Aug 2026· Computers· Vol 15, pp. 510· 0 citations· 4 references
TL;DR
This work proposes composition attestation, a runtime control complementary to identity governance, and proposes a two-stage operator: a component diff detects that the composition changed; a capability-closure stage detects when it authorized something new.
Abstract
Agent identity governance governs an agent’s identity, credentials, and lifecycle, but assumes the composition it was approved with is the composition it runs with. That stability assumption is unenforced: no lifecycle mechanism evaluates an agent’s evolving composition against its approved baseline. An agent’s effective composition—tools, data sources, delegated authorities, child agents—is a runtime supply chain of capability, and it drifts. We introduce composition drift, the departure of effective composition from the terms of approval, and isolate its sharpest form, compositional drift: individually approved changes accumulating into a capability none authorized alone. We formalize this with a two-stage operator: a component diff detects that the composition changed; a capability-closure stage detects when it authorized something new. The contribution is a temporal governance model linking emergent capability to reauthorization and inventory reconciliation. Drift produces shadow infrastructure: resources provisioned outside any inventory through benign, individually approved pathways. We propose composition attestation, a runtime control complementary to identity governance, and evaluate it in a pre-registered study. Across five thousand trajectories the detector separates compositional drift from authorized growth where a static analyzer cannot; an ablation isolates the primitives that cause it; and, in controlled live agent runs across three models (9B to 70B parameters, Llama and Qwen lineages), agents given only benign tasks provision unauthorized shadow infrastructure in 59% to 99% of drift-conducive trials against 0% to 19% of matched controls.
Software systems have traditionally been organized around applications where human users act as principal decision-makers. Recent developments in agentic capabilities alter this paradigm: software agents now autonomously translate high-level goals into structured tasks, orchestrating tools, services and sub-agents to execute complex workflows. This evolution gives rise to an agent economy where these autonomous agents capture real economic value. However, the infrastructure required to support the agent economy fails across three critical dimensions: the absence of persistent identity infrastructure prevents systemic accountability in agentic workflows; capability claims remain self-declared not backed by verifiable execution evidence; and the disconnect between creator identities, agent performance, and project value hinders the economic valuation of agents as assets. While existing registries provide naming and discovery, unifying these features around a persistent identity anchor remains largely unaddressed. TessIndex is a capability-verified identity system for agent primitives that utilizes a dual-plane architecture: the blockchain records compact commitments for identity, ownership, and verification, while centralized servers maintain dynamic metadata for discovery, commerce, and reputation. It establishes: persistent identities across agent primitives to enforce systemic accountability in autonomous workflows; a predicate-based verification process replacing self-declared claims with cryptographic capability proof; an identity infrastructure that links agent performance to both project and creator identities while capturing value through tokenization. Ultimately, TessIndex serves as an integrated infrastructure that binds an agent's existence across capabilities, execution, and reputation into a single persistent identity.
SAGE-Fin is presented, a finance-specific authority-handoff contract that makes the proposed effect, not merely its text, the object of runtime control, and its results establish executable conformance, not independent safety accuracy.
Rui Tang, Qiang Liu, Yichi Zhang et al.· 0 citations
MasuGate is presented, a runtime architecture that keeps policies as reviewable programs while coordinating the state and effects needed to preserve their decisions, and suggests a path for integrating stateful governance boundaries into agent frameworks and provider-backed domains where agents act on shared resources.
A policy algebra is proposed that defines the reliability envelope within which agent capability may be exercised and provides researchers and practitioners with formal correctness conditions, executable decision semantics, and trace evidence for building agents that are not only capable, but reliably capable.
Bhaskar Tripathi, Anurag Kumar, R. Kumar et al.· 0 citations
We give a formal mechanism design model for the continuous participatory governance of a deployed AI agent. The mechanism is built on the principle that governance should control an AI agent through resource allocation so as to make authorization self enforcing via compute budgets. The mechanism seeks to establish the Safe AI paradigm that compute is an effective governance lever. We situate our work as a compliance or commons overlay on a deployer. One governance period is an extensive form game in which verified human stakeholders arrive sequentially and contribute, on a provision or a rejection market, in a governance currency that is deliberately distinct from the agents compute. A funding aggregator turns raw contributions into breadth weighted effective supports - a two threshold gate with hysteresis converts net support into a binary authorization that, through a coupling map bounded by an exogenously certified safety ceiling, releases a metered compute budget - realized in hardware as a signed compute license so that the decision is self-enforcing. We characterize the class of agents the mechanism can govern and isolate manipulation of the governing electorate by the governed agent as the central open problem. We also introduce several challenges addressing manipulation of governing electorate by the governed agents.
Enterprise agentic artificial intelligence (AI) increasingly converts model outputs into consequential actions involving payments, records, customer communications, infrastructure, and regulated decisions. Existing safeguards commonly emphasize refusal, confidence thresholds, expected loss, or human approval, but they insufficiently distinguish a recoverable task failure from an irreversible or externally propagated harm. This paper develops Reversibility-Aware Staged Delegation (RASD), a multidisciplinary decision framework integrating AI governance, resilience engineering, transaction processing, real-options reasoning, and human-centered automation. RASD introduces an Action Recoverability Index, Non-Recoverable Exposure, and an option-value decision rule that allocates each proposed action among direct execution, staged commit, human review, and block/defer modes. The staged mode separates preparation, validation, commitment, and compensation so that an agent can make progress while preserving the organization’s ability to inspect, reverse, or contain side effects. A formal dominance condition shows when staging creates greater expected value than direct execution. The framework is evaluated in a Monte Carlo design comprising 120,000 synthetic enterprise tasks across 240 episodes, including a controlled distribution shift. RASD achieved a mean net value of 7.408 normalized units per task, compared with 5.735 for a confidence-threshold policy and 5.282 for an expected-loss gate. Its severe-incident rate was 0.390%, versus 5.937% and 4.166%, respectively, while preserving positive value after distribution shift. RASD had a higher raw task-failure rate than the expected-loss gate, demonstrating that failure frequency alone is an inadequate safety metric when recovery and consequence containment differ. The findings support a shift from binary autonomy decisions toward recoverability-preserving execution architectures and provide operational guidance for auditability, human escalation, and risk-adjusted enterprise value creation.
K. Tan· Open Access Journal of Multi...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
