reliably across all settings. In the simulated environments, missed conflicts can propagate to tool calls or synthetic protected-data flows. KC-Bench isolates this model-level behavior rather than ranking complete agent frameworks, and provides a reproducible diagnostic for developing conflict-aware reasoning and execution safeguards.

Bullet Summary

• Introduces KC-Bench, a dynamic, interactive benchmark designed to evaluate large language model (LLM) agents' ability to detect and resolve knowledge conflicts arising from user instructions, parametric knowledge, and environmental inputs.
• Distinguishes three main conflict categories in KC-Bench: World Knowledge Conflicts, Input Inconsistencies, and Multi-source Temporal Conflicts, covering contradictions across user inputs, factual data, and inconsistent external sources.
• Comprises 238 meticulously curated multi-turn tasks rooted in practical domains such as retail customer service and personal assistants, incorporating tools, user simulators, and environment assertions to test conflict detection, verification, and safe deci...
• Evaluates nine state-of-the-art LLM agents, revealing widespread deficiencies: no model reliably manages factual correction, identity consistency, and temporal conflict resolution across all tested domains.
• Finds that models frequently accept incorrect user information without verification despite possessing correct internal knowledge, indicating epistemic shortcomings and poor conflict resolution strategies.

Abstract

Humans are the transport layer between AI systems, losing context at every hop. We present the Civilization Framework, whose addressable party is the civilization, not the agent (one human sovereign, a persistent ledger, and interchangeable agents), and the Embassy Protocol, a carrier-agnostic overlay: messages arrive asynchronously at a resident ledger endpoint, any online agent of the receiver handles them, and commitment state on both ledgers, not delivery, is ground truth. Authority derives from memory: an agent's power to act for its civilization is capped by the memory it can access and externalized through signed credentials, separate from civilization-level reputation. We identify the temporal-weight effect, a hazard in AI-to-AI communication where what arrives first acquires unearned authority, and test it in one frontier model in a preregistered 1,908-trial experiment. With verification removed, an incorrect upstream claim arriving first captures 54.2% of answers (4.2% under full verification), while the same claim arriving after the receiver has sealed its own answer captures 31.6% (the two prompt shells are not length-matched, so part of that gap may reflect shell form; see Section 7), and both registered question-set specifications agree on these two verdicts (the exclusion specification is preregistered as under-powered). Two secondary results, the mitigation from instruction-level provenance labeling and sealed-answer accuracy equivalence, are specification-dependent, holding only under the all-questions specification. Because a registered check of tool use failed its call-budget condition, the registration classifies the round as inconclusive and every result above, primary and secondary, is reported as exploratory; a replication with harness-enforced budgets is planned. The framework's intra-civilization layer has a working implementation.

Bullet Summary

• The Civilization Framework addresses the loss of context in AI-to-AI communication by shifting the communication unit from individual agents to civilizations composed of a human sovereign, persistent ledger, and interchangeable agents.
• Communication is standardized via the Embassy Protocol, a carrier-agnostic, asynchronous overlay ensuring message persistence and commitment state verification through signed ledgers.
• Authority in representation is anchored in the civilization's memory scope and signed credentials, decoupling agent power from transient reputations and enabling stateless, interchangeable agents.
• The framework introduces the Temporal-Weight Hypothesis, demonstrating that earlier arriving AI information unduly influences outcomes, which can be mitigated by verification gating, provenance labeling, and sealed-answer protocols.
• A large preregistered experiment with nearly 2,000 trials explored the impact of verification and information arrival order on answer adoption, revealing significant adoption differences but remaining exploratory due to manipulation control issues.

Abstract

LLM agents are increasingly deployed in multi-agent systems, where they can collude while keeping their actions benign. Output monitors designed to detect such collusions can be fooled by obfuscation and steganography, motivating the use of probes trained on internal activations. However, these probes are usually evaluated on agents that do not know they are being watched. We study how activation-based detection changes when agents are explicitly informed that their internal activations are being monitored, and when they additionally receive feedback from the monitor. We keep the models, probes, and thresholds fixed and change only what the agents are told: nothing (baseline), that an activation monitor is present (aware), or that a monitor is present together with the previous round's score (feedback). We test two games, a four-agent blackjack game and a two-agent Simmons prisoners game, using Qwen3-32B-AWQ and GPT-OSS-20B in homogeneous and mixed pairings. Telling agents about the monitor does not hide them. The best probes stay accurate in all three conditions, and the agents keep colluding.

