e001
Runtime Governance for AI Agents: Policies on Paths
Permalink- Source
- arXiv 2603.16586
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Runtime
- Published
- 2026-03-17
- Claims
- OBJ, RA
- Conditions
- OBJ
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Argues the execution path is the central object for runtime governance and formalizes compliance policy as a deterministic function mapping agent identity, partial path, proposed next action, and organizational state to a violation probability. Claims prompt-level instructions and static access control are special cases of this framework. Policy examples drawn from the AI Act; reference implementation discussed. Bears on OBJ and RA.
Original linke018
Agent Control Protocol (ACP): Admission Control for Agent Actions
Permalink- Source
- arXiv 2603.18829
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Runtime
- Published
- 2026-03
- Claims
- RA, OBJ
- Conditions
- OBJ, 3.4
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Technical specification and reference implementation for admission control at the agent action boundary. Same inline-enforcement pattern as Section 5.1, with a concrete protocol. Relevant to the Section 5.5 concession that the discipline may be implemented inside existing machinery.
Original linke019
Proof of Execution: Runtime Verification for Governed AI Agent Actions
Permalink- Source
- arXiv 2607.05397 (Rhodes & Kang)
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Verification
- Published
- 2026-04-26
- Claims
- GE, RA, OBJ, PE
- Conditions
- EV, OBJ, 3.2
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Formalizes execution as a triple (contract C, Execution Causal Event Stream T, replay context R) with five validator-checkable invariants and five semantic guarantees: authorization, path compliance, null effect on deny, history integrity, replayability. Includes soundness and replay theorems with witness constructions. Overlaps AOI on execution as evaluation object, deterministic inline enforcement, null effect after denial, integrity and replayability, and independently checkable execution history. Does not evaluate contextual validity, intent conformance, or causal origin; establishes that execution followed a valid contract and path rather than whether the execution was institutionally legitimate.
Original linke022
State-Aware Runtime for Long-Horizon LLM Agents: A Conceptual Framework and Research Agenda
Permalink- Source
- Cambridge Open Engage
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Memory/State
- Published
- 2026
- Claims
- AD, CD, RA
- Conditions
- 3.3
- Stance
- supports
- Relation
- complements
- Strength
- emerging
- Overlap flag
- none
Conceptual framework and research agenda for state-aware runtime across long-horizon agent operation. Bears on AD and on the Section 6.1 assumption that business systems can be consulted at execution latency. CD tag is provisional: the source addresses state persistence, and qualifies for CD only where it substantively treats capability evolution.
Original linke025
Runtime verification and monitorability of safety properties
Permalink- Source
- Springer / RV literature
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Verification
- Published
- 2023
- Claims
- RA, GE
- Conditions
- EV, OBJ
- Stance
- supports
- Relation
- supports
- Strength
- foundational
- Overlap flag
- none
Monitorability is defined as the ability to return a positive or negative verdict after a finite execution prefix, with the field concentrating on safety properties because violations are always detectable in finite time. This supplies formal grounding for Section 2.2's claim that the evaluable tuple is only complete at execution, and a rigorous way to state which legitimacy conditions are monitorable at all. Also gives Section 4.3's determinism requirement an existing literature to stand on.
Original linke026
Verified runtime validation for partially observable hybrid systems
Permalink- Source
- arXiv 1811.06502
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Verification
- Published
- 2018
- Claims
- RA, AD
- Conditions
- 3.3, EV
- Stance
- supports
- Relation
- supports
- Strength
- foundational
- Overlap flag
- none
Synthesizes runtime monitors from provably safe hybrid system models, robust to partial observability arising from sensor uncertainty and partial controllability arising from actuator disturbance. Establishes what guarantee survives when a monitor cannot observe full system state. The partial-observability treatment corresponds to the Section 6.1 assumption that contextual validity may proceed on cached state, and to the signal-freshness requirement in Section 4.2.
Original linke027
Saga pattern, compensating transactions, and durable execution
Permalink- Source
- Azure Architecture Center / long-running transaction literature
- Source type
- architecture
- Primary or secondary status
- Primary
- Domain
- Distributed Systems
- Published
- ongoing
- Claims
- RA, PE, OBJ
- Conditions
- OBJ
- Stance
- supports
- Relation
- adjacent
- Strength
- foundational
- Overlap flag
- none
Long-running transactions abandon locks on non-local resources and use compensating transactions that semantically undo rather than restore prior state, typically coordinated by a durable state machine. Establishes an existing engineering distinction between operations that can be compensated and those that cannot. Bears on the reversibility-based allocation in Section 5.3.
