The Last Human Gate: Forward Deployed Engineering for Governance Automation

Jeremy Canale

cs.AISep 24, 2026

The Last Human Gate: Forward Deployed Engineering for Governance Automation

Authors: Jeremy Canale

Abstract

Enterprise governance requires decisions, evidence, and accountable authority; it does not require every review task to retain its current human implementation. We develop a task-substitution framework for Digital Governance Frameworks (DGF), treating each gate as an executable contract. Substitution requires sufficient accessible information, valid decision and authority checks, and a reduction in total human work after exceptions, verification, correction, and maintenance are counted. We derive a residual-work threshold and show why automating most cases can still increase labor. Forward deployed engineering connects these conditions to an architecture for agents, rule engines, evidence services, and escalation. DGF-Bench supplies controlled evidence from 300 synthetic projects and 899 evaluable model-project runs. Gemini 3.8 Flash, GPT-5.6 Luna, and DeepSeek v4.1 Flash achieve strict gate success of 94.98%, 83.29%, and 74.18%; complete-route success is 76.92%, 42.33%, and 24.67%. A deterministic control passes all 1,700 gates given the supplied rules and structured facts, locating the comparison in execution of a supplied decision kernel. Evidence audits and 135 repeated runs distinguish correct decisions from reliable execution. A document counterexample establishes an information-sufficiency obstruction. These results support the technical feasibility of replacing human execution of specified governance-review tasks with agents and software. The framework specifies a workforce test based on the complete human effort required at fixed output and quality; the present measurements concern review performance. Sources, dossiers, traces, and analyses are public.

Figures & tables

Panel of Figure 1 — Figure 1: Three DGF workflows evaluated in DGF-Bench. A project follows the route matching its need. Arrows show review order and information handoffs; General consolidates preceding reviews. The benchmark runs all scheduled gates, including after a refusal. These are example governance routes, not automatic approvals or a universal enterprise standard.

Claim	Observable test	Evidence in this paper
Contract execution	Decision, findings, actions, evidence, and mandate meet fixed criteria	Original runs and deterministic control
Workflow reliability	Every required gate succeeds; repeated trajectories remain successful	Complete-route scores and 135 additional runs
Net task substitution	Accepted output requires fewer total human hours	Accounting conditions and illustrative calculations
Ecosystem workforce reduction	Comparable governed output and quality with a lower complete FTE account	Dated hypothesis and a measurement protocol

Table 1: Claim structure and evidence required. A result at one level does not supply the missing observation at another.

Benchmark	Central task	Relation to this study
WorkArena	Execute knowledge-work tasks through enterprise web interfaces	Interface operation can support evidence collection, but is not the gate-review endpoint here
ITBench	Address operational IT automation scenarios	Operational execution and remediation differ from reviewing whether a project meets a governance contract
$\tau$ -bench	Use tools while following domain policies in a user interaction	Motivates repeated reliability and policy compliance; DGF-Bench follows specialist reviews through a dossier route
DGF-Bench	Produce a disposition with findings, actions, observed evidence, and authorization	Measures complete review records and whole-route success under explicit supplied policies and facts

Table 2: Neighboring evaluation tasks. The descriptions concern the cited releases; no cross-benchmark performance ordering is inferred.

Gate	Review question	Examples of material examined
Procurement	Does the selected supplier satisfy purchasing requirements?	Offers, mandatory criteria, due diligence, sanctions, and three-year cost
Legal	Are the contractual prerequisites and signing authority present?	Data-processing agreement, liability, exit assistance, and signing authority
Compliance	Does the proposal satisfy the applicable compliance checks?	Required impact assessment, residency, regulatory mapping, and audit trail
Security	Does the design provide the protections required for its exposure and data?	Identity controls, private endpoints, monitoring, and vulnerability findings
IT	Does the proposal fit the technology and operating environment?	Catalog status, existing capability, capacity, support ownership, and change records
Architecture	Is the proposed system consistent with the declared design constraints?	Network overlap, interfaces, data ownership, latency, and reversibility

Table 3: What each benchmark gate reviews. Questions summarize the supplied policies; listed records and checks are examples, not exhaustive definitions of the professions.