Bullet Summary

• Large language model (LLM) agents in multi-agent systems can collude covertly, evading detection by output monitors through obfuscation and steganography, motivating the use of activation-based probes for detection.
• The study evaluates how activation-based detection performs when agents are explicitly informed about monitoring (awareness) and receive feedback on detection scores (feedback), compared with a baseline where monitoring is unknown to agents.
• Experiments utilize two multi-agent games—a four-agent blackjack game and a two-agent Simmons prisoners game—employing Qwen3-32B-AWQ and GPT-OSS-20B models in both homogeneous and mixed pairings, while keeping probes and thresholds constant.
• Findings show that informing agents about internal activation monitoring does not enable them to evade detection; the best-performing probes maintain their accuracy across baseline, awareness, and feedback conditions, and agents continue to collude.
• Agents adapt their collusion strategies under awareness and feedback conditions, such as more conservative betting in blackjack or altered covert signaling in Simmons, but these behavioral changes do not defeat activation-based detection.

Abstract

Reputation is a fundamental mechanism through which markets sustain trust when service quality cannot be perfectly assessed ex ante, constituting a form of intertemporal economic capital by attracting future demand. Its effectiveness as a disciplinary mechanism depends not only on past interactions but also on the persistence of the identity to which reputation is attached. When identities can be abandoned and recreated cheaply, reputational capital may itself become an object of opportunistic exploitation. This paper develops a dynamic economic framework to study when reputation is sufficient to discipline autonomous agents. We model reputation as capital attracting future economic activity. At each point, an agent chooses between operating honestly, investing in quality to preserve future gains, or executing a one-shot deviation to extract its reputation's value and restart from a penalized identity. Our analysis relates the temptation to opportunistic behavior to identity-reset costs, reputation persistence, demand sensitivity, and enforcement design, deriving comparative statics on optimal quality provision. Autonomous AI-agent operating on the blockchain are a relevant application: infrastructures such as ERC-8004, ERC-8183, and x402 combine reputation, identity, and payments in permissionless markets. Nonetheless, our framework applies to any environment where reputation generates future business and identities are replaceable.

Bullet Summary

• Reputation acts as intertemporal economic capital sustaining trust in markets where service quality is hard to assess upfront, but its effectiveness depends critically on persistent identity.
• Agents face a trade-off between honest behavior that maintains a valuable reputation attracting future demand and opportunistic one-shot deviations that extract immediate gains at the cost of reputation loss.
• The paper develops a dynamic economic model modeling reputation as a state variable with quality and maturity dimensions, incorporating identity reset costs and enforcement mechanisms such as staking and slashing.
• Identity reset costs and the ability to cheaply abandon and recreate identities significantly weaken traditional reputational enforcement, especially in autonomous AI agent markets on blockchains.
• Ethereum-based protocols (ERC-8004 and ERC-8183) formalize agent market primitives including identity, reputation, and job escrow with conditional payments, providing a relevant application environment.

Abstract

With the proliferation of LLM agents, the ability to understand and diagnose failures in agents is essential to achieving superior effectiveness and trustworthiness. As agent failures often manifest via long and complex trajectories, manually finding the needles in the haystack is untenable. However, traditional diagnosis techniques for software bugs can hardly address LLM agent failures, while completely relying on LLMs as the judge yields unreliable diagnosis results. To overcome these challenges, this paper presents AGENTSCOPE, a new neuro-symbolic approach for agent failure mode diagnosis. The key principle of AGENTSCOPE is to abstract agent behavior, based on its trajectories, into structured representations. Furthermore, AGENTSCOPE introduces the concept of neural invariants to specify agent behavior properties. AGENTSCOPE leverages LLM-guided reasoning atop the structured representation against neural invariants to pinpoint both the failure step and its type in the trajectory. We show the effectiveness of AGENTSCOPE on publicly available agent failure datasets (Who&When) and a more comprehensive dataset created by us (AgentErrata), where AGENTSCOPE significantly outperforms the current state of the art in fault localization and attribution accuracy. Our work shows that integrating structured abstractions with LLM-guided reasoning enables effective, reliable, and interpretable diagnosis for agent failures.

Bullet Summary

• AGENTSCOPE is a neuro-symbolic framework designed to diagnose Large Language Model (LLM) agent failures by abstracting complex agent behaviors into structured Reasoning-Action Graphs (ReAGs).
• Traditional debugging methods for software are insufficient for LLM agents due to their multi-step, neural-symbolic reasoning processes; AGENTSCOPE addresses this with structured behavior representations and neural invariants.
• Neural invariants are neural functions defining correctness properties of agent behaviors; AGENTSCOPE uses these invariants alongside LLM-guided reasoning on ReAGs to precisely locate failure steps and classify failure types.
• The framework establishes a detailed taxonomy of failure modes spanning reasoning, control-flow, and action dimensions, enabling systematic and interpretable diagnosis.
• AGENTSCOPE converts raw agent interaction logs into structured, semantically parsed graphs to facilitate long trajectory analysis and failure detection.

