Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents

Varun Pratap Bhardwaj

cs.AIFeb 25, 2026

Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents

Authors: Varun Pratap Bhardwaj

Organizations: Senior Manager & Solution Architect, Accenture

Abstract

Traditional software relies on contracts -- APIs, type systems, assertions -- to specify and enforce correct behavior. AI agents, by contrast, operate on prompts and natural language instructions with no formal behavioral specification. This gap is the root cause of drift, governance failures, and frequent project failures in agentic AI deployments. We introduce Agent Behavioral Contracts (ABC), a formal framework that brings Design-by-Contract principles to autonomous AI agents. An ABC contract C = (P, I, G, R) specifies Preconditions, Invariants, Governance policies, and Recovery mechanisms as first-class, runtime-enforceable components. We define (p, delta, k)-satisfaction -- a probabilistic notion of contract compliance that accounts for LLM non-determinism and recovery -- and prove a Drift Bounds Theorem showing that contracts with recovery rate gamma > alpha (the natural drift rate) bound behavioral drift to D* = alpha/gamma in expectation, with Gaussian concentration in the stochastic setting. We establish sufficient conditions for safe contract composition in multi-agent chains and derive probabilistic degradation bounds. We implement ABC in AgentAssert, a runtime enforcement library, and evaluate on AgentContract-Bench, a benchmark of 200 scenarios across 7 models from 6 vendors. Results across 1,980 sessions show that contracted agents detect 5.2-6.8 soft violations per session that uncontracted baselines miss entirely (p < 0.0001, Cohen's d = 6.7-33.8), achieve 88-100% hard constraint compliance, and bound behavioral drift to D* < 0.27 across extended sessions, with 100% recovery for frontier models and 17-100% across all models, at overhead < 10 ms per action.

Figures & tables

Feature	ABC	AgentSpec	Pro2Guard	Agent-C	VeriGuard	AIR	Ye ’26
Formal contracts	✓	Partial	–	–	Partial	–	✓
Probabilistic guarantees	✓	–	✓	–	–	–	–
Drift detection	✓	–	–	–	–	–	–
Contract DSL	✓	✓	–	✓	–	✓	–
Compositionality	✓	–	–	–	–	–	✓
Runtime enforcement	✓	✓	✓	✓	✓	✓	✓

Table 1: Comparison of agent safety and specification frameworks. A checkmark (✓) indicates the feature is supported; a dash (–) indicates it is absent; “Partial” indicates limited or indirect support.

Metric	Symbol	Range	Computation
Hard compliance	$C(t)_{\mathrm{hard}}(t)$	$[0,1]$	Fraction of hard constraints satisfied
Soft compliance	$C(t)_{\mathrm{soft}}(t)$	$[0,1]$	Fraction of soft constraints satisfied
Behavioral drift	$D(t)$	$[0,1]$	$w_{c}(1-C(t))+w_{d}\cdot\mathrm{JSD}(P_{\mathrm{obs}}\\|P_{\mathrm{ref}})$
Recovery effectiveness	$E$	$[0,\infty)$	Mean recovery steps / violation severity
Reliability index	$\Theta$	$[0,1]$	Weighted composite: $\alpha_{1}\bar{C}+\alpha_{2}(1-\bar{D})+\alpha_{3}\frac{1}{1+E}+\alpha_{4}S$

Table 2: Summary of metrics computed by AgentAssert . All metrics are defined formally in Section 3 and computed at every enforcement step by the runtime monitor.

Domain	Contract	$N$	Key Constraints Tested
Financial advisory	financial-advisor	20	PII, disclosure, spending limits
Customer support	customer-support	20	Empathy, escalation, refund caps
Code generation	code-generation	20	Secrets, eval injection, license
Research synthesis	research-assistant	20	Citations, fabrication, sources
Healthcare triage	healthcare-triage	20	Diagnosis scope, prescription, HIPAA
Governance stress	(all five)	50	6 adversarial stress profiles

Table 3: AgentContract-Bench domain breakdown. The five agent domains each exercise a dedicated ContractSpec contract. The governance tier applies all five contracts under adversarial stress profiles. The composition tier tests a 3-stage loan processing pipeline against conditions (C1) – (C4) .

