admission control

Traditional programming models lack structured mechanisms for governing side effects, making it difficult to reliably oversee the behavior of autonomous systems. This work proposes an intent-driven computing model in which programs generate only declarative “intents” describing proposed actions. These intents are then vetted by a managed runtime against a decidable policy language and, upon approval, recorded in a tamper-evident ledger before execution. By shifting governance from the undecidable domain of program semantics to the decidable domain of intent data, the approach enables event sourcing, intent replay, structured auditing, and high human interpretability. An implementation atop the BEAM virtual machine integrates Rocq formal verification—encompassing 454 theorems—and over 70,000 property-based tests, achieving full verification of the specification’s null hypothesis lemma and strong alignment between implementation and formal specification, thereby establishing the first programming model for autonomous systems with built-in governance capabilities.

Existing safety mechanisms struggle to constrain the option-generation and presentation authority of autonomous agents in high-stakes, regulated environments, often leading to irreversible decision risks. This work proposes a novel governance architecture that shifts the focus from intent alignment to the control of “choice power.” By structurally decoupling cognition, selection, and action, and integrating mechanisms such as external candidate generation (CEFL), controlled reducers, commit-reveal entropy isolation, rationale validation, and explicit fault circuit breakers, the framework enforces quantifiable bounds on an agent’s causal power. Empirical evaluations in financial adversarial settings demonstrate that the approach effectively prevents deterministic outcome manipulation, significantly reduces choice concentration, enhances narrative diversity and governance transparency, and preserves the agent’s original reasoning capabilities.

Existing autonomous systems lack enforceable guarantees on the permissibility of state transitions in concurrent environments, often leading to uncontrolled or non-compliant changes. This work introduces the concept of an “atomic decision boundary,” which tightly couples policy evaluation with state transition into an indivisible operation. Formalized using labeled transition systems (LTS), the approach distinguishes atomic systems from those employing decoupled evaluation. The study demonstrates, for the first time, that under concurrent semantics, decoupled evaluation is not equivalent to atomic execution and that classical TOCTOU (Time-of-Check-to-Time-of-Use) analyses overlook a critical “Escalate” scenario requiring atomicity. It further proves that the atomic decision boundary constitutes a necessary structural condition for ensuring permissibility across all execution traces, thereby establishing a theoretical foundation for runtime governance. This paper is the inaugural contribution to the Agent Governance series.

This paper investigates whether deterministic computation can be fully characterized by a finite algebraic system analogous to Kleene Algebra with Tests (KAT). Specifically, it addresses whether the deterministic fragment of KAT admits a finite set of control-flow operations sufficient to generate all deterministic finite-state computations. Method: Drawing on formal language theory, algebraic semantics, regular algebra, and model-theoretic techniques, the authors rigorously analyze the expressive limitations of finite algebraic signatures over deterministic automata. Contribution/Results: The paper establishes, for the first time, that no finite set of control-flow primitives can axiomatize the entire class of deterministic finite-state computations—thereby refuting the existence of a KAT-style complete algebraic framework for determinism. This result demonstrates an intrinsic incompleteness in the algebraic characterization of deterministic computation and reveals a fundamental expressiveness boundary of classical control structures (sequence, conditionals, loops), advancing foundational understanding of computational representability in program algebras.

Traditional binary correctness verification fails to capture quantitative system behaviors. Method: We propose the first automated toolkit for quantitative automata supporting six classical semantics—Inf, Sup, LimInf, LimSup, LimInfAvg, and LimSupAvg—and systematically address core decision problems: emptiness, inclusion, equivalence, and safety/liveness verification. Our approach introduces weighted transition modeling and a generalized value-function framework, integrating symbolic decision procedures, optimization solvers, and automata transformation techniques to enable extremal-value computation, safety-liveness decomposition, and real-time monitoring. Contribution/Results: Experiments demonstrate efficiency on inclusion checking, constant-function recognition, and online monitoring tasks. We release the first open-source benchmark suite for quantitative automata analysis, establishing a scalable, modular, and unified infrastructure for quantitative system verification.

This study addresses the challenge of providing certifiable runtime safety guarantees prior to tool invocation, focusing on three core issues: the representability of policy states, the observability of monitoring evidence, and the impact of interventions on future behavior. To this end, we propose the first formal theoretical framework for runtime safety-executable boundaries, distinguishing among static policy executability, statistical calibration under exogenous legal constraints, and closed-loop intervention effects. Building upon finitely controlled models, we develop a method for closed-loop safety certification that integrates register model identification, Neyman–Pearson hypothesis testing, conformal calibration, and occupancy planning. Empirical validation through static diagnosis, model enumeration, representation rewriting, and closed-loop re-execution experiments demonstrates the efficacy of our approach and exposes the fundamental limitations of static calibration under representation attacks.

This work addresses the high computational cost of full power flow calculations in real-time N-1 thermal security assessment and the lack of statistical safety guarantees in existing fast linear methods under deployment shifts. The authors propose an audit-based selective verification framework that employs a lightweight proxy model to pre-screen contingencies eligible for skipping, complemented by online randomized full power flow audits. By leveraging a risk budget and confidence bounds, the method provides theoretical guarantees on the thermal violation rate of the skipped set. Notably, it achieves statistically safe, lightweight screening under arbitrary deployment shifts—relying on actual verification and online auditing rather than proxy accuracy—and is compatible with diverse controller outputs. Evaluations on three public transmission systems demonstrate that the actual violation rate consistently remains below the allocated budget, reducing full power flow computations by 29%–75% while preserving safety under deployment shifts.

Current evaluations of AI systems predominantly rely on static benchmarks, which fail to capture behavioral risks in dynamic real-world environments. This work formalizes AI auditing as an uncertainty-aware, dynamic constraint monitoring problem across the system’s entire lifecycle, targeting critical attributes such as fairness and safety while integrating sociotechnical norms with statistical risk control. By developing a theoretical framework and supporting infrastructure for continuous auditing, the study advances AI governance beyond one-off testing toward ongoing, reliable, and accountable oversight mechanisms.

This work identifies and quantifies a previously overlooked failure mode in tool-augmented large language model agents—“silent errors”—where agents violate domain-specific constraints without observable indications, leading to undetected erroneous states. To address this, the authors propose a lightweight, deterministic pre-execution gating mechanism that performs read-only validation of tool-call requests against the current system state prior to any write operation, ensuring compliance with prescribed policies. The approach integrates tool-call verification with policy enforcement and is evaluated on a newly introduced benchmark, τ²-bench. Experimental results demonstrate that, when applied to GPT-4o-mini, the method improves overall task success rate from 29.6% to 42.0% (+12.4 percentage points), with a 19.2-percentage-point gain specifically on tasks triggering the gating mechanism.

This work addresses the frequent integration failures in collaborative software development caused by concurrent code changes—such as edit conflicts, scope violations, or broken dependencies—among parallel coding agents. The authors propose a model-agnostic coordination framework that formulates concurrent edits as a pre-write admission problem, leveraging declarative ChangeIntents and a deterministic control plane to enforce atomic admission, scoped constraints, and dependency tracking. By decoupling probabilistic planning from deterministic permission control, the architecture introduces dynamic scope elevation and failure containment mechanisms, enabling fine-grained parallelism while preserving safety. Empirical evaluation on CooperBench demonstrates that the framework achieves full success (6/6) in static scenarios, maintains parallel admission in all dynamic cases (3/3), successfully executes seven scope elevations, and safely rejects two undeclared modifications.