Property	Potential advantage	Condition that can defeat it
Recurring dossiers and outputs	Reusable extraction and decision interfaces	Material facts remain tacit or inaccessible
Explicit policies and mandates	Executable checks and bounded delegation	Conflicting rules or discretionary commitments
Recorded gate handoffs	Shared evidence and traceable dependencies	Work is repeated or lost between teams
Repeated review populations	Integration cost spread across cases	Low volume or frequent policy change
Observable acceptance criteria	Regression tests and monitored service	Evaluation rewards format instead of valid work

Table 4: Properties that make a governance workflow a candidate for task substitution.

Quantity	Required observation	Interpretation
$\lambda,h_{0}$	Review visits and baseline hours	Scale and baseline intensity
$q,\phi$	Routed cases and their baseline hours	Case coverage versus retained labor
$h_{E},\eta$	Complete exception effort	Assistance or inflation on the residual
$h_{R},\mu$	Ordinary review and audit effort	Human work remaining on the standard path
$h_{W}$	Additional correction and rework	Work created beyond the recorded paths
$B_{H},B_{A}$	Allocated recurring support	Human upkeep in both regimes

Table 5: Operational measurements behind the labor account. Conditional means use the same frozen routing partition; time categories must not overlap.

Figure 2: Illustrative human-work requirements with the same case partition: baseline 140 FTE; four operating assumptions produce 43.52, 85.32, 89.07, and 168.92 FTE. The dashed line is the author’s 80% reduction target, not a fitted forecast. Parameters and calculation are released.

Scenario	Visits	$q$	$\kappa$	$\eta$	Support h/visit	$\rho$
Integrate	5	0.60	1.4	1.0	13.20	1.451
Build	95	0.14	2.0	0.8	0.69	0.360
Integrate at higher volume	95	0.60	1.4	1.0	0.69	0.930

Table 6: Synthetic route-specific labor requirements on the same platform. The final row changes only Integrate’s visit volume; it is an alternative scale calculation, not a third route added to the 20-FTE population.

Panel of Figure 3 — Figure 3: Proposed gate implementation. Every human contribution, including support of these services, belongs in the labor account. Passing a technical check alone is not a certificate of complete substantive correctness.

Deliverable	Acceptance criterion	Human-work location
Source interface	Recover required premises or report their absence; preserve source identity	Preparation and verification; recurring connector upkeep in $B_{A}$
Policy and mandate service	Apply the specified version; reject unauthorized commitments; retain unresolved conditions	Ordinary checks in $h_{R}$ ; exceptional decisions in $h_{E}$
Evidence and handoff record	Findings retain observed support and their open obligations through downstream reviews	Repeated review in $h_{R}$ or $h_{E}$ ; additional repair in $h_{W}$
Operating ledger	Record case work and shared support across teams and suppliers	Case work in $h_{E},h_{R},h_{W}$ ; shared recurring effort in $B_{A}$

Table 7: Proposed engineering deliverables and acceptance checks. Human hours are allocated once to the account in Section 4 ; these are deployment requirements, not measured savings.

Figure 4: Implemented experimental workflow. A program generates the case and evidence; the tested model investigates and submits reviews; a deterministic evaluator scores the retained trace. Public authoritative facts are available in addition to documents.

Outcome	Gemini	Luna	DeepSeek	Rules
Evaluable projects	299	300	300	300
Evaluable gates	1,694	1,700	1,700	1,700
Correct dispositions	1,694	1,668	1,619	1,700
Strict gate successes	1,609	1,416	1,261	1,700
Strict gate success (%)	94.98	83.29	74.18	100.00
Complete routes	230	127	74	300

Table 8: Task execution on the original population and repeated trajectories. Counts preserve the original strict endpoint. Sensitivity accepts specified structural evidence matches; it is post-hoc and is not a semantic adjudication. The deterministic control was not repeated.

Gate	DeepSeek	Gemini	Luna
Architecture	75.00	85.43	89.50
Compliance	88.00	100.00	96.00
General	68.67	87.96	61.67
IT	87.00	100.00	97.67
Legal	68.50	99.50	80.50
Procurement	43.00	96.00	33.00

Table 9: Strict gate success by review family (percent). Columns retain the original generated table order. Gemini has one fewer Integrate dossier, affecting six of its gate families.

