Organising Trajectory Evidence for Language-Model Agent Assurance: Fragments, Methods, and the Residual

Xiaowei Huang

cs.MAOct 3, 2026

Organising Trajectory Evidence for Language-Model Agent Assurance: Fragments, Methods, and the Residual

Authors: Xiaowei Huang

Organizations: University of Liverpool Liverpool, United Kingdom

Abstract

Methods for assessing language-model agents include rule checkers over logs, analyses of skill coverage and composition, support checkers, prefix monitors, execution gates, and rare-event estimators. Each observes a different part of a run and makes a claim of a different strength, and no common account says how these claims combine or what they leave unchecked. We give one, built from a logic, information fragments, and an assurance ledger. Requirements are formulas of a two-tier logic: an outer finite-trace temporal logic over recorded events, and an inner logic of standing over the argument structure that the agent's recorded context supports at a decision. A rule violation and an action taken on withdrawn support are thus formulas of one language. The information available to an assessor, to the agent, and to an execution gate defines fragments of that language; each checking method decides one fragment and returns a typed claim: exact, on a named test suite, a risk bound, or descriptive. The ledger merges the evidence and classifies every obligation as established, addressed but not established, or unaddressed. On 456 released $τ^2$ -bench telecom trajectories, the benchmark oracle flags 231 runs; adding a rule checker, a support stand-in, and a prefix-monitor baseline raises the union to 391, 401, and 407, each contributing flags the others miss, and a gate makes one prohibition exact on a gated deployment. The 49 unflagged runs and the unmet or unaddressed obligations form the residual. Discovery makes unknown requirements explicit, and new or stronger checkers then reduce it.

Figures & tables

Panel of Figure 1 — Figure 1. The framework. Requirements are formulas; each method decides a fragment with a stated strength; the ledger merges typed claims and names the residual; discovery makes requirements explicit, and checkers reduce it. A vertical flow diagram: trajectories of a deployment feed the two-tier logic, which is split into three information fragments; methods check fragments and send typed claims to the ledger, which outputs the residual; an arrow from the residual back to the methods is labelled add a checker.

Method	Reads	Target formula	Claim type	Cannot see
Outcome oracle	final state, required actions	$\neg F$	suite count	how the outcome was reached
Rule checker (Skill Coverage ( Tan et al., 2026 ) )	$\mathit{Log}(\tau)$ , complete run	$\varphi_{c}\in\mathcal{L}_{\mathrm{obs}}$ for each audited rule	suite count $(n_{\mathrm{app}},n_{\mathrm{viol}})$	unlisted requirements; the agent’s premises; world predicates
Support checker (Grounded Continuation ( He et al., 2026 ) )	$(s_{t},a_{t})$ , the agent’s prefix	$\mathbf{G}\forall a(\mathit{checked}(a)\Rightarrow\mathit{grounded}(a))\in\mathcal{L}_{\mathrm{loc}}$	exact for the extracted structure; suite count	whether a grounded action is correct or compliant
Prefix monitor (PrefixGuard ( Huang et al., 2026 ) )	prefix $\tau_{\leq t}$	warning of the event its labels name	recall at a false-alarm rate	any event absent from its labels
Boundary gate	$(s_{t},a_{t})$ at one call	guard form of a rule in $\mathcal{L}_{\mathrm{act}}$	exact invariant on $\Sigma_{g}$	obligations to act; the run after a refusal
Rare-event estimator (SCARCE ( Wang et al., 2026 ) )	re-sampled runs	$\Pr(\neg\varphi)$ for a score-defined event	lower risk bound	events its score does not order

Table 1. Methods as fragment checkers. The claim type is what the method returns; the blind spot is the class of failures outside its target formula, not a defect of its implementation. Discovery methods enlarge the requirement set rather than check it.

