Harnessing Embodied Agents: Runtime Governance for Policy-Constrained Execution

Xue Qin; Simin Luan; John See; Zeyd Boukhers; Cong Yang; Zhijun Li

cs.ROApr 9, 2026

Harnessing Embodied Agents: Runtime Governance for Policy-Constrained Execution

Authors: Xue Qin, Simin Luan, John See, Zeyd Boukhers, Cong Yang, Zhijun Li

Organizations: School of Software, Harbin Institute of Technology, Harbin, China. · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China. · School of Mathematical and Computer Sciences, Heriot-Watt University, Malaysia Campus, Putrajaya, Malaysia. · Fraunhofer Institute for Applied Information Technology, Sankt Augustin, Germany. ·

Abstract

Embodied Agents are evolving from passive reasoning systems into active executors that interact with tools, robots, and physical environments. Once an agent gains execution authority, the central challenge shifts from how to make it act to how to keep its actions governable at runtime. Existing approaches embed safety, recovery, and decision constraints inside the agent loop, making execution control difficult to standardize, audit, and adapt across environments. We propose a runtime governance framework for policy-constrained execution that separates agent cognition from execution oversight. Governance is externalized into a dedicated runtime layer performing policy checking, capability admission, execution monitoring, rollback, and human override. We formalize the control boundary among a persistent Embodied Agent, modular Capability Packages, and the governance layer, and define a policy-constrained execution pipeline evaluated under controlled simulation. Over 1000 randomized trials, the framework achieves 96.2%+/-2.7% interception of unauthorized actions, reduces unsafe continuation from 100% to 22.2%+/-3.1% under runtime drift, and attains 90.7%+/-3.0% recovery success with full policy compliance. Comparison with five baselines, including AutoRT-style constitution filtering and RoboGuard-style two-stage guardrails, shows that pre-execution filtering is equally effective across governance-aware methods, while only the proposed framework provides continuous runtime detection (RVDR = 61.3% vs. 0%) and structured recovery (all p<0.001). A sensitivity sweep across the full detection range confirms a genuine detection-continuation trade-off. This work argues future embodied systems should be designed for governable execution.

Figures & tables

Panel of Figure 1 — Figure 1: Core idea. (a) In ungoverned execution, the Embodied Agent directly invokes capabilities without policy checking, runtime monitoring, or recovery. (b) Our framework interposes a Runtime Governance Layer between agent cognition and physical execution: every capability invocation passes through admission control, policy checking, and execution monitoring, with recovery and human override at runtime. This separation makes execution policy-constrained, observable, recoverable, and auditable without modifying the agent model.

Dimension	Splx	ASpec	NeMo	AuRT	RoGd	EI/N.	Ours
Capability admission	–	$\sim$	–	✓	$\sim$	✓	✓
Policy-based gating	$\sim$	✓	✓	✓	✓	✓	✓
Runtime execution watch	✓	$\sim$	–	–	–	$\sim$	✓
Recovery & rollback	✓	–	–	–	–	–	✓
Human override interface	–	–	–	–	–	$\sim$	✓
Audit & telemetry	–	$\sim$	$\sim$	$\sim$	–	$\sim$	✓

Table 1: Qualitative comparison of runtime governance approaches along key governance dimensions. ✓ = supported,

\sim

= partial, – = not supported. Column abbreviations: Splx = Simplex; ASpec = AgentSpec; NeMo = NeMo Guardrails; AuRT = AutoRT; RoGd = RoboGuard; EI/N. = EI/Normative MAS ( Esteva et al., 2001 ; Grossi et al., 2007 ; Boissier et al., 2013 ) .

Panel of Figure 2 — Figure 2: Runtime governance framework architecture. Stratum 3 (Runtime Governance Layer) mediates between agent cognition and embodied execution through six coordinated components. Solid arrows indicate the forward execution path; dashed arrows indicate feedback, telemetry, and intervention flows.

Panel of Figure 3 — Figure 3: Policy-constrained execution pipeline. The seven stages form a governed lifecycle: agent proposals pass through admission and policy evaluation before monitored execution. Runtime observation may trigger intervention, recovery, or escalation. Dashed arrows indicate feedback, modification, rejection, and replanning paths.

Component	Prototype Role
Embodied Agent	Task planning and capability proposal
Capability Package	Structured executable skill unit
Runtime Governance Layer	Admission, policy check, watching, recovery
Execution Substrate	ROS 2 / simulator / robot interface
Audit Trace	Execution record and intervention log

Table 2: Prototype components and their roles in the reference implementation.