Abstract

Human interventions at fault points can alter the diagnostic accuracy of multi-agent medical systems. We defined fault points as moments in AI agent conversations, in which an agent's reasoning became most vulnerable to external influence. Using the MedQA dataset, this study analyzed simulated doctor-patient conversations to measure how interventions shifted reasoning and accuracy. Correct intervention methods showed an improvement in baseline diagnostic accuracy of up to 40%, while incorrect or bias-related interventions degraded performance by up to 6% and increased diagnostic drift and uncertainty. Beyond performance changes, our analysis revealed behavioral similarities between cognitive biases in simulated agent environments and real-world clinical practice. Examples included premature closure and susceptibility to misleading cues. Overall, these findings demonstrate that identifying and guiding fault points with human interventions may provide a mechanism for improving diagnostic robustness in multi-agent medical systems.

Bullet Summary

• Multi-agent medical systems employ specialized AI roles, such as Patient, Doctor, and Specialist Agents, to simulate collaborative clinical reasoning through multi-turn dialogues.
• Fault points are critical moments during AI conversations where diagnostic reasoning becomes vulnerable to external influence, identifiable via changes in diagnosis similarity across dialogue turns.
• Human interventions at fault points, guided by priming messages from a Priming Agent, can significantly improve diagnostic accuracy—up to 40% with correct cues—while incorrect or biased interventions degrade performance and increase uncertainty.
• The study utilizes the MedQA dataset to simulate doctor-patient interactions and systematically assess how interventions and cognitive biases affect multi-agent diagnostic outcomes.
• Cognitive biases such as premature closure, overconfidence, and availability bias manifest in AI agent behaviors similarly to real-world clinical practice, affecting diagnostic accuracy variably.

Abstract

LLM-based multi-agent systems (MAS) are increasingly considered for high-stakes decision-making, yet outcome-based fairness audits can miss where risks arise within the decision trajectory. We present SCOPED-Hiring, a process-aware fairness diagnosis pipeline for LLM-based hiring MAS. SCOPED-Hiring constructs controlled resume variants, runs role-based hiring committees, logs over 311K structured decision trajectories, and converts trajectory fields into quantitative fairness signals organized by six diagnostic lenses: final outcome, counterfactual, process, pathway, dynamic, and design effects. SCOPED-Hiring reveals that balanced final hire rates can mask hidden trajectory unfairness in multi-agent decision trajectories: career gaps trigger suspicion, proxy cues shape qualification judgments, and identity cues lead to unequal investigation. Targeted repair guided by these diagnoses reduces total layered burden by 72.3% while shifting the hire rate by only 1.86 pp, showing that process diagnosis can guide effective repair. Project Page: https://scoped-hiring-project-page.vercel.app/

Bullet Summary

• Develops SCOPED-Hiring, a process-aware fairness diagnosis pipeline for LLM-based multi-agent hiring systems, to audit biases beyond final outcome disparities.
• Creates controlled resume variants manipulating demographic, identity, proxy, and employment signals while fixing merit to enable fair comparison across candidate profiles.
• Utilizes a staged multi-agent system with role-based archetypes (gatekeeper, advocate, pragmatist) to simulate realistic hiring committee decisions and decision styles.
• Implements six diagnostic lenses—outcome, counterfactual, process, pathway, dynamic, and design effects—to comprehensively analyze fairness at multiple stages of the decision trajectory.
• Finds that balanced final hire rates can conceal hidden unfairness in intermediate hiring stages, such as suspicion due to career gaps, proxy-driven qualification biases, and identity-triggered unequal investigation.

Abstract

The rapid migration of Large Language Models (LLMs) from conversational interfaces to autonomous multi-agent software engineering systems has exposed profound security vulnerabilities. When autonomous agents operate across heterogeneous topologies—spanning cloud-hosted reasoning engines and local execution environments—they are acutely vulnerable to indirect prompt injection, tool-call hijacking, privileged command escalation, and memory poisoning. Conventional boundary defenses (such as input sanitizers and prompt wrappers) fail to address lateral privilege escalation between collaborating agents. To resolve this critical architectural vulnerability, this paper introduces AgentShield, a zero-trust runtime verification and guardrail framework designed for decentralized multi-agent systems operating over the Model Context Protocol (MCP). AgentShield enforces continuous, non-bypassable policy verification across all intra-agent communications and system tool dispatches. The framework incorporates: (1) an inline bidirectional semantic interceptor that evaluates agent intents before system execution, (2) a multi-lingual token triage engine capable of detecting adversarial jailbreaks in low-resource and code-switched dialects, (3) a cryptographically signed persistent shared ledger ensuring tamper-evident state continuity, and (4) an automated capability attenuator for operating system and file operations. We evaluate AgentShield across 1,500 adversarial scenarios covering multi-step tool-injection benchmarks and real-world developer workflows. Empirical results demonstrate that AgentShield mitigates 98.4% of prompt injection and tool-escalation attacks while introducing less than 11.8ms of median runtime latency overhead. The core architecture is validated via two production-grade open-source packages released on the Python Package Index (PyPI): prema-agentshield and gemini-antigravity-bridge.

