Securing Agentic AI: From Per-Action Checks to Trajectory Assurance

2026-08-02

AI Summary

This work addresses the limitation of existing autonomous agents, which typically ensure compliance only at the level of individual actions and struggle to maintain system-wide safety constraints throughout an entire task. To overcome this, the paper proposes a verifiable safety architecture spanning the agent’s full stack, embedding safety into its design, interaction protocols, and runtime mechanisms. The framework establishes a multi-layered assurance system—from input sanitization and multi-agent trust establishment to behavioral trajectory verification—by integrating formal verification, runtime monitoring, identity and capability control, model provenance, and end-to-end observability. This approach enables behavior containment that extends from pointwise safeguards to trajectory-level constraints, offering a scalable and verifiable deployment pathway for large language model–driven autonomous agents and effectively addressing complex security challenges in cross-organizational settings.

Abstract

Autonomous agents are increasingly used to execute consequential tasks in environments governed by operational constraints, organizational policies, regulatory requirements, and technical standards. Their safety is therefore determined not by the correctness of individual actions, but by whether their overall behavior remains consistent with the rules and invariants of the systems in which they operate. As large language model (LLM)-based agents become more autonomous and increasingly delegate tasks across organizational boundaries, securing them evolves from a single challenge into a broad and interconnected landscape spanning the entire agentic stack. At the single-agent level, untrusted inputs through prompts, memory, retrieved knowledge, and tool interfaces create attack surfaces. In multi-agent settings, delegation and communication introduce challenges related to identity, trust, capability control, and decision transparency, while the underlying model routing and execution control plane remains vulnerable to manipulation and to unverified model provenance. Perhaps the most fundamental challenge is behavioral containment: sequences of individually permissible actions may collectively violate system-level constraints and safety invariants. At the broader level, supply-chain integrity, provenance, accountability, and end-to-end observability remain largely open problems. A common principle unifies these directions: security must become a verifiable property of the architectures, protocols, and runtimes that govern agent behavior, rather than an optional layer of guidance. Charting these challenges provides a roadmap toward trustworthy autonomous agent deployment.

Problem

• Agentic AI
• Trajectory Assurance
• Behavioral Containment
• Security
• Autonomous Agents

Innovation

• Trajectory Assurance
• Behavioral Containment
• Agentic Security
• Verifiable Safety
• Multi-Agent Trust