Method	UAIR $\uparrow$	FRR $\downarrow$
Direct Exec.	$.000{\scriptstyle\pm.000}$	$.000{\scriptstyle\pm.000}$
Static Rule	$.595{\scriptstyle\pm.065}$	$.000{\scriptstyle\pm.000}$
Cap.-Internal	$.595{\scriptstyle\pm.065}$	$.000{\scriptstyle\pm.000}$
AutoRT-Style	$.962{\scriptstyle\pm.027}$	$.000{\scriptstyle\pm.000}$
RoboGuard-Style	$.962{\scriptstyle\pm.027}$	$.000{\scriptstyle\pm.000}$
Proposed	$\mathbf{.962}{\scriptstyle\pm.027}$	$\mathbf{.000}{\scriptstyle\pm.000}$

Table 3: Unauthorized action interception (mean

\pm

std, 5 seeds). Tier-2 and Tier-3 methods share the same admission–policy pipeline and achieve identical UAIR, confirming that pre-execution filtering is equally effective across governance-aware methods.

Method	RVDR $\uparrow$	CEF $\uparrow$	UCR $\downarrow$
Direct Exec.	$.000{\scriptstyle\pm.000}$	–	$1.00{\scriptstyle\pm.000}$
Static Rule	$.000{\scriptstyle\pm.000}$	–	$1.00{\scriptstyle\pm.000}$
Cap.-Internal	$.351{\scriptstyle\pm.011}$	$.600{\scriptstyle\pm.000}$	$.649{\scriptstyle\pm.011}$
AutoRT-Style	$.000{\scriptstyle\pm.000}$	–	$1.00{\scriptstyle\pm.000}$
RoboGuard-Style	$.000{\scriptstyle\pm.000}$	–	$1.00{\scriptstyle\pm.000}$
Proposed	$\mathbf{.613}{\scriptstyle\pm.020}$	$\mathbf{1.00}{\scriptstyle\pm.000}$	$\mathbf{.222}{\scriptstyle\pm.031}$

Table 4: Runtime violation monitoring (mean

\pm

std, 5 seeds). AutoRT-Style and RoboGuard-Style lack continuous monitoring (RVDR = 0), leaving all runtime violations undetected.

Method	RSR $\uparrow$	RBSR $\uparrow$	MRT(s) $\downarrow$	RPC $\uparrow$
Direct Exec.	$.334{\scriptstyle\pm.038}$	$.000{\scriptstyle\pm.000}$	$1.28{\scriptstyle\pm.030}$	$.000{\scriptstyle\pm.000}$
Static Rule	$.460{\scriptstyle\pm.029}$	$.000{\scriptstyle\pm.000}$	$.897{\scriptstyle\pm.033}$	$.000{\scriptstyle\pm.000}$
Cap.-Internal	$.580{\scriptstyle\pm.034}$	$.411{\scriptstyle\pm.028}$	$.597{\scriptstyle\pm.009}$	$.538{\scriptstyle\pm.014}$
AutoRT-Style	$.320{\scriptstyle\pm.037}$	$.000{\scriptstyle\pm.000}$	$1.11{\scriptstyle\pm.023}$	$.000{\scriptstyle\pm.000}$
RoboGuard-Style	$.383{\scriptstyle\pm.040}$	$.000{\scriptstyle\pm.000}$	$.991{\scriptstyle\pm.022}$	$.000{\scriptstyle\pm.000}$
Proposed	$\mathbf{.907}{\scriptstyle\pm.030}$	$\mathbf{.533}{\scriptstyle\pm.032}$	$\mathbf{.169}{\scriptstyle\pm.003}$	$\mathbf{1.00}{\scriptstyle\pm.000}$

Table 5: Recovery and rollback (mean

\pm

std, 5 seeds). Pre-execution-only methods (AutoRT, RoboGuard) lack structured recovery and achieve RSR comparable to Direct Execution.

Violation Type	Detection Rate
Force exceeded	$.688{\scriptstyle\pm.045}$
Speed exceeded	$.735{\scriptstyle\pm.047}$
Retry exceeded	$.697{\scriptstyle\pm.052}$
Postcondition failed	$.758{\scriptstyle\pm.061}$
Zone violation	$.503{\scriptstyle\pm.041}$
Human proximity	$.248{\scriptstyle\pm.040}$

Table 6: Per-violation-type detection rates, proposed framework (mean

\pm

std, 5 seeds).