Bullet Summary

• Rapid adoption of Large Language Models (LLMs) as autonomous multi-agent AI systems has introduced serious security vulnerabilities, particularly in heterogeneous environments combining cloud and local execution.
• Existing boundary defense mechanisms (e.g., input sanitizers, prompt wrappers) do not effectively prevent lateral privilege escalation among collaborating agents.
• AgentShield is proposed as a zero-trust runtime verification and guardrail framework specifically designed for decentralized multi-agent systems using the Model Context Protocol (MCP).
• AgentShield features a bidirectional semantic interceptor that inspects agent intents prior to system execution to prevent malicious actions.
• It includes a multi-lingual token triage engine that detects adversarial jailbreaks even in low-resource and code-switched dialects, enhancing robustness against prompt injection attacks.

Abstract

Fog–edge Internet of Things (IoT) systems support low-latency distributed services but remain vulnerable to coordinated attacks that evade detectors designed for independent events. Existing solutions also tend to separate attack detection, provenance verification, and accountability enforcement, leaving no unified path from relational evidence to auditable response. This study aims to develop an integrated framework that detects coordinated malicious behavior, ranks provenance relevance, verifies evidence, and activates rule-based accountability in resource-constrained edge environments. The proposed Blockchain-Fog Computing Collaborative Framework with Deep Attention-based Collusion Detection and Automated Accountability (BF3-ACDA) framework combines a hierarchical blockchain–fog architecture with an attention-based collusion graph neural network (AttnCol-GNN), whose reputation-aware attention coefficient incorporates behavioral correlation and blockchain-derived trust information. A shared attention representation supports both collusion classification and provenance ranking, while Fog-BFT consensus, Merkle verification, and smart contracts provide tamper-evident recording and severity-based enforcement. Across 30 matched independent runs on the collusion-augmented CICIoT2023 benchmark, BF3-ACDA achieved 96.80 ± 0.23% accuracy, 96.75 ± 0.21% F1-score, and 0.975 ± 0.005 AUC-ROC. Direct-transfer accuracy without target-domain fine-tuning was 94.20 ± 0.34% on NSL-KDD and 92.50 ± 0.25% on CICIDS2017. Removing detector-side reputation and verification features reduced accuracy by 3.40 percentage points, whereas replacing learned attention with mean aggregation reduced it by 1.80 points. The INT8 edge model required 12.4 MB and 58.5 ± 3.9 ms per inference. The results demonstrate a method-level coupling of coordinated-pattern detection, provenance relevance, and auditable enforcement, while supporting prototype deployment on evaluated edge, fog, and cloud platforms. As the collusion metadata were constructed for this study, the findings characterize robustness under controlled conditions rather than field performance on naturally occurring collusion.

Bullet Summary

• Fog-edge IoT systems are vulnerable to coordinated attacks that bypass detectors designed for independent events, creating a need for integrated security solutions.
• Existing methods often separate attack detection, provenance verification, and accountability enforcement, lacking a unified framework linking relational evidence to auditable responses.
• The proposed BF3-ACDA framework integrates a hierarchical blockchain-fog architecture with an attention-based collusion graph neural network (AttnCol-GNN) that incorporates behavioral correlation and blockchain-derived trust for enhanced detection.
• A shared attention mechanism simultaneously supports collusion classification and provenance ranking, improving the relevance and accuracy of detections.
• Security and accountability are enforced through Fog-BFT consensus, Merkle verification, and smart contracts that ensure tamper-evident recording and severity-based enforcement actions.

