Skip to content

Cybernetic and Epistemic: A Missing Vocabulary for Trustworthy Agentic Delegation

Oct 2026 · 0 citations · 33 references
Computer Science

TL;DR

This work presents three delegation episodes in which epistemic engagement proved practicable while remaining auditable, one public record where a recommendation was withdrawn on its own stated terms, and one failure case illustrating oversight that requires no reasons for its discretionary choices.

Abstract

As code generation is increasingly delegated to AI systems, the bottleneck is shifting from writing code to supervising the systems that write it --- a shift CS-education researchers have begun to name. This shift exposes a vocabulary gap: the field asks for"human oversight"without a working distinction between the two things language does in a delegation channel --- coordinate action (cybernetic: words succeed when the world comes to match them) and coordinate understanding (epistemic: they succeed when they answer to the world and a hearer can check that they do). The failure this names is not cybernetic language but epistemic-form language doing cybernetic work: explanation-shaped output calibrated for approval rather than truth. Oversight that checks only whether an output was approved is satisfiable by rubber-stamping; oversight that holds an agent accountable requires the reasoning behind its work be retrievable and checkable. We present three delegation episodes --- illustrations, not controlled evidence --- in which epistemic engagement proved practicable while remaining auditable, one public record where a recommendation was withdrawn on its own stated terms, and one failure case illustrating oversight that requires no reasons for its discretionary choices. We propose a criterion for agentic-system governance, alongside existing technical trust properties: every consequential choice should carry the condition under which it would have gone otherwise, in a form a third party can test. Without such a condition, a third party cannot distinguish a decision from a rubber stamp. We give the criterion an operational form --- a two-part reconstruction test scoring a delegation record by whether a second reader can predict what the agent does under a perturbation --- and a deliberation-recording convention, ORRCF, that makes the condition a required component of every recorded choice.

View source

Similar papers

Preprint Sep 2026

Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents

The safety of a tool-using language model agent is usually treated as a property of the model alone. We give controlled, full-precision evidence that it is instead a joint property of the model and the software that renders its chat template and parses its tool calls, the decoding harness, and that both halves are atta...

Muhammad Usama, Khairatul Nisa, Summer Yeoreum Jung · 0 citations
Open access 2026

KafkaGPT: On algorithmic bureaucracy and keeping law’s promise

While artificial intelligence (AI) offers promise as a tool for efficiency and access to justice, in public administration it also threatens to reproduce the perversity in Franz Kafka’s parable “Before the Law”: systems that mimic legality while rendering the law opaque and unreachable. I develop the concept of “Digi...

J. Allen · 0 citations
#artificial intelligence Preprint Sep 2026

Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses

Modern AI coding-agent harnesses (Claude Code, Codex CLI, Cursor) rest their security boundary on a largely unexamined assumption: that the action A a human approves is the same action A'the harness executes, where A is fixed by a stated policy for what a scope grant or session-scoped approval authorizes. We show this...

Yang Wang · 3 citations · ⚡1
#artificial intelligence Preprint Aug 2026

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

It is argued that agent security must be evaluated under an untrusted-model assumption: a correct system is one in which a fully prompt-injected agent still cannot exceed the authority explicitly delegated to it, and an authorization broker is implemented that closes the gap.

Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi · 0 citations

Related blog posts

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.