Skip to content

Canonical Procedural Actions: An Auditable Annotation Protocol for Tool-Use Agent Traces

Sep 2026 · 0 citations · 19 references
Computer Science

TL;DR

Canonical Procedural Actions (CPAs) is presented, an annotation protocol that records a procedural function, its first agent-event anchor, the agent events that realize it, and separate contextual evidence, and separate contextual evidence.

Abstract

Tool-use agent traces identify messages and API calls, but procedural analyses also need explicit units of action and inspectable links to their evidence. We present Canonical Procedural Actions (CPAs), an annotation protocol that records a procedural function, its first agent-event anchor, the agent events that realize it, and separate contextual evidence. Multiple actions may share a message anchor without an inferred within-message order. A retail case study produces a versioned 24-entry codebook through open induction, recorded consolidation, and successive application audits. Two isolated LLM contexts annotate 32 trajectories disjoint from development at the trajectory level, producing 499 and 491 occurrences with anchor-label overlap A=0.982. Requiring identical context-event references reduces overlap to 0.798. These are structural repeatability measures, not semantic accuracy: 16 of 26 task IDs also occur in development, and historical tool payloads were truncated to 110 characters. Retrospective controls show that collapsing all labels raises overlap to 0.986, while simple endpoint rules reproduce the tool-anchored portion with 0.997 overlap. Assistant-message actions have 0.971 overlap, with a per-label minimum of 0.816. Applying the frozen codebook to 244 further trajectories yields 4,058 records, including eight diagnostic outcomes. The contribution is an explicit, auditable annotation instrument and a case study of its construction and measurement limits; human-reference validity and downstream utility remain to be established.

View source

Similar papers

Review Aug 2026

When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

This work proposes SARA, which treats action induction and execution authorization as distinct runtime roles and separates action provenance from execution authority, and applies No-History-Promotion to prevent historical recurrence from laundering action origins into execution authority.

Xiao-Kun Guo, Zhen Xu, Dongdong Huo et al. · 1 citation
Preprint Sep 2026

Localizing Post-Wire Semantic Changes in MCP Agent Frameworks

Valid Model Context Protocol (MCP) messages do not guarantee that an agent framework preserves the distinctions downstream software needs. We present a differential testing method that follows a fixed tool result through each framework's public interfaces and checks explicit consumer requirements. Applied to 18 designe...

Aditi Patodiya · 0 citations
#artificial intelligence Preprint Sep 2026

Symbolic Temporal Supervision of LLM Agents Using Contracts

ContrAgent is presented, a contract-based framework for symbolic temporal supervision of LLM agents that matches state-of-the-art LLM-judge and rule-based guardrail baselines while producing deterministic, reproducible verdicts and, in the online mode, orders-of-magnitude lower per-call latency.

Yi-Feng Xiao, Pierluigi Nuzzo · 0 citations
Book Open access Oct 2026

Formal Runtime Verification for Tool-Using LLM Agents: An Offline Same-Benchmark Study on AgentDojo and STAC

Results show that formal temporal monitoring adds value exactly when the trace exposes trustworthy history, and quantify how far current benchmarks are from that point and propose a twelve-field enforcement-ready trace schema.

Nikolaos Kekatos, Stylianos Basagiannis, Marinelio Chintri et al. · 2 citations
#artificial intelligence Preprint Oct 2026

POLAR: Ontology-Guided Risk Prevention for Tool-Calling LLM Agents

LLM tool-use agents operate in dynamic environments where many actions carry operational risk. However, most safety mechanisms react only after errors manifest. Existing pre-emptive approaches either fine-tune the agent on chain-of-thought deliberation or compile natural-language guardrails into runtime checks, but the...

Yun-Ju Kang, Seonghyeon Cho, Irene Li et al. · 0 citations

Related blog posts

Microsoft Research Blog Oct 22, 2026

Flint-interactive: A language for creating interactive data visualizations

Flint-interactive gives AI agents a language for creating interactive visualizations. Click a chart, filter data, highlight related content, and explore beyond the view the author originally chose. The post Flint-interactive: A language for creating interactive data visualizations appeared first on Microsoft Research.

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.