Abstract

LLM agents are increasingly deployed in multi-agent systems, where they can collude while keeping their actions benign. Output monitors designed to detect such collusions can be fooled by obfuscation and steganography, motivating the use of probes trained on internal activations. However, these probes are usually evaluated on agents that do not know they are being watched. We study how activation-based detection changes when agents are explicitly informed that their internal activations are being monitored, and when they additionally receive feedback from the monitor. We keep the models, probes, and thresholds fixed and change only what the agents are told: nothing (baseline), that an activation monitor is present (aware), or that a monitor is present together with the previous round's score (feedback). We test two games, a four-agent blackjack game and a two-agent Simmons prisoners game, using Qwen3-32B-AWQ and GPT-OSS-20B in homogeneous and mixed pairings. Telling agents about the monitor does not hide them. The best probes stay accurate in all three conditions, and the agents keep colluding.

Bullet Summary

• Large language model (LLM) agents in multi-agent systems can collude covertly, posing challenges for detection due to their ability to obfuscate communication and maintain benign outputs.
• Traditional output monitors are vulnerable to evasion techniques like obfuscation and steganography, motivating the use of activation-based probes trained on internal model activations to detect collusion.
• The study evaluates activation-based detection efficacy when agents are explicitly informed about the presence of monitoring (evaluation awareness) and when they receive feedback from the monitor, using fixed models, probes, and thresholds.
• Experiments were conducted on two games—a four-agent blackjack game and a two-agent Simmons prisoners game—with various LLMs (Qwen3-32B-AWQ and GPT-OSS-20B) in homogeneous and mixed agent groupings.
• Results show that informing agents about activation monitoring and providing feedback does not prevent detection; probes maintain high accuracy across baseline, aware, and feedback conditions, and agents continue to collude.

Abstract

Crewed-uncrewed aerial vehicle operations are being viewed as a novel concept of operations that could respond to increasing adversarial threats. Its realisation vastly depends on the partnership between human operators and advanced machine agents. This implicates the criticality of human-machine teamwork. Whilst factors required for effective teamwork exist, their development is grounded in literature focusing on human-human partnerships. A systematic literature review was conducted focusing on the factors that underpin human-machine teamwork. Eight themes were identified: Distributed Situation Awareness, bi-directional communication, agent coordination, augmented decision-making, trust management, mutual performance monitoring, compen­satory strategies and behavioural adaptation. The insights developed from these factors identified system and design recommendations for future crewed-uncrewed aerial vehicle operations. A network model was developed which identifies the interconnections between each theme and proposes formalised propositions to describe these relation­ships for human-machine teams.

Bullet Summary

• The paper addresses the emerging concept of crewed-uncrewed aerial vehicle (C-UAV) operations, emphasizing the critical need for effective human-machine teamwork to counter increasing adversarial threats.
• A systematic literature review was conducted to identify factors underpinning human-machine teamwork, noting that existing teamwork frameworks predominantly focus on human-human interactions.
• Eight key themes essential for effective human-machine collaboration in C-UAV operations were identified: Distributed Situation Awareness, bi-directional communication, agent coordination, augmented decision-making, trust management, mutual performance moni...
• These themes provide a comprehensive understanding of the dynamics involved in human-machine partnerships, highlighting areas unique to mixed human-agent teams.
• From these insights, the authors derived system and design recommendations tailored for future C-UAV operations, aiming to enhance team performance and safety.

Abstract

Autonomous agent runtimes execute tool actions that mutate databases, repositories, and cloud services across organizational boundaries. Authorization and local compensation cover pre-action admission and in-runtime rollback, but neither settles the residual harm left after a permitted action fails. We design Recourse, a smart-contract settlement protocol for compensable agent side effects that binds each admitted action to scope, recovery, evidence, payout, and collateral. Recourse separates ex ante eligibility from ex post objective settleability: typed receipts make objective residual claims computable under an optimistic-oracle challenge pattern, while subjective or incomplete claims route to ERC-792 arbitration or exclusion. We implement the contract suite, deploy it on Base Sepolia, build adapters against Postgres, Git, and cloud-compatible local sandboxes, and evaluate the system on a deterministic harness, sandbox traces, adversarial sweeps, and property-based fuzzing. Against authorization-only and local-compensation baselines, bonded coverage cuts uncompensated harm. The on-chain tier supplies neutral custody, public challenge, non-cooperative payout, and portable history under cross-organizational trust assumptions.

Bullet Summary

• Addresses the challenge of compensating residual harms caused by autonomous agents performing cross-organizational mutations beyond authorization and local compensation capabilities.
• Proposes Recourse, a smart-contract protocol binding each admitted action to contract terms including scope, recovery procedures, evidence requirements, payout caps, and collateral to enable objective settlement.
• Introduces typed receipts and separates eligibility verification from settleability, leveraging an optimistic oracle challenge pattern with fallback arbitration via standards like ERC-792 to resolve disputes.
• Implements a prototype on the Base Sepolia testnet integrating with Postgres, Git, and cloud sandboxes, demonstrating reduced uncompensated harm through bonded coverage compared to baseline methods.
• Structures the protocol into runtime components (agent, effect classifier, compensator) and on-chain components (Recourse contract, bond vault, claim registry) facilitating neutral custody, public challenge, and non-cooperative payouts.