Original linke030
FlowSignal — Runtime Authority Infrastructure
Permalink- Source
- FlowSignal
- Source type
- vendor
- Primary or secondary status
- Secondary
- Domain
- Runtime
- Published
- 2026
- Claims
- RA, AC, EL
- Conditions
- OBJ, 3.1, 3.3
- Stance
- contests
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- naming_collision
Direct naming use of Runtime Admissibility, and the closest terminology overlap in the corpus. Operationalizes governance intent at the execution boundary where authority resolves, sitting between AI decision engines and executing systems so that authority resolves before execution proceeds. Its Authority Validation Sprint (FAVS) applies execution-bound authority validation to a single AI decision surface. Vocabulary in use: runtime admissibility, current authority state, delegation validity, contextual integrity, operational legitimacy, independently verifiable admissibility decisions, governance before consequence. Centers the final bind or consequence-formation boundary.
Original linke031
AgentBound: Verifiable Behavioral Governance for Autonomous AI Agents
Permalink- Source
- arXiv 2606.30970
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Evidence
- Published
- 2026-06
- Claims
- GE, AC, RA
- Conditions
- EV, 3.1, 3.2
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Introduces cryptographically verifiable governance receipts binding each executed action to its exact governing policy artifacts, enabling non-repudiable independent replay verification. Composes three independent authorities in parallel: delegated authorization, owner-signed behavioral constitutions, and site action contracts. Introduces a standing delegation model, per-execution policy refreshing, and deterministic obligation enforcement, accommodating both interactive and long-running periodic agents. Bears on GE, AC, and RA.
Original linke032
Reconstructive Authority Model: Runtime Execution Validity Under Partial Observability
Permalink- Source
- arXiv 2604.22898
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Verification
- Published
- 2026-04
- Claims
- AC, RA, EL
- Conditions
- 3.1, 3.2, 3.3
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Treats authority as reconstructed at execution rather than carried forward from grant, addressing runtime execution validity under partial observability. Companion to e033. Bears on AC, RA, and conditions 3.1 through 3.3.
Original linke033
Operationalizing Reconstructive Authority: Runtime Construction, Dependency Resolution, and Execution Gating in Autonomous Agent Systems
Permalink- Source
- arXiv 2605.23935
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Runtime
- Published
- 2026-05
- Claims
- RA, AC
- Conditions
- 3.1, 3.2
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Operationalizes the reconstructive authority model through runtime construction, dependency resolution, and execution gating in autonomous agent systems. Execution gating addresses the same decision point as Runtime Admissibility, with a dependency-resolution mechanism. Companion to e032.
Original linke034
AI Agent Authorization and Control — Admissibility in Decision Governance
Permalink- Source
- FlexRule
- Source type
- vendor
- Primary or secondary status
- Secondary
- Domain
- Policy
- Published
- 2026
- Claims
- RA, PE
- Conditions
- OBJ, 3.3
- Stance
- contests
- Relation
- differentiates
- Strength
- emerging
- Overlap flag
- naming_collision
Vendor article distinguishing authorization from admissibility: authorization can be partly static, but admissibility is contextual and situational and must be resolved at runtime, with a decision model determining what actions an actor may take for a specific case in its current situation and context. Describes admissibility as explicit, versioned, testable, and controlled at runtime. Bears on RA and PE.
Original linke035
Harnessing Embodied Agents: Runtime Governance for Policy-Constrained Execution
Permalink- Source
- arXiv 2604.07833
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Robotics
- Published
- 2026-04
- Claims
- RA, OBJ
- Conditions
- OBJ
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- naming_collision
Robotics application of the term runtime governance. Separates agent cognition from execution oversight by externalizing governance into a dedicated runtime layer performing policy checking, capability admission, execution monitoring, rollback handling, and human override. Capability admission and rollback handling bear on CD and on the reversibility material in Section 5.3.
