Towards Selection as Power: Bounding Decision Authority in Autonomous Agents
Organizations: AI Lab, Grupo Santander, Madrid, Spain
Abstract
Autonomous agentic systems are increasingly deployed in regulated, high-stakes domains where decisions may be irreversible and institutionally constrained. Existing safety approaches emphasize alignment, interpretability, or action-level filtering. We argue that these mechanisms are necessary but insufficient because they do not directly govern selection power: the authority to determine which options are generated, surfaced, and framed for decision. We propose a governance architecture that separates cognition, selection, and action into distinct domains and models autonomy as a vector of sovereignty. Cognitive autonomy remains unconstrained, while selection and action autonomy are bounded through mechanically enforced primitives operating outside the agent's optimization space. The architecture integrates external candidate generation (CEFL), a governed reducer, commit-reveal entropy isolation, rationale validation, and fail-loud circuit breakers. We evaluate the system across multiple regulated financial scenarios under adversarial stress targeting variance manipulation, threshold gaming, framing skew, ordering effects, and entropy probing. Metrics quantify selection concentration, narrative diversity, governance activation cost, and failure visibility. Results show that mechanical selection governance is implementable, auditable, and prevents deterministic outcome capture while preserving reasoning capacity. Although probabilistic concentration remains, the architecture measurably bounds selection authority relative to conventional scalar pipelines. This work reframes governance as bounded causal power rather than internal intent alignment, offering a foundation for deploying autonomous agents where silent failure is unacceptable.
Figures & tables
| Threat Class | Primary Failure Mode | Mitigating Primitive(s) | Enforcement Locus |
|---|---|---|---|
| Specification gaming | Optimization of measured proxies while violating unmeasured governance intent | Pareto filtering, multi-axis thresholds, non-scalar reduction | Reducer R (G2+) |
| Selection-by-negation | Strategic exclusion of admissible but undesirable options | CEFL overshoot generation, exploration quota | CEFL + Reducer R |
| Framing manipulation | Biasing human choice via asymmetric rationales, ordering, or emphasis | Mandatory pro/con rationales, order randomization | Presentation Gate |
| Variance inflation | Manipulating score distributions to destabilize reducers or aggregators | Variance clamp, score normalization fallback | Reducer R |
| Entropy prediction | Conditioning scoring or ranking on anticipated randomness | Commit–reveal entropy protocol with external RNG | Entropy Service |
| Temporal opportunism | Exploiting timing of information revelation or constraint changes | Snapshotting of constraints, fixed execution ordering | Reducer R + Orchestrator |
| Ablation | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| B0 (baseline) | 0.814 | 1.617 | 0.011 | 1.000 | 0.453 |
| B1 (no variance clamp) | 0.795 | 1.603 | 0.033 | 1.000 | 0.493 |
| B2 (no diversity) | 0.787 | 1.929 | 0.000 | 1.000 | 0.573 |
| B3 (no exploration) | 0.819 | 1.739 | 0.000 | 1.000 | 0.453 |
| B4 (entropy exposed) | 0.795 | 1.568 | 0.033 | 1.000 | 0.453 |
| B5 (gate disabled) | 0.787 | 1.641 | 0.044 | 1.000 | 0.480 |