Recorded quantity	Gemini	Luna	DeepSeek
Approval calls	864	394	216
Rejected calls	466	40	14
Used conditional decisions	398	353	202
Eligible gates, all scored runs	398	398	397
Used on matched opportunities / 391	391	347	201

Table 10: Conditional-approval behavior in the original runs. The final row restricts the comparison to the same 391 eligible non-General gates in the 299 shared dossiers. Calls rejected by the environment are recorded separately from final review outcomes.

Figure 5: The generated architecture document in Project Falcon’s actual dossier. The diagram is review evidence, not an independently validated production design. Identity, application, data, monitoring, backup, and recovery elements contextualize the readiness example.

Condition	Policy representation	Permitted evidence
A	Executable definitions	Authoritative structured snapshots
B	Semantically equivalent prose	The same snapshots
C	The same executable definitions	Documents and operational records sufficient to recover the same facts
D	The same prose as B	The same documents and records as C

Table 11: Proposed matched-information design. These conditions describe an unexecuted extension, not four completed experiment arms.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Claim or operation	Inspectable record
Original metrics and intervals	research/2026-09-dgf-bench/paper_results.json
Matched model comparisons	research/2026-09-dgf-bench/paired_comparisons.json
Falcon and Meridian traces	research/2026-09-dgf-bench/worked_examples.json
Structural evidence audit	research/2026-09-followup/ALL_MODELS_AUDIT.md
Repeated trajectories	research/2026-09-followup/repetition_analysis.json
Information counterexample	research/2026-09-followup/document_ablation_preflight.json

Appendix

Table 12: Repository records for the principal claims. Paths are relative to the public repository; the release linked in the data statement contains the larger underlying archives.

Explore similar work

DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards
Sep 28, 2026Jeremy CanaleGovernance Deception
Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI
Apr 18, 2026Christopher Koch, Joshua Andreas WellbrockArtificial Intelligence Governance Governance
Independent Researcher
Think Before You Act -- A Neurocognitive Governance Model for Autonomous AI Agents
Apr 28, 2026Eranga Bandara, Ross Gore, Asanga Gunaratna +12Artificial Intelligence Governance Governance
Old Dominion University, Norfolk, VA, USA · AI Motion Labs, Melbourne, Australia · Florida International University, FL, USA +6

Sep 28, 2026, cs.AIJ/K move · Enter open · S save

DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards

Jeremy Canale

Governance Deception Model Auditing Tamper Localization Language-Model Agents

Open paper AskPDF arXiv

Tool-using language-model agents can review enterprise projects as governance boards do: they read the evidence, apply written rules and decide whether the project may proceed. Part of that evidence comes from suppliers and project members with a stake in the decision. DGF-Bench is a benchmark in which a board of agents (specialist gates and a General gate that consolidates their decisions) reviews synthetic dossiers while an attacker plants deceptive content in evidence the organization does not vouch for. Dossiers are generated from canonical facts under 61 executable rules, with 42 authoritative records and 32 narrative documents; every gate is certified decidable from those records. Attacks never change an authoritative value, so an attacked dossier keeps the reference decisions of its clean copy. A success is attributable only when the agent receives the injection and takes the exact injected action, which it does not take on the paired clean dossier; the DGF score is the share of applicable fixed attacks a model blocks. Reading documents and records themselves, five of six models were outcome-strict (disposition, findings, actions and authorization all correct) on 82 to 85 of 85 gates. Over 2,622 attacked gate runs, seven direct-order, false-data and false-authority attacks obtained one attributable success against these five, whereas task-aligned attacks imitating the organization's own process passed against four of them: a record note citing a fake review procedure lowered GPT-6 Luna Pro from 34 to 6 outcome-strict gates and DeepSeek V4 Pro from 33 to 7. DGF scores ranged from 96.2 to 26.9, and a policy-aware adaptive attacker writing in records succeeded against five of six models. The approval tool executed no forged approval, yet deceived agents submitted approvals that the rules forbid. The open-source package dgf-bench computes the DGF score with one command.

Abstract

Explore similar work

DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards

Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI

Think Before You Act -- A Neurocognitive Governance Model for Autonomous AI Agents