Original linke036
Authorization and Governance for AI Agents: Runtime Authorization Beyond Identity at Scale
Permalink- Source
- Microsoft Security
- Source type
- vendor
- Primary or secondary status
- Secondary
- Domain
- Runtime
- Published
- 2026
- Claims
- RA, MKT
- Conditions
- OBJ, 3.1
- Stance
- contests
- Relation
- differentiates
- Strength
- emerging
- Overlap flag
- naming_collision
Microsoft Security framing runtime authorization as extending beyond identity at enterprise scale. Companion to the Agent Control Specification entry (e004). Bears on RA and MKT.
Original linke037
From Audit to Admissibility: Why AI Governance Must Move Into The Execution Boundary
Permalink- Source
- Medium
- Source type
- practitioner
- Primary or secondary status
- Secondary
- Domain
- Runtime
- Published
- 2026
- Claims
- RA, OBJ, PE
- Conditions
- OBJ, EV
- Stance
- supports
- Relation
- supports
- Strength
- emerging
- Overlap flag
- naming_collision
Practitioner argument that model outputs are not admissible actions but proposals, and that if a proposal can directly mutate system state without boundary evaluation, the model becomes a source of authority. Uses admissibility and execution boundary framing. Bears on OBJ, RA, and PE.
Original linke038
Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents
Permalink- Source
- arXiv 2607.23586
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Verification
- Published
- 2026-07
- Claims
- CD, AC, RA
- Conditions
- 3.1, 3.2, 3.3
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Formulates what it calls authorization continuity: whether an existing grant remains valid as a long-lived agent evolves after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. States that evolution can change both the effects reachable under an old grant and the authority a task requires, and that the required authority may rise, fall, or become incomparable; existing tool policies constrain actions but do not determine when a grant survives this change. Proposes a state-bound model that fixes a transition envelope and an immutable effect ceiling at grant time, distinguishes requested from realized effects, and proves that under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling; agent-produced evidence may allocate authority below the ceiling but cannot raise it, which places the derivation of any additional authority under an evidence condition and bears on condition 3.2. The source's authorization continuity is scoped to grant survival under agent mutation. Vocabulary in use that overlaps AOI's: authorization continuity, authorization drift, admission, effect ceiling. Bears on CD, AC, and conditions 3.1 through 3.3.
Original linke039
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
Permalink- Source
- arXiv 2605.26542 (Jiang et al.; AIWILD workshop, ICML 2026)
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Runtime
- Published
- 2026-05
- Claims
- AC, RA
- Conditions
- 3.3, 3.5
- Stance
- complicates
- Relation
- complements
- Strength
- supporting
- Overlap flag
- prior_art
Names permission laundering: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, because a restricted value is transformed, mixed, or rewritten before reaching a sink it should not reach. Enforces a runtime invariant in which every value carries a sink-specific authority budget and tool composition propagates budgets by intersection, so a value may lose but never gain authority through composition; states and proves a non-amplification theorem to that effect. Implemented as a transparent MCP proxy requiring no change to agent or tool servers; reports attack success falling from 25-68 percent to 0-4.8 percent across five frontier models on an 82-task suite, with manifest authoring quality, not runtime overhead, identified as the binding deployment constraint. The mechanism governs authority attenuation across a composed tool chain within a session rather than change in an agent's effective ability to produce consequences over time. The paper positions itself as complementary to execution-boundary mechanisms, which it says constrain execution while ChainCaps constrains the authority of derived values. Vocabulary in use that overlaps AOI's: monotonic capability attenuation, authority propagation, declassification. Bears on AC, RA, condition 3.5, and the compositional material in Appendix C.4.
Original linke040
Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with Embodied Agents as Case Study
Permalink- Source
- arXiv 2604.08059
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Robotics
- Published
- 2026-04
- Claims
- CD, RA
- Conditions
- 3.1
- Stance
- complicates
- Relation
- complements
- Strength
- supporting
- Overlap flag
- naming_collision
Formulates governed capability evolution as a software-lifecycle problem: when a capability module evolves into a new version, the hosting system must decide whether the new version may be activated, under what deployment conditions it runs, how it is monitored, and when it is rolled back. Introduces four upgrade compatibility checks (interface, policy, behavioral, recovery) staged into a pipeline of candidate validation, sandbox evaluation, shadow deployment, gated activation, online monitoring, and rollback. Reports that naive upgrade reaches 72.9 percent task success but drives unsafe activation to 60 percent by the final round, while governed upgrade retains 67.4 percent success with zero unsafe activations, and that shadow deployment reveals 40 percent of upgrade regressions invisible to sandbox evaluation alone. States its contribution as extending runtime governance from action execution to capability evolution; the checks are lifecycle-time and pre-activation rather than per-execution. The source's terms are governed capability evolution and runtime governance; it does not use the term Capability Drift. Bears on CD and on the reversibility material in Section 5.3.