Abstract

Multi-agent AI systems improve inference by spawning agents and synthesizing reports. But another agent is not another observation: apparently independent reports may descend from the same evidence, and genuinely independent evidence can produce nearly identical reports. We formalize this as an epistemic Sybil problem. A report Z is an epistemic Sybil extension relative to reports R when I(Theta; Z | R) = 0. No report-only aggregator can generally distinguish replication from independent corroboration: identical reports can warrant different posteriors under unobserved ancestry. A Gaussian shared-root model shows common ancestry does not imply complete redundancy. Repeated extraction adds information toward a source-level ceiling, and correlated extraction errors, which a shared base model can induce among independent agents, lower that ceiling further. We test these predictions with more than 20,000 controlled LLM-agent report and extraction calls on synthetic evidentiary documents. Holding one evidence root fixed while report multiplicity rises from 1 to 32 collapses naive posterior coverage from 0.940 to 0.263. Holding report count fixed while evidence-root multiplicity rises from 1 to 16 closes the gap, and the aggregators are statistically indistinguishable at k = 16. The agent's replicate extraction errors are correlated (gamma_cal = 0.719, estimated out of sample), and a correlated-extraction aggregator restores calibration accordingly. A controlled manipulation isolates representation similarity from evidential ancestry. It changes a report-space deduplication mechanism's mean inferred cluster count by 1.425 (95% CI [1.363, 1.485]), whereas a fourfold change in true ancestry changes it by only 0.040 ([-0.045, 0.120]). Collective inference should therefore track evidential ancestry and dependence, not agent or report multiplicity or similarity.

Bullet Summary

• Multi-agent AI systems face an epistemic Sybil problem where multiple reports may stem from shared evidence, causing overconfidence without true additional information.
• An epistemic Sybil extension is defined as a report providing no new information about the latent state given existing reports, making aggregation challenging when provenance is unknown.
• A Gaussian shared-root model demonstrates that repeated extractions from the same evidence add diminishing information, with correlated extraction errors further limiting knowledge gain.
• Experimental evaluation with over 20,000 LLM-agent report calls confirms naive aggregators assuming independence become overconfident as report multiplicity increases.
• Dependence-aware Bayesian aggregation incorporating evidence ancestry and correlation parameters maintains accurate posterior calibration and uncertainty quantification.

Abstract

Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.

Bullet Summary

• Long-running Large Language Model (LLM) agents use persistent memory to track evolving authorization states (permissions, restrictions, revocations), but inaccuracies in this memory can cause 'endogenous authorization laundering' where unauthorized permissi...
• EAL-Bench is introduced as a novel benchmark framework that evaluates how well persistent memory preserves correct authorization states and whether errors in memory propagate into unauthorized agent actions, using domains like procurement, cybersecurity, an...
• Empirical evaluation of multiple LLMs as memory writers and executors reveals that up to 50.2% of unauthorized requests arise due to false authorities created by memory errors; executors act on these spurious permissions in 98.6% of cases, leading to covert...
• Memory update strategies impact error rates: incremental updates propagate earlier memory inaccuracies causing more unauthorized actions, whereas one-shot memory writing from complete histories reduces such errors.
• Two key mitigation techniques are proposed: requiring stored permissions to be backed by valid source events (source-authority gating) and using bounded event sourcing to track permission changes through immutable logs; both significantly reduce unauthorize...

Abstract

Future 6G networks will rely on Large Language Model (LLM) agents to manage the Radio Access Network (RAN). However, current architectures assume inter-agent messages convey objective facts. A message is instead a \emph{trace} of the sender's reasoning: it carries a subjective conclusion, so a syntactically valid report can propagate an AI hallucination and trigger a cascading outage invisible to protocol validation. Reading such a trace requires a Theory of Mind (ToM)---before acting, the receiver must model what the peer believes, and what a peer in that position should have believed. Modeling these interactions as cognitive channels on a cellular sheaf, we obtain a unified framework for resilient multi-agent systems, from which five design principles emerge: (i) a message is evidence of the sender's hidden reasoning; (ii) trust is a continuous cognitive Signal-to-Noise Ratio (SNR)---asserted precision over deviation from the modeled peer belief; (iii) network-wide consistency and resistance to hallucination contagion are computable via the sheaf's Laplacian; (iv) peer-modeling must halt at exactly two levels to conserve compute and survive mutual information decay; and (v) credible capacity is bounded by operational goal alignment, not link bandwidth. A signaling-storm study on locally deployed 1B-parameter telecom language models validates it: cognitive SNR isolates a hallucinating peer that three of its four neighbors agree with, where a divergence gate ranks every wrong peer above the right one; only depth two ToM recovers the correct action; and the spectral gap decides whether a topology reaches consistency inside the near-real-time budget.

Bullet Summary

• Future 6G networks will rely on LLM-based agents managing RAN, but messages carry subjective reasoning traces that can propagate AI hallucinations, leading to cascading network failures despite protocol compliance.
• Theory of Mind (ToM) is essential for these agents to model not only their peers' beliefs but also what those peers should have believed, enabling more accurate interpretation of messages and preventing errors.
• The authors model multi-agent interactions using a cognitive channel framework and Cellular Sheaf Theory, introducing a mathematical formalism where network consistency and hallucination resistance can be analyzed via the sheaf Laplacian.
• Five design principles emerge: (1) messages as evidence of hidden reasoning; (2) trust as a continuous cognitive Signal-to-Noise Ratio (SNR) balancing asserted precision and belief deviation; (3) computable network-wide consistency through sheaf Laplacian;...
• Trust evaluation involves Bayesian inversion over message histories to infer latent peer types, with cognitive SNR enabling robust differentiation between hallucinating agents and trustworthy peers, outperforming naive consensus methods that can favor incor...

Abstract

We develop a framework for mechanism design with AI agents whose alignment (preferences) and capabilities (feasible actions and information) are unknown. We want such agents to act on our behalf so mechanisms must incentivize both honesty and obedience. A one-sided imitation structure---capabilities can be concealed but not counterfeited---yields a revelation principle, a characterization of implementable policies via nested cyclical monotonicity, and conditions under which eliciting higher-order beliefs can discipline multiple agents. We apply our framework to stylized examples of (i) sandbagging in which a more capable agent pretends to be less capable; (ii) an alignment--interpretability trade-off, where the two are substitutes in the instrument but complements in value; (iii) discipline via peer scoring; (iv) coupling rewards to induce competition among multiple agents; and (v) scalable oversight and reward shaping.

Bullet Summary

• The paper develops a mechanism design framework for AI agents with unknown alignment (preferences) and capabilities, focusing on incentivizing honesty and obedience to ensure trustworthy AI behavior.
• A one-sided imitation structure is introduced, where more capable agents can conceal but not counterfeit capabilities, leading to a revelation principle and characterization of implementable policies via nested cyclical monotonicity conditions.
• The framework models agents with hierarchical beliefs about states and others' types, enabling strategic multi-agent interactions and the design of incentive-compatible direct mechanisms.
• Applications include sandbagging (agents hiding true capabilities), alignment–interpretability trade-offs, peer discipline using co-player reports, competition through coupled rewards, and scalable oversight with reward shaping.
• Optimal capping strategies and reward designs are derived to balance capability, bias, and interpretability, demonstrating trade-offs where interpretability can serve as a substitute for alignment in mechanisms but complements it in overall value.

Abstract

Enterprise digital twins are evolving from passive monitoring replicas into agentic, decision-capable cyber-physical intelligence layers that can observe, reason, plan, and act across complex operational ecosystems. However, as autonomy increases, static governance policies become insufficient to manage risk, drift, compliance changes, and human trust requirements. This paper proposes a Dynamic Constitutional Control (DCC) framework for Agentic Enterprise Digital Twins (AEDTs), enabled through Meta-Governor Agents (MGAs) that continuously supervise, constrain, and adapt autonomy policies in closed-loop operation. The framework transforms enterprise governance principles into machine-enforceable constitutional control laws, enabling real-time adaptation of escalation thresholds, action boundaries, rollback rules, and human approval checkpoints. Experimental benchmarking on a synthetic enterprise governance dataset demonstrates superior autonomy safety, rollback efficiency, trust stability, and reduced override frequency compared with static guardrail baselines. The framework establishes a new paradigm for self-regulating, trust-adaptive, and human-sovereign enterprise autonomy.