Rule	Requirement (abbreviated)	App.	Viol.
$c_{1}$	Identify customer before account write	302	0
$c_{2}$	Read bill before payment request	84	0
$c_{3}$	Re-check bill after payment	83	2
$c_{4}$	Refuel at most 2 GB	181	0
$c_{5}$	Obtain plan price before refuelling	181	4
$c_{6}$	Read line record before restoration	83	0

Table 2. Audited rules on the 456-run suite. Positive applicability with zero violations meets only the suite contract.

Pair	Both	Exp.	Only 1st	Only 2nd	Dis.	Indep.
$C$ / $G$	102	87	236	15	.55	.62
$C$ / $M$	131	136	207	52	.57	.55
$C$ / $O$	178	171	160	53	.47	.50
$G$ / $M$	30	47	87	153	.53	.45
$G$ / $O$	46	59	71	185	.56	.50
$M$ / $O$	161	93	22	70	.20	.50

Table 3. Pairwise overlap of run-level verdicts. “Exp.” is the product-of-marginals reference under run-level independence; “Dis.” is the fraction of runs on which the verdicts differ, with its independence reference.

Obligation	System	Contract	Status	Evidence or missing premise
$c_{1},c_{2},c_{4},c_{6},c_{8},c_{10},c_{16}$	$\Sigma$	Suite, $k=1$	Established on suite	Applicable and unviolated on the 456 runs.
Other 13 rules, incl. $c_{7}$	$\Sigma$	Suite, $k=1$	Addressed, not established	At least one observed violation each.
Support ideal	$\Sigma$	Suite, $k=1$	Addressed, not established	117 runs with an ungrounded action.
Outcome $\neg F$	$\Sigma$	Suite, $k=1$	Unmet: counterexamples	231 failures.
Outcome risk $\leq\varepsilon$	$\Sigma$	Risk	Not established: scope	No deployment distribution; runs clustered by task.
Warning ideal	$\Sigma$	Exact	Addressed, not established	Retrospective operating points do not establish the ideal.

Table 4. The merged ledger, conditional on the audited rule semantics and correct implementation. “Established on suite” never means established on all deployment runs; the gated rows concern a different deployment.

Method family	Target	Placement
Workflow conformance ( Donadello et al., 2022 ; Berti et al., 2019 )	ordering and eventual obligations	fits $\mathcal{L}_{\mathrm{obs}}$
Specified enforcement ( Wang et al., 2025a ; Kahani et al., 2026 )	approval, budget, consent guards	fits $\mathcal{L}_{\mathrm{act}}$
Information flow ( Wang et al., 2025b ; Hu et al., 2026c )	purpose-bound disclosure $\varphi_{\mathrm{flow}}$	new map
Adversarial scenarios ( Debenedetti et al., 2024 )	authorised actions under injection	new distribution
Repeated-run stability	$\Pr[q(\tau)\neq q(\tau^{\prime})]\leq\varepsilon$	relational
Counterfactual pairs	decision tracks permission, not cues	relational

Table 5. Further method families placed in the framework. “Fits”: an existing fragment; “new map”: a new observation map or distribution; “relational”: a property of several runs, outside the current logic.

Explore similar work

Oct 3, 2026

From Probe Scores to Alarm Policies: Operational Validity of Activation Monitors for Language-Model Agents