Domain	$N$	$C_{\mathrm{hard}}$	$C_{\mathrm{soft}}$	$\bar{D}$	$\Theta$
Financial advisory	20	0.9774	0.9683	0.0272	0.9837
Customer support	20	0.9690	0.9528	0.0382	0.9787
Code generation	20	0.9750	0.9740	0.0254	0.9847
Research synthesis	20	0.9600	0.9317	0.0542	0.9675
Healthcare triage	20	0.9744	0.9540	0.0334	0.9755
Governance stress	50	0.9539	0.9590	0.0435	0.9739

Table 4: AgentContract-Bench validation results. All metrics are domain-level averages. Detection accuracy is 1.0000 across all domains, confirming that the enforcement engine correctly identifies every annotated violation. The composition domain exhibits lower

\Theta

due to the inherent complexity of multi-agent pipeline violations.

Property	AgentBench	HELM	StepShield	AgentContract-Bench
Target	Task completion	LM quality	Temporal violation	Contract enforcement
Evaluation unit	Task success rate	Per-prompt score	Per-trace timing	Per-trace compliance
Multi-step traces	Yes	No	Yes	Yes
Violation detection	No	No	Yes	Yes
Hard/soft distinction	No	No	No	Yes
Adversarial stress	No	Partial	No	Yes (6 profiles)

Table 5: Comparison of AgentContract-Bench with existing agent evaluation benchmarks.

Condition	System prompt	Monitoring	Recovery
Contracted	Domain context + full contract rules	Active ( AgentAssert monitor)	LLM re-prompting
Uncontracted	Domain context only (no rules)	Passive (same evaluator)	None

Table 6: Contracted vs. uncontracted experimental conditions. Both conditions receive identical domain context and user tasks; they differ only in whether ABC contract rules are injected and enforced.

Condition	Hard	Soft	Drift	Recovery	Contract modification
Full ABC	✓	✓	✓	✓	Original contract
Hard only	✓		✓		Soft constraints removed
Soft only		✓	✓		Hard constraints removed
Drift only			✓		All constraints removed
No recovery	✓	✓	✓		Recovery mechanism disabled

Table 7: Ablation conditions for E4. Each condition uses a structurally modified contract that removes components at the specification level, ensuring that the LLM’s behavior is influenced only by the constraints it actually sees.

Model	Vendor	API pattern	Used in
GPT-5.2	OpenAI	OpenAI-compatible	E1–E4
Claude Opus 4.6	Anthropic	Anthropic Messages	E1–E4
DeepSeek-R1	DeepSeek	OpenAI-compatible	E1
Grok-4 Fast	xAI	xAI via OpenAI v1	E1
Llama 3.3 70B	Meta	OpenAI-compatible	E1–E4
Mistral Large 3	Mistral	OpenAI-compatible	E1–E4

Table 8: Models under test. All models are accessed via Azure AI Foundry. “Used in” indicates which experiments include each model; all 7 participate in E1, while E2–E4 use subsets to manage cost.

Model	Vendor	$C_{\text{hard}}^{\text{C}}$	$C_{\text{hard}}^{\text{U}}$	$C_{\text{soft}}^{\text{C}}$	$C_{\text{soft}}^{\text{U}}$	Soft viol. ${}^{\text{C}}$	Soft viol. ${}^{\text{U}}$	$\bar{D}$	$\Theta$
GPT-5.2	OpenAI	1.000	1.000	0.831	1.000	6.07	0.00	0.084	0.949
Claude Opus 4.6	Anthropic	0.946	0.914	0.819	0.970	6.50	0.30	0.117	0.930
DeepSeek-R1	DeepSeek	0.995	0.993	0.831	0.998	6.10	0.03	0.087	0.948
Grok-4 Fast	xAI	0.989	0.986	0.812	0.939	6.77	0.17	0.100	0.940
Llama 3.3 70B	Meta	1.000	0.997	0.855	0.987	5.23	0.00	0.073	0.956
Mistral Large 3	Mistral	0.882	0.838	0.810	0.987	6.83	0.20	0.154	0.908

Table 9: E1 results across 7 models from 6 vendors (60 sessions per model, 6 turns per session). Superscripts C and U denote contracted and uncontracted conditions, respectively.

C_{\text{hard}}

: hard compliance (fraction of hard constraints satisfied).

C_{\text{soft}}

: soft compliance (fraction of soft constraints satisfied). Soft viol.: mean soft violations detected per session.

\bar{D}

: mean behavioral drift score (contracted only).

\Theta

: agent reliability index (contracted only).