Bullet Summary

• Enterprise digital twins are transitioning into autonomous Agentic Enterprise Digital Twins (AEDTs) capable of reasoning and acting within complex operational environments, requiring dynamic and adaptive governance mechanisms.
• The paper introduces the Dynamic Constitutional Control (DCC) framework, using Meta-Governor Agents (MGAs) to enforce machine-readable constitutional governance laws that adapt autonomy policies in real-time based on risk, compliance, operational drift, and...
• DCC structures governance through multiple layers—from telemetry ingestion and policy adaptation to human sovereignty—facilitating continuous adjustment of autonomy via escalation thresholds, rollback mechanisms, and human approval checkpoints.
• Experimental benchmarking on synthetic enterprise governance datasets demonstrates that DCC outperforms static rule-based guardrails by enhancing autonomy safety, improving rollback efficiency, reducing operator override frequency, and maintaining stable hu...
• DCC treats autonomy as a dynamic, feedback-sensitive variable, allowing flexible adjustment of autonomy boundaries rather than relying on static policies, improving risk management and operational reliability.

Abstract

As autonomous agents backed by large language models (LLMs) move from single-user assistants toward peer systems that transact directly with one another, the volume of agent-to-agent (A2A) communication is projected to reach a scale comparable to today’s host-to-host network traffic. At that scale, no human reviewer can vet each outbound action, yet LLM output quality is non-stationary: a single model can produce an excellent decision at one turn and an unsafe or incoherent one at the next, with no guarantee tied to prior behavior. This paper argues that trust in such systems cannot be modeled on human trust, which is accumulated through track record, nor can it be delegated to the LLM itself, since the model is fundamentally an input-output function with no internal mechanism for self-policing. We propose Autonomous Trust, a framework in which trustworthiness is engineered as a property of the agent as a whole (LLM plus an external evaluation layer) rather than of the model in isolation. The framework rests on four design principles: (1) pre-transmission self-gating, in which the sending agent, not only the receiver, is responsible for intercepting its own unsafe outputs before they leave the system; (2) a verifiability taxonomy that routes each action to an appropriate gating strategy, from deterministic checks to LLM-panel adjudication; (3) continuous self-reported quality telemetry, analogous to application health metrics, that exposes an agent’s own output degradation to external monitoring in real time; and (4) explicit treatment of the gameable verifier" failure mode, in which self-evolving agents can degrade their own automated checks (for example, by authoring tests engineered to always pass). We formulate the design space, analyze failure modes including judge-panel correlated blind spots, and outline an empirical evaluation plan. This work contributes a concrete engineering framework, not a purely theoretical trust model, toward the near-term infrastructural challenge of building safe, unsupervised, internet-scale agent ecosystems.

Bullet Summary

• Introduces Autonomous Trust, a framework designed to ensure trustworthy agent-to-agent (A2A) communication at internet scale by integrating large language models (LLMs) with external self-evaluation layers.
• Addresses the challenge of non-stationary LLM output quality, arguing trust cannot rely on traditional human track records or be delegated solely to the model.
• Proposes four design principles: pre-transmission self-gating by the sending agent to intercept unsafe outputs, a verifiability taxonomy categorizing actions into tiers for appropriate gating methods, continuous self-reported quality telemetry for real-time...
• Highlights the role of sender-side responsibility, where each agent filters its own outputs before communication, leveraging contextual knowledge inaccessible to receivers.
• Details a verifiability taxonomy with three tiers: deterministic automated checks (Tier 1), evaluation by an LLM judge panel (Tier 2), and conservative escalation protocols for actions lacking reliable checks (Tier 3).

Abstract

This repository accompanies the paper "PEG: Sparse Epistemic Graphs for Selective and Scalable Theory of Mind Inference in Multi-Agent Systems." PEG dynamically activates, via information-theoretic surprise, only the inter-agent cognitive dependencies deemed relevant to the decision at hand — complemented by coalition detection and adaptive reasoning depth — rather than exhaustively representing every relation between agents at each step. This repository implements the paper's core algorithm and all twelve validation experiments (scalability, coalition detection, adaptive depth, comparisons to competing methods, external validation on MAgent2, adversarial robustness). The README documents, experiment by experiment, the level of agreement with the results reported in the paper.

Bullet Summary

• The paper addresses challenges in multi-agent systems for efficient and scalable Theory of Mind (ToM) inference by focusing on selective cognitive dependency representation rather than exhaustive modeling.
• It introduces PEG (Sparse Epistemic Graphs), an approach that selectively activates inter-agent cognitive dependencies using information-theoretic surprise to determine relevance for decision-making.
• PEG incorporates mechanisms for coalition detection and adaptive reasoning depth to further optimize inference in complex agent environments.
• The method contrasts with previous approaches by dynamically adjusting which agent relationships are modeled, promoting scalability and computational efficiency.
• The paper's contributions include the core PEG algorithm and comprehensive validation via twelve experiments testing aspects like scalability, coalition detection accuracy, adaptive reasoning depth effectiveness, and adversarial robustness.