Original linke041
Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure
Permalink- Source
- arXiv 2606.11632
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Runtime
- Published
- 2026-06
- Claims
- RA, GE, OBJ, EL
- Conditions
- 3.1, 3.2, 3.4, 3.5
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
States a control-plane authorization problem: non-deterministic reasoning systems may propose high-stakes mutations to production resources, while IAM, policy engines, consensus protocols, and audit logs either enforce static permissions or record actions only after execution. Introduces a certificate-bound runtime admission boundary that intercepts agent proposals at an assurance airlock, compiles them into typed execution contracts, binds those contracts to cryptographic evidence digests and policy versions, and routes them through consequence-aware certification paths; successful admission emits a signed certificate valid only for a scoped execution identity, revocation epoch, and validity window. The contract-to-certificate-to-execution chain constrains which execution path may follow from a given admitted proposal, which bears on condition 3.5. Formalizes admission and revocation invariants and reports feasibility measurements from a Go prototype over 2,500 admission attempts. Vocabulary in use that overlaps AOI's: runtime admission boundary, execution contract, evidence-bound, consequence-aware certification, replayable. Companion to e042. Bears on RA, GE, OBJ, and conditions 3.1, 3.2, 3.4, and 3.5.
Original linke042
Sovereign Execution Broker: Enforcing Certificate-Bound Authority in Agentic Control Planes
Permalink- Source
- arXiv 2606.20520
- Source type
- research
- Primary or secondary status
- Primary
- Domain
- Runtime
- Published
- 2026-06-19
- Claims
- RA, AC, GE
- Conditions
- 3.1, 3.3
- Stance
- complicates
- Relation
- differentiates
- Strength
- supporting
- Overlap flag
- prior_art
Execution-side companion to e041. Defines a runtime enforcement boundary that consumes certificates issued by the assurance boundary, verifies that the requested mutation matches the certified execution contract, checks validity windows, policy epochs, revocation epochs, and live-state drift, mints a scoped execution identity, invokes infrastructure APIs, and records signed decision and outcome records. States that production mutation authority should not reside inside non-deterministic reasoning processes, and separates proposal, admission, and execution so that certified authority becomes a short-lived, revocable, auditable runtime capability. Prototype evaluated on AWS and Kubernetes clusters. The live-state drift check compares infrastructure state at execution against the certified contract; it is not a comparison of retained authority against current organizational circumstances, and the entry is therefore not tagged AD. Vocabulary in use that overlaps AOI's: certificate-bound authority, execution broker, live-state drift, signed decision records, revocation epoch. Bears on RA, AC, GE, and the grant-to-effect interval.
Original linke044
Principles for financial market infrastructures - Principle 8: Settlement finality
Permalink- Source
- CPSS-IOSCO / CPMI-IOSCO, PFMI (CPMI Papers No 101)
- Source type
- standard
- Primary or secondary status
- Primary
- Domain
- Financial Systems
- Published
- 2012-04-16
- Claims
- EL, RA
- Conditions
- 3.5
- Stance
- supports
- Relation
- complements
- Strength
- foundational
- Overlap flag
- none
Governance analogue from financial market infrastructure standards, not a doctrinal claim about software agents. Principle 8 requires that an FMI provide clear and certain final settlement, at a minimum by the end of the value date, and intraday or in real time where necessary or preferable. The accompanying legal-basis discussion states that there should be a clear legal basis regarding when settlement finality occurs, in order to define when key financial risks are transferred, including the point at which transactions are irrevocable, and treats settlement finality as a building block for risk management rather than a bookkeeping detail. Establishes an existing international standard requiring that the moment at which an action becomes irrevocable be defined ex ante and be legally determinate, including under participant insolvency. The standard governs the determinacy of the finality boundary; it does not specify evidence of a governance determination, and the entry is therefore not tagged GE. Bears on the reversibility-based allocation in Section 5.3 and on the treatment of the consequence-formation boundary; complements the compensating-transaction material catalogued at e027.
Original link