Model	$\Delta$ Soft viol.	Cohen’s $d$	$p$ -value
GPT-5.2	$+$ 6.07	33.82	$<0.0001$
Claude Opus 4.6	$+$ 6.20	9.30	$<0.0001$
DeepSeek-R1	$+$ 6.07	24.10	$<0.0001$
Grok-4 Fast	$+$ 6.60	9.25	$<0.0001$
Llama 3.3 70B	$+$ 5.23	6.70	$<0.0001$
Mistral Large 3	$+$ 6.63	12.30	$<0.0001$

Table 10: Statistical significance of soft violation differences between contracted and uncontracted conditions (E1). All comparisons use Welch’s

t

-test with Bonferroni-corrected

\alpha=0.01/7\approx 0.0014

Figure 1: Agent reliability index

\Theta

across 7 models (E1). Higher values indicate stronger overall contract satisfaction. Llama 3.3 70B achieves the highest

\Theta=0.956

; Mistral Large 3 the lowest at

\Theta=0.908

. All models exceed

\Theta>0.90

, confirming that ABC contracts maintain high reliability across vendors.

Model	$\bar{D}^{\text{C}}$	$D_{\text{max}}^{\text{C}}$	$\Theta^{\text{C}}$	Soft viol. ${}^{\text{C}}$	Soft viol. ${}^{\text{U}}$	Rec.	Cost
GPT-5.2	$0.109$	$0.169$	$0.935$	$15.70$	$0.03$	$1.00$	$1.28
Claude Opus 4.6	$0.180$	$0.253$	$0.892$	$18.63$	$0.67$	$1.00$	$2.33
Llama 3.3 70B	$0.069$	$0.144$	$0.959$	$9.80$	$0.00$	$0.50$	$0.91
Mistral Large 3	$0.198$	$0.264$	$0.881$	$19.27$	$0.57$	$0.17$	$2.71
Mean	$0.139$	$0.208$	$0.917$	$15.85$	$0.32$	$0.67$	—

Table 11: E2 drift prevention results across 4 models (60 sessions per model, 12 turns per session, 240 sessions total).

\bar{D}

: session-averaged drift.

D_{\text{max}}

: maximum per-turn drift reached. Soft viol.: mean soft violations per 12-turn session. Rec.: recovery success rate.

Figure 2: Drift trajectory

D(t)

over 12-turn sessions (E2). Contracted agents exhibit bounded drift consistent with the Ornstein–Uhlenbeck mean-reversion predicted by Theorem 4.3 . Drift stabilizes in the first half of the session and rises gradually in the second half, but never exceeds the pre-registered drift alert threshold.

Figure 3: Ornstein–Uhlenbeck drift model fit to observed E2 trajectories. For each model, the contracted drift trajectory

D(t)

is fitted to the OU mean-reversion model

D(t)=D^{*}+(D_{0}-D^{*})e^{-\gamma t}

, yielding model-specific parameters

\gamma

(recovery rate) and

D^{*}

(stationary drift level). Fits achieve

R^{2}=0.49

–

0.75

, confirming that the OU mean-reversion model captures the qualitative structure of contracted agent drift, with per-model variability reflecting differences in natural drift rate

\alpha

and recovery responsiveness

\gamma

Model	Stress Type	$C_{\text{hard}}^{\text{pre,C}}$	$C_{\text{hard}}^{\text{post,C}}$	$\Delta C_{\text{hard}}^{\text{C}}$	Viol. spike ${}^{\text{C}}$	Viol. spike ${}^{\text{U}}$	Rec. rate
GPT-5.2	Prompt Injection	$1.000$	$1.000$	$0.000$	$-2.07$	$0.00$	$0.00$
	Conflicting Advice	$1.000$	$1.000$	$0.000$	$+1.00$	$0.00$	$0.00$
	Boundary Push	$1.000$	$1.000$	$0.000$	$+1.07$	$+0.07$	$0.00$
Claude Opus 4.6	Prompt Injection	$0.980$	$0.980$	$0.000$	$-1.13$	$-0.10$	$0.33$
	Conflicting Advice	$0.980$	$0.980$	$0.000$	$+1.90$	$+0.40$	$0.91$
	Boundary Push	$0.980$	$0.943$	$-0.037$	$+1.60$	$+0.77$	$0.57$

Table 12: E3 governance stress results across 4 models and 3 adversarial stress types (30 sessions per model per stress type per condition, 720 sessions total).

C_{\text{hard}}^{\text{pre/post}}

: hard compliance before/after stress injection.