Baseline	$d$ (RVDR)	$d$ (UCR)	$d$ (RSR)
Direct Execution	$43.3$	$33.6$	$26.1$
AutoRT-Style	$43.3$	$33.6$	$24.8$
RoboGuard-Style	$43.3$	$33.6$	$23.9$
Capability-Internal	$16.4$	$29.1$	$19.1$
Static Rule	$43.3$	$33.6$	$16.0$

Table 7: Effect sizes (Cohen’s

d

) for the proposed framework versus each baseline. All

p<0.001

(paired

t

-test,

df{=}4

); Wilcoxon signed-rank

p{=}0.031

(minimum achievable with

N{=}5

, all pairs concordant in direction).

	Actually Unauth.	Actually Auth.
Blocked	490 (TP)	0 (FP)
Allowed	17 (FN)	493 (TN)

Table 8: Governance decision confusion matrix (aggregated over 1000 trials).

Variant	UAIR $\uparrow$	RVDR $\uparrow$	UCR $\downarrow$	RSR $\uparrow$	RPC $\uparrow$
Full	$\mathbf{.972}{\scriptstyle\pm.027}$	$\mathbf{.585}{\scriptstyle\pm.035}$	$\mathbf{.241}{\scriptstyle\pm.040}$	$\mathbf{.930}{\scriptstyle\pm.014}$	$\mathbf{1.00}{\scriptstyle\pm.000}$
–Admit	$.509{\scriptstyle\pm.029}$	$.584{\scriptstyle\pm.010}$	$.242{\scriptstyle\pm.016}$	$.912{\scriptstyle\pm.020}$	$1.00{\scriptstyle\pm.000}$
–Policy	$.567{\scriptstyle\pm.046}$	$.611{\scriptstyle\pm.030}$	$.215{\scriptstyle\pm.037}$	$.922{\scriptstyle\pm.014}$	$1.00{\scriptstyle\pm.000}$
–Watch	$.972{\scriptstyle\pm.027}$	$.000{\scriptstyle\pm.000}$	$1.00{\scriptstyle\pm.000}$	$.899{\scriptstyle\pm.022}$	$1.00{\scriptstyle\pm.000}$
–Recov	$.972{\scriptstyle\pm.027}$	$.578{\scriptstyle\pm.021}$	$.248{\scriptstyle\pm.039}$	$.311{\scriptstyle\pm.025}$	$.000{\scriptstyle\pm.000}$
–Human	$.793{\scriptstyle\pm.034}$	$.605{\scriptstyle\pm.033}$	$.221{\scriptstyle\pm.029}$	$.916{\scriptstyle\pm.007}$	$1.00{\scriptstyle\pm.000}$

Table 9: Component ablation study (mean

\pm

std, 5 seeds). Each row removes one governance component.

Condition	Block Rate $\uparrow$	Incorrect Allow $\downarrow$
With Override	$\mathbf{1.000}{\scriptstyle\pm.000}$	$\mathbf{.000}{\scriptstyle\pm.000}$
Without Override	$.000{\scriptstyle\pm.000}$	$1.00{\scriptstyle\pm.000}$

Table 10: Human override evaluation (mean

\pm

std, 5 seeds).

Component	Mean	Std	P50	P99
Admission	$0.23$	$0.01$	$0.24$	$0.35$
Policy Guard	$0.29$	$0.01$	$0.28$	$0.45$
Watcher/step	$0.26$	$0.00$	$0.26$	$0.39$
Recovery	$0.19$	$0.00$	$0.19$	$0.33$
Total pre-exec	$0.47$	$0.01$	$0.51$	$0.72$

Table 11: Governance-layer per-action latency (

\mu

s, 5 seeds

\times

1000 trials).

Sensitivity	RVDR $\uparrow$	UCR $\downarrow$	RSR
0.0	$.000$	$.796$	$.905$
0.2	$.165$	$.631$	$.905$
0.4	$.318$	$.478$	$.905$
0.5	$.396$	$.400$	$.905$
0.6	$.469$	$.327$	$.905$
0.8	$.778$	$.186$	$.920$

Table 12: Sensitivity sweep: watcher detection and unsafe-continuation frontier (proposed framework, 5 seeds, 1000 trials per point).