Activation probes can predict safety-relevant properties of language models with high area under the receiver-operating-characteristic curve (AUROC), but deployed agent monitors make thresholded alarm decisions under tight false-alarm budgets. These are different estimands. We introduce an Operational Validity Contract that fixes a monitor's target, observability, identity, timing, intervention unit, comparator, calibration, and cost. We formalize risk at the semantic request or trajectory level: when one task contains repeated alarm opportunities, row-level AUROC and false positive rate do not identify semantic-unit any-alarm risk. A confidence-certified threshold also requires enough independent negative units, a tie-safe rule, and transport to deployment. Across Models Under Pressure, LASR refusal prediction, immutable AgentDojo, and a prospectively protocol-frozen ST-WebAgentBench replication, joint activation-observable monitors reach AUROC 0.957 and 0.935 on the first two benchmarks, yet their locked 5%/10% detection rates are only .642/.742 and .719/.782, respectively. On AgentDojo, the secondary mean-activation rollout monitor reaches AUROC 0.922 but detects none of 38 positive semantic cases at the locked 5% operating point; thresholds intended for 10% false alarms realize 18.7-20.0% on test. Because the test misses its prospectively frozen 40-positive support gate, we label it support-insufficient. On ST-WebAgentBench, activation reaches AUROC .874, but 23 independent calibration negatives cannot identify even a 10% controller; the locked policy abstains rather than reporting its mechanical zero FPR as a success. An exploratory counterexample also lowers full AUROC while improving realized 10% utility. The fail-closed compiler caps MUP and LASR at restricted predictive value and AgentDojo and ST-Web at representation accessibility; no setting reaches alarm-policy validity.

Xueping Gao

Alibaba Cloud Computing Hangzhou, China

AI Agent Monitoring Language Model Safety Evaluation AI Agent Safety Benchmarks Binary Classification

Ask PDF

Aug 19, 2026

LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents

Large language model (LLM) agents can now carry out long-horizon technical workflows involving complex tool use, code execution, file edits, and generated artifacts. As agents do more work faster, the productivity bottleneck shifts from producing outputs to auditing whether those outputs are correct and trustworthy. Agent observability systems make fine-grained execution events visible, but visibility alone still leaves reviewers to reconstruct which actions, artifacts, and validation steps matter for a particular conclusion. We introduce LEDGER - Layered Evidence and Decision Graphs for Execution Review, a tracing and review system that builds layered trace graphs over observed agent sessions. LEDGER preserves Trace Records while grouping them into Evidence Nodes and Workflow Nodes, representing artifacts as evidence anchors, and adding typed semantic edges that connect claims to supporting actions, artifacts, and checks. Through data-analysis and coding examples, we show how the resulting traces expose workflow decisions, artifact lineage, repair steps, validation coverage, and claim-support paths for evidence-centered audit.

Daehong Kim, Haichao Miao, Shusen Liu

Carnegie Mellon University Pittsburgh, PA 15213 · Lawrence Livermore National Laboratory Livermore, CA 94550

AI Agent Auditing Data Provenance

Ask PDF

Oct 8, 2026

Safe Actions Alone Do Not Ensure Safe Agents: Identifying Unfulfilled Obligations with Guard Models

Guard models are increasingly used to safeguard LLM-based agents, primarily by identifying actions that agents are forbidden to perform. However, identifying forbidden actions alone is insufficient to ensure agent safety. In this paper, we argue that agent safety also depends on identifying required yet unperformed safety-critical actions, which we call obligations. Our preliminary study on a popular benchmark for evaluating safety shows that 56.92% of GLM-5.3 trajectories contain unfulfilled obligations, compared with only 30.00% containing forbidden actions. This finding reveals unfulfilled obligations as a major and previously overlooked source of safety risk. However, to our knowledge, no existing benchmark evaluates whether guard models can identify these obligations. To close this gap, we introduce ObligationBench, the first benchmark for evaluating the capability of obligation identification, comprising 240 expert-validated trajectories covering issue resolution, feature development, and terminal operations. Our evaluation of 14 representative models reveals substantial limitations: the highest recall and exact-match rate are only 48.97% and 10.00%, respectively. To address these limitations, we develop ObligationGuard using 40,000 synthetic training examples. ObligationGuard achieves 57.52% recall and an exact-match rate of 21.67%, surpassing all evaluated models on both metrics. We call on the community to incorporate obligation identification into the design and evaluation of future guard models to improve agent safety.

Youwei Feng, Yitong Zhang, Yuetong Liu +1

Tsinghua University, China · College of AI, Tsinghua University, China

LLM Agent Safety LLM Guardrails AI Agent Safety Benchmarks LLM Agent Evaluation

Ask PDF