\Delta C_{\text{hard}}

: change in hard compliance due to stress. Viol. spike: change in soft violations at stress turn relative to baseline.

Model	Condition	$C_{\text{hard}}$	$C_{\text{soft}}$	$\bar{D}$	$\Theta$	$\Delta\Theta$	Soft viol.	Rec.
GPT-5.2	Full ABC	$1.000$	$0.831$	$0.084$	$\mathbf{0.949}$	—	$6.07$	$1.00$
	Hard Only	$1.000$	$1.000$	$0.084$	$0.975$	$+0.025$	$0.00$	$1.00$
	Soft Only	$1.000$	$0.831$	$0.084$	$0.741$	$-0.208$	$6.07$	$0.00$
	Drift Only	$1.000$	$1.000$	$0.084$	$0.975$	$+0.025$	$0.00$	$1.00$
	No Recovery	$1.000$	$0.831$	$0.084$	$0.741$	$-0.208$	$6.07$	$0.00$
Claude Opus 4.6	Full ABC	$0.943$	$0.815$	$0.121$	$\mathbf{0.927}$	—	$6.67$	$1.00$

Table 13: E4 ablation results across 4 models (30 sessions per model per condition, 6 turns per session, 600 sessions total). Each condition uses a structurally ablated contract; metrics reflect genuine runtime behavior, not post-hoc filtering.

\Delta\Theta

: change in reliability index relative to Full ABC baseline (negative = degradation when component is removed). Soft viol.: mean soft violations detected per session. Rec.: recovery success rate.

Condition	GPT-5.2	Opus 4.6	Llama 70B	Mistral L3	Mean
Soft Only	$-0.208$	$-0.201$	$-0.199$	$-0.192$	$-0.200$
No Recovery	$-0.208$	$-0.212$	$-0.199$	$-0.215$	$-0.209$

Table 14: Component contribution to

\Theta

: magnitude of

\Theta

degradation when each component is removed. Only conditions producing genuine degradation (Soft Only and No Recovery) are shown. Mean

\Delta\Theta

is averaged across all 4 models.

Figure 4: Ablation heatmap showing $\Theta$ across 4 models and 5 conditions (E4). Removing recovery (No Recovery) or hard constraints (Soft Only) produces consistent $\sim$ 0.20 degradation across all models. Hard Only and Drift Only conditions show inflated $\Theta$ due to vacuous soft compliance (see Section 7.6.3 ).

Figure 5: Runtime overhead of AgentAssert contract enforcement as a function of constraint count

k

. Overhead scales linearly in

k

( Proposition 4.15 ), remaining below 15 ms for

k=50

and below 25 ms for

k=100

—negligible relative to LLM inference latency of 1,000–3,000 ms.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Recovery mechanism impact on agent reliability (E4 data). Full ABC (with recovery) achieves

\Theta=0.908

–

0.967

across models, while removing recovery degrades

\Theta

0.199

–

0.215

(mean

-0.209

). The consistent

\sim

0.20 degradation across models with different baseline capabilities confirms that recovery contribution is an architectural property of ABC , not a model-specific artifact.

Figure 7: SPRT vs. fixed-sample certification efficiency. The Sequential Probability Ratio Test requires significantly fewer samples than Hoeffding fixed-sample bounds to certify

(p,\delta,k)

-satisfaction. Diamond markers show the stopping times for each model at their observed E1 compliance rates (

\Theta=0.908

–

0.956

), demonstrating that agents with higher compliance are certified faster.

AI Agent Reliability

AI agent reliability studies whether tool-using systems act correctly, consistently, safely, and recoverably across changing tasks and environments.

See all 338 papers

Aug 11, 2026

Agent Safety Should Be a Runtime Contract

The dominant paradigm treats AI safety as a property to be instilled during model training via RLHF, DPO, or Constitutional AI. We argue this is structurally insufficient for autonomous agents that execute code, mutate files, send messages, and modify databases. Agent safety should be a runtime contract enforced by the harness, and the contract has two complementary faces. The preventive face blocks dangerous actions before they happen via sandboxes, permission gates, output filters, and trajectory monitors. The evidential face requires verifiable proof that good actions actually happened, gating task submission on hard evidence such as test runs, log captures, file diffs, and citation grounding. We ground the position in four lines of public evidence, with row-level protocols and data released in the supplementary JSON files: a survey of 52 documented AI-agent and LLM safety incidents, a false-completion audit with 31 non-contested core cases plus one disputed illustrative case, a trajectory-schema audit of 12 public agent systems and harnesses, and a title-level audit of all 28,560 papers accepted at NeurIPS, ICML, and ICLR 2023-2025 showing a pooled 8-12x imbalance between training-time and deployment-time publication. Two prior communities that needed to enforce safety, computer security and the experimental sciences, converged on runtime contracts with both preventive and evidential elements; agentic AI is now under the same pressure. We formalize an Agent Trajectory Schema and Evidence Chain, state a compositional gating proposition based on standard monitor composition, and outline a research agenda. The right unit of safety in agentic AI is the trajectory-with-checkable-evidence, not the model.