Figure 4: Detection–continuation frontier. As watcher sensitivity increases from 0.0 to 1.0, RVDR rises monotonically while UCR falls to zero. Recovery success (RSR) remains stable at 90–92%, confirming that the recovery subsystem is independent of detection sensitivity. The crossing point near sensitivity

=0.5

marks the operating region where detection and continuation rates are approximately balanced.

EU AI Act Article	Obligation	Framework Component
Art. 9 (Risk mgmt.)	Identify, estimate, and mitigate risks throughout lifecycle	Capability Admission + Policy Guard (pre-execution risk gate); environment profiles parameterize risk bounds per deployment
Art. 12 (Record-keeping)	Automatic logging enabling traceability of system decisions	Audit trace $\Lambda_{t}$ records every admission decision, policy outcome, watcher event, and recovery action
Art. 13 (Transparency)	Sufficient transparency for deployers to interpret output	External policy knowledge base is inspectable; governance decisions reference named rules and predicates
Art. 14 (Human oversight)	Effective human oversight including ability to intervene, interrupt, or halt	Human Override Interface with approval, takeover, and forced-stop modes (Section 4 confirms 100% block without override)
Art. 15 (Robustness)	Resilience against errors, faults, and inconsistencies	Execution Watcher (continuous monitoring) + Recovery Manager (structured rollback and retry under policy compliance)

Table 13: Regulatory traceability: EU AI Act (2024/1689) requirements mapped to framework components.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 273 papers

EmbodiedGovBench: A Benchmark for Governance, Recovery, and Upgrade Safety in Embodied Agent Systems
Apr 13, 2026Xue Qin, Simin Luan, John See +2AI Agent Governance AI Agent Safety Benchmarks
School of Software, Harbin Institute of Technology, Harbin, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China · School of Mathematical and Computer Sciences, Heriot-Watt University, Malaysia Campus, Putrajaya, Malaysia +1
Governance by Construction for Generalist Agents
May 20, 2026Segev Shlomov, Iftach Shoham, Alon Oved +7LLM Guardrails AI Agent Governance
IBM Haifa, Israel
Think Before You Act -- A Neurocognitive Governance Model for Autonomous AI Agents
Apr 28, 2026Eranga Bandara, Ross Gore, Asanga Gunaratna +12Cognitive Architectures for AI Agents AI Agent Governance
Old Dominion University, Norfolk, VA, USA · AI Motion Labs, Melbourne, Australia · Florida International University, FL, USA +6

Apr 13, 2026J/K move · Enter open · S save

EmbodiedGovBench: A Benchmark for Governance, Recovery, and Upgrade Safety in Embodied Agent Systems

Xue Qin, Simin Luan, John See, Cong Yang+1

School of Software, Harbin Institute of Technology, Harbin, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China · School of Mathematical and Computer Sciences, Heriot-Watt University, Malaysia Campus, Putrajaya, Malaysia+1

AI Agent Governance AI Agent Safety Benchmarks AI Agent Benchmarks Embodied AI

Open paper AskPDF arXiv

Recent progress in embodied AI has produced a growing ecosystem of robot policies, foundation models, and modular runtimes. However, current evaluation remains dominated by task success metrics such as completion rate or manipulation accuracy. These metrics leave a critical gap: they do not measure whether embodied systems are governable -- whether they respect capability boundaries, enforce policies, recover safely, maintain audit trails, and respond to human oversight. We present EmbodiedGovBench, a benchmark for governance-oriented evaluation of embodied agent systems. Rather than asking only whether a robot can complete a task, EmbodiedGovBench evaluates whether the system remains controllable, policy-bounded, recoverable, auditable, and evolution-safe under realistic perturbations. The benchmark covers seven governance dimensions: unauthorized capability invocation, runtime drift robustness, recovery success, policy portability, version upgrade safety, human override responsiveness, and audit completeness. We define a benchmark structure spanning single-robot and fleet settings, with scenario templates, perturbation operators, governance metrics, and baseline evaluation protocols. We describe how the benchmark can be instantiated over embodied capability runtimes with modular interfaces and contract-aware upgrade workflows. Our analysis suggests that embodied governance should become a first-class evaluation target. EmbodiedGovBench provides the initial measurement framework for that shift.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

EmbodiedGovBench: A Benchmark for Governance, Recovery, and Upgrade Safety in Embodied Agent Systems

Governance by Construction for Generalist Agents

Think Before You Act -- A Neurocognitive Governance Model for Autonomous AI Agents