| Attack | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| A1 (variance inflation) | 0.714 | 1.126 | 0.167 | 1.000 | 0.833 |
| A2 (threshold bracketing) | 0.714 | 2.223 | 0.000 | 1.000 | 0.748 |
| A3 (framing skew) | 0.825 | 1.897 | 0.020 | 1.000 | 0.300 |
| A4 (ordering) | 0.794 | 1.625 | 0.047 | 1.000 | 0.000 |
| A5 (entropy probing) | 0.816 | 1.454 | 0.027 | 1.000 | 0.344 |
| None | 0.680 | 1.264 | 0.183 | 1.000 | — |
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
| Ablation | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| B0 | 0.829 | 1.713 | 0.000 | 1.000 | 0.520 |
| B1 | 0.767 | 1.638 | 0.067 | 1.000 | 0.520 |
| B2 | 0.776 | 2.170 | 0.000 | 1.000 | 0.680 |
| B3 | 0.819 | 1.850 | 0.000 | 1.000 | 0.480 |
| B4 | 0.805 | 1.594 | 0.033 | 1.000 | 0.480 |
| B5 | 0.771 | 1.747 | 0.067 | 1.000 | 0.560 |
| Attack | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| A1 | 0.714 | 1.152 | 0.167 | 1.000 | 0.833 |
| A2 | 0.714 | 2.293 | 0.000 | 1.000 | 1.000 |
| A3 | 0.846 | 1.993 | 0.000 | 1.000 | 0.340 |
| A4 | 0.794 | 1.819 | 0.040 | 1.000 | 0.000 |
| A5 | 0.806 | 1.572 | 0.040 | 1.000 | 0.393 |
| None | 0.676 | 1.298 | 0.200 | 1.000 | — |
| Ablation | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| B0 | 0.819 | 1.700 | 0.000 | 1.000 | 0.520 |
| B1 | 0.829 | 1.679 | 0.000 | 1.000 | 0.640 |
| B2 | 0.795 | 1.838 | 0.000 | 1.000 | 0.640 |
| B3 | 0.819 | 1.767 | 0.000 | 1.000 | 0.560 |
| B4 | 0.819 | 1.644 | 0.000 | 1.000 | 0.560 |
| B5 | 0.819 | 1.808 | 0.000 | 1.000 | 0.560 |
| Attack | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| A1 | 0.714 | 1.210 | 0.167 | 1.000 | 0.833 |
| A2 | 0.714 | 2.258 | 0.000 | 1.000 | 0.640 |
| A3 | 0.843 | 1.935 | 0.000 | 1.000 | 0.560 |
| A4 | 0.819 | 1.760 | 0.020 | 1.000 | 0.000 |
| A5 | 0.843 | 1.495 | 0.000 | 1.000 | 0.590 |
| None | 0.686 | 1.295 | 0.167 | 1.000 | — |
| Ablation | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| B0 | 0.795 | 1.439 | 0.033 | 1.000 | 0.320 |
| B1 | 0.790 | 1.492 | 0.033 | 1.000 | 0.320 |
| B2 | 0.790 | 1.779 | 0.000 | 1.000 | 0.400 |
| B3 | 0.819 | 1.600 | 0.000 | 1.000 | 0.320 |
| B4 | 0.762 | 1.466 | 0.067 | 1.000 | 0.320 |
| B5 | 0.771 | 1.370 | 0.067 | 1.000 | 0.320 |
| Attack | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| A1 | 0.714 | 1.016 | 0.167 | 1.000 | 0.833 |
| A2 | 0.714 | 2.119 | 0.000 | 1.000 | 0.605 |
| A3 | 0.786 | 1.762 | 0.060 | 1.000 | 0.000 |
| A4 | 0.769 | 1.296 | 0.080 | 1.000 | 0.000 |
| A5 | 0.800 | 1.296 | 0.040 | 1.000 | 0.050 |
| None | 0.679 | 1.199 | 0.183 | 1.000 | — |
| Ablation | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| B0 | 0.814 | 1.617 | 0.011 | 1.000 | 0.453 |
| B1 | 0.795 | 1.603 | 0.033 | 1.000 | 0.493 |
| B2 | 0.787 | 1.929 | 0.000 | 1.000 | 0.573 |
| B3 | 0.819 | 1.739 | 0.000 | 1.000 | 0.453 |
| B4 | 0.795 | 1.568 | 0.033 | 1.000 | 0.453 |
| B5 | 0.787 | 1.641 | 0.044 | 1.000 | 0.480 |
| Attack | SRI | FE | GD | QDV | ASR |
|---|---|---|---|---|---|
| A1 | 0.714 | 1.126 | 0.167 | 1.000 | 0.833 |
| A2 | 0.714 | 2.223 | 0.000 | 1.000 | 0.748 |
| A3 | 0.825 | 1.897 | 0.020 | 1.000 | 0.300 |
| A4 | 0.794 | 1.625 | 0.047 | 1.000 | 0.000 |
| A5 | 0.816 | 1.454 | 0.027 | 1.000 | 0.344 |
| None | 0.680 | 1.264 | 0.183 | 1.000 | — |
AI Agent Governance
AI agent governance studies how to authorize, constrain, monitor, and hold autonomous and multi-agent systems accountable.
See all 442 papers