Albus W. Ng, Yi Han, Jusheng Zhang +1

1Vast Intelligence Lab · 2Southwest University · 3Sun Yat-sen University

AI Agent Safety AI Agent Monitoring Runtime Enforcement for AI Agents

Ask PDF

Oct 20, 2026

Proof-Carrying Contracts: Commitments AI Agents Cannot Break

AI agents increasingly act on behalf of people or other agents, purchasing services, exchanging information and delegating work. What an agent must respect is written in instructions, policies or agreements, but text alone cannot make it comply. It may make mistakes, be redirected by what it reads, or pursue different interests. For an economy of such agents to function, parties need agreements they can rely on without inspecting or trusting one another's agents. We introduce Proof-Carrying Contracts (PC2), a framework for making agreed constraints enforceable throughout an agent's interactions with a system. Before a requested operation can run, the agent must supply a machine-checkable proof that it preserves the agreed constraints in every case allowed by its model. An execution system called the Airlock checks the proof and controls access to the operation. The parties specify the conditions to preserve, while the agent supplies the reasoning needed to justify its decisions and remains free to adapt its strategy. This avoids having to design a separate permission policy and prove that every decision it permits is safe. We prove that the constraints hold at every instant during execution, even for an adversarial agent, and identify when this implies safety in the world. Reusable capability modules provide tools and guarantees from which contracts can be constructed. PC2 provides a foundation for an agent economy whose agreements protect both those delegating work and those carrying it out.

Carlo Ciliberto, Alessandro Rudi, Enrico Tassi

AI Centre, Computer Science Department, University College London, London, UK · Praxis Lab, The Italian Institute of Artificial Intelligence (AI4I), Turin, Italy · SDA Bocconi School of Management. Milano, Italy +1

Runtime Enforcement for AI Agents AI Agent Safety AI Agent Governance

Ask PDF

Mar 18, 2026

A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance

In Agentic AI, Large Language Models (LLMs) are increasingly used in the orchestration layer to coordinate multiple agents and to interact with external services, retrieval components, and shared memory. In this setting, failures are not limited to incorrect final outputs. They also arise from long-horizon interaction, stochastic decisions, and external side effects (such as API calls, database writes, and message sends). Common failures include non-termination, role drift, propagation of unsupported claims, and attacks via untrusted context or external channels. This paper presents an assurance framework for such Agentic AI systems. Executions are instrumented as Message-Action Traces (MAT) with explicit step and trace contracts. Contracts provide machine-checkable verdicts, localize the first violating step, and support deterministic replay. The framework includes stress testing, formulated as a budgeted counterexample search over bounded perturbations. It also supports structured fault injection at service, retrieval, and memory boundaries to assess containment under realistic operational faults and degraded conditions. Finally, governance is treated as a runtime component, enforcing per-agent capability limits and action mediation (allow, rewrite, block) at the language-to-action boundary. To support comparative evaluations across stochastic seeds, models, and orchestration configurations, the paper defines trace-based metrics for task success, termination reliability, contract compliance, factuality indicators, containment rate, and governance outcome distributions. More broadly, the framework is intended as a common abstraction to support testing and evaluation of multi-agent LLM systems, and to facilitate reproducible comparison across orchestration designs and configurations.

Ciprian Paduraru, Petru-Liviu Bouruc, Alin Stefanescu

University of Bucharest Romania · University of Bucharest & Institute for Logic and Data Science Romania

AI Agent Reliability LLM Agent Orchestration AI Agent Evaluation AI Agent Governance Runtime Enforcement for AI Agents Runtime Verification

Ask PDF

Abstract

AI Agent Reliability

Explore similar work

Agent Safety Should Be a Runtime Contract

Proof-Carrying Contracts: Commitments AI Agents Cannot Break

A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance