Aug 2026· Computers· Vol 15, pp. 510· 0 citations· 4 references
TL;DR
This work proposes composition attestation, a runtime control complementary to identity governance, and proposes a two-stage operator: a component diff detects that the composition changed; a capability-closure stage detects when it authorized something new.
Abstract
Agent identity governance governs an agent’s identity, credentials, and lifecycle, but assumes the composition it was approved with is the composition it runs with. That stability assumption is unenforced: no lifecycle mechanism evaluates an agent’s evolving composition against its approved baseline. An agent’s effective composition—tools, data sources, delegated authorities, child agents—is a runtime supply chain of capability, and it drifts. We introduce composition drift, the departure of effective composition from the terms of approval, and isolate its sharpest form, compositional drift: individually approved changes accumulating into a capability none authorized alone. We formalize this with a two-stage operator: a component diff detects that the composition changed; a capability-closure stage detects when it authorized something new. The contribution is a temporal governance model linking emergent capability to reauthorization and inventory reconciliation. Drift produces shadow infrastructure: resources provisioned outside any inventory through benign, individually approved pathways. We propose composition attestation, a runtime control complementary to identity governance, and evaluate it in a pre-registered study. Across five thousand trajectories the detector separates compositional drift from authorized growth where a static analyzer cannot; an ablation isolates the primitives that cause it; and, in controlled live agent runs across three models (9B to 70B parameters, Llama and Qwen lineages), agents given only benign tasks provision unauthorized shadow infrastructure in 59% to 99% of drift-conducive trials against 0% to 19% of matched controls.
Software systems have traditionally been organized around applications where human users act as principal decision-makers. Recent developments in agentic capabilities alter this paradigm: software agents now autonomously translate high-level goals into structured tasks, orchestrating tools, services and sub-agents to execute complex workflows. This evolution gives rise to an agent economy where these autonomous agents capture real economic value. However, the infrastructure required to support the agent economy fails across three critical dimensions: the absence of persistent identity infrastructure prevents systemic accountability in agentic workflows; capability claims remain self-declared not backed by verifiable execution evidence; and the disconnect between creator identities, agent performance, and project value hinders the economic valuation of agents as assets. While existing registries provide naming and discovery, unifying these features around a persistent identity anchor remains largely unaddressed. TessIndex is a capability-verified identity system for agent primitives that utilizes a dual-plane architecture: the blockchain records compact commitments for identity, ownership, and verification, while centralized servers maintain dynamic metadata for discovery, commerce, and reputation. It establishes: persistent identities across agent primitives to enforce systemic accountability in autonomous workflows; a predicate-based verification process replacing self-declared claims with cryptographic capability proof; an identity infrastructure that links agent performance to both project and creator identities while capturing value through tokenization. Ultimately, TessIndex serves as an integrated infrastructure that binds an agent's existence across capabilities, execution, and reputation into a single persistent identity.
SAGE-Fin is presented, a finance-specific authority-handoff contract that makes the proposed effect, not merely its text, the object of runtime control, and its results establish executable conformance, not independent safety accuracy.
Rui Tang, Qiang Liu, Yichi Zhang et al.· 0 citations
AI agents are moving from advisory interfaces into systems that execute consequential operations: issuing refunds, reserving scarce inventory, provisioning cloud resources, and initiating financial transfers. These workflows require governance over effects, not only over model outputs. Existing safeguards often decide whether an action is allowed from the information available when the action is requested. For stateful policies, that request-time view may be incomplete: budgets, inventory, approval status, and risk signals can change before the effect occurs, making an earlier authorization or approval stale. This paper studies stateful governance for concurrent agentic systems. We identify stale authorization as the core failure mode and define policy-state serializability, a correctness condition requiring committed effects to be explainable as authorized against the policy state immediately before they occur. We present MasuGate, a runtime architecture that keeps policies as reviewable programs while coordinating the state and effects needed to preserve their decisions. In experiments with a PostgreSQL-backed prototype of MasuGate, the system prevents stale authorizations missed by baselines that pass policy state as ordinary request context, preserves delayed approvals while unrelated work proceeds, keeps policy evolution mostly in policy text rather than trusted provider code, and avoids policy violations in a scripted, LLM-free procurement workflow where agent-governance baselines produce stale authorizations over shared budgets and inventory. More broadly, MasuGate suggests a path for integrating stateful governance boundaries into agent frameworks and provider-backed domains where agents act on shared resources.
