Runtime Enforcement for AI Agents

Follow this topic Ask about this topic

Runtime enforcement governs what AI agents may do while they are running, especially when tool calls can change files, access data, spend money, or control devices. Common approaches intercept actions at a trusted boundary and apply permissions, policies, behavioral contracts, or formal checks; other systems track action history and provenance, require human approval, or verify effects before committing them. These controls are studied in settings such as coding and web agents, financial workflows, scientific tools, and robotics, with benchmarks measuring both blocked attacks and preserved task success. A central challenge is balancing safety with useful autonomy: policies must account for context and changing state, while evidence for guarantees often remains limited to specific environments and assumptions.

Latest papers

279 papers81 papers in the last four weeks, up 8% on the four weeks before. 0.5% of all new papers.

Goal-Autopilot: A Verifiable Anti-Fabrication Firewall for Unattended Long-Horizon Agents
Jun 10, 2026Youwang DengLLM Agent Reliability LLM Hallucination Mitigation
EpistemicaLab — Independent Research
Harness Engineering for Physical AI: Robot Middleware Is the Harness Layer
Jun 8, 2026Sanghoon Lee, Jiyeong Chae, Kyung-Joon ParkRobotic Control Robotics
Daegu Gyeongbuk Institute of Science and Technology (DGIST) · Daegu, Republic of Korea
AgentTrust: A Self-Improving Trust Layer for AI-Agent Actions
Jun 7, 2026Chenglin YangAI Agent Reliability LLM-as-a-Judge
Independent Researcher
The Saturation Trap and the Subjectivity of Intervention Timing: Why Affect-Based Triggers and LLM Judges Fail to Time Interventions on Autonomous Agents
Jun 2, 2026Manvendra ModgilLLM-as-a-Judge Human-in-the-Loop Evaluation
Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools
Jun 1, 2026Bardia Mohammadi, Lars Klein, Akhil Arora +1Data Leakage LLM Agent Security
Max Planck Institute for Software Systems · EPFL · Aarhus University
The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Plane
May 27, 2026Tyler Akidau, Tyler Rockwood, Johannes Brüderl +1AI Agent Security AI Agent Safety
Redpanda · USA / Germany
FinHarness: An Inline Lifecycle Safety Harness for Finance LLM Agents
May 26, 2026Haoxuan Jia, Yang Liu, Bin Chong +10AI Agent Reliability LLM Guardrails
Nanyang Technological University · Tsinghua University · Peking University +8
Insuring Every Action: An Authority Frontier Framework for Runtime Actuarial Control of Autonomous AI Agents
May 25, 2026Hao-Hsuan ChenAI Risk Management AI Agent Evaluation
Department of Risk Management and Insurance National Chengchi University
Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment
May 18, 2026S. Bensalem, Y. Dong, M. Franzle +6AI Agent Reliability LLM Guardrails
1CSX-AI, France · University of Liverpool, UK · 3Carl von Ossietzky Universität Oldenburg, Germany +2
Ethical Hyper-Velocity (EHV): A Hardware-Rooted Zero-Trust Runtime Enforcement Architecture for Agentic AI Systems
May 18, 2026Riddhi Mohan SharmaAI Agent Safety Runtime Enforcement for AI Agents
IAM Architect & Non-Human Identity Governance Enterprise Identity, M&A Integration, Regulated Environments
AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use
May 6, 2026Chenglin YangAI Agent Security AI Agent Security Benchmarks
Independent Researcher
Proof of Execution: Runtime Verification for Governed AI Agent Actions
Apr 26, 2026James Rhodes, George KangAI Agent Security Formal Verification
AlphaBitCore, Inc.
From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers
Apr 20, 2026Xiangyu Wen, Yuang Zhao, Xiaoyu Xu +9AI Agent Security AI Agent Safety
CUHK · Hong Kong SAR, China · Shanghai Jiao Tong University +6
Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives
Apr 18, 2026Daeyeon SonMCP Security AI Agent Security
Independent Researcher · Republic of Korea
Parallax: Why AI Agents That Think Must Never Act
Apr 14, 2026Joel FokouAI Agent Security Runtime Enforcement for AI Agents
Independent Researcher
Policy-Invisible Violations in LLM-Based Agents
Apr 14, 2026Jie Wu, Ming GongLLM Agent Safety Runtime Enforcement for AI Agents
Atlassian
ProbeLogits: Kernel-Level LLM Inference Primitives for AI-Native Operating Systems
Apr 13, 2026Daeyeon SonAI Safety LLM Guardrails
Independent Researcher Republic of Korea
Beyond Static Sandboxing: Learned Capability Governance for Autonomous AI Agents
Apr 12, 2026Bronislav Sidik, Lior RokachAI Agent Governance Tool Access Control for LLM Agents
Institute for Applied AI Research Faculty of Computer and Information Science Ben-Gurion University of the Negev, Beer Sheva, Israel
ClawVM: Harness-Managed Virtual Memory for Stateful Tool-Using LLM Agents
Apr 11, 2026Mofasshara Rafique, Laurent BindschaedlerLLM Context Management Agent Memory Management
Independent Researcher Switzerland · Max Planck Institute for Software Systems Saarbrücken, Saarland, Germany
Rebooting Microreboot: Architectural Support for Safe, Parallel Recovery in Microservice Systems
Apr 11, 2026Laurent BindschaedlerMicroservice Architecture Runtime Enforcement for AI Agents
Max Planck Institute for Software Systems (MPI-SWS), Saarbrücken, Germany
Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with a Proof-of-Concept Evaluation on Embodied Agents
Apr 9, 2026Xue Qin, Simin Luan, John See +3AI Agent Governance Runtime Enforcement for AI Agents
School of Software, Harbin Institute of Technology, Harbin, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China · School of Mathematical and Computer Sciences, Heriot-Watt University, Malaysia Campus, Putrajaya, Malaysia +2
Harnessing