Large language model-based agentic frameworks primarily optimize capability: whether an agent can reason, retrieve information, call tools, delegate work, and complete a goal. Enterprise execution requires a stronger property. A successful result is not reliable if it was produced through unauthorized data access, widened delegated authority, unapproved side effects, unrecoverable budget consumption, or incomplete evidence. This paper defines reliable capability as a path property: an agent is reliably capable only when it completes a task through action events that remain admissible under identity, profile, tool, data, memory, budget, artifact, approval, and audit constraints. We propose a policy algebra that defines the reliability envelope within which agent capability may be exercised. Security profiles and runtime obligations compose through joins, intersections, budget narrowing, approval inheritance, and evidence accumulation; the resulting composition is both trust-preserving and the least restrictive state satisfying all governing inputs. The algebra also propagates restrictions across multi-agent calls and introduces cost-aware artifact materialization, which redirects open-ended execution toward a recoverable outcome as budget exposure grows. The evaluation is interpreted as a reliability-capability trade-off rather than a capability benchmark: the policy-algebra runtime intervenes on 94.8% of policy-violating events while retaining an 86.9% task-completion rate, eliminates the observed profile-monotonicity and zero-artifact-exhaustion violations, and increases audit completeness to 98.6%. The method provides researchers and practitioners with formal correctness conditions, executable decision semantics, and trace evidence for building agents that are not only capable, but reliably capable.
Bhaskar Tripathi, Anurag Kumar, R. Kumar et al.· 0 citations
We give a formal mechanism design model for the continuous participatory governance of a deployed AI agent. The mechanism is built on the principle that governance should control an AI agent through resource allocation so as to make authorization self enforcing via compute budgets. The mechanism seeks to establish the Safe AI paradigm that compute is an effective governance lever. We situate our work as a compliance or commons overlay on a deployer. One governance period is an extensive form game in which verified human stakeholders arrive sequentially and contribute, on a provision or a rejection market, in a governance currency that is deliberately distinct from the agents compute. A funding aggregator turns raw contributions into breadth weighted effective supports - a two threshold gate with hysteresis converts net support into a binary authorization that, through a coupling map bounded by an exogenously certified safety ceiling, releases a metered compute budget - realized in hardware as a signed compute license so that the decision is self-enforcing. We characterize the class of agents the mechanism can govern and isolate manipulation of the governing electorate by the governed agent as the central open problem. We also introduce several challenges addressing manipulation of governing electorate by the governed agents.
Enterprise agentic artificial intelligence (AI) increasingly converts model outputs into consequential actions involving payments, records, customer communications, infrastructure, and regulated decisions. Existing safeguards commonly emphasize refusal, confidence thresholds, expected loss, or human approval, but they insufficiently distinguish a recoverable task failure from an irreversible or externally propagated harm. This paper develops Reversibility-Aware Staged Delegation (RASD), a multidisciplinary decision framework integrating AI governance, resilience engineering, transaction processing, real-options reasoning, and human-centered automation. RASD introduces an Action Recoverability Index, Non-Recoverable Exposure, and an option-value decision rule that allocates each proposed action among direct execution, staged commit, human review, and block/defer modes. The staged mode separates preparation, validation, commitment, and compensation so that an agent can make progress while preserving the organization’s ability to inspect, reverse, or contain side effects. A formal dominance condition shows when staging creates greater expected value than direct execution. The framework is evaluated in a Monte Carlo design comprising 120,000 synthetic enterprise tasks across 240 episodes, including a controlled distribution shift. RASD achieved a mean net value of 7.408 normalized units per task, compared with 5.735 for a confidence-threshold policy and 5.282 for an expected-loss gate. Its severe-incident rate was 0.390%, versus 5.937% and 4.166%, respectively, while preserving positive value after distribution shift. RASD had a higher raw task-failure rate than the expected-loss gate, demonstrating that failure frequency alone is an inadequate safety metric when recovery and consequence containment differ. The findings support a shift from binary autonomy decisions toward recoverability-preserving execution architectures and provide operational guidance for auditability, human escalation, and risk-adjusted enterprise value creation.
K. Tan· Open Access Journal of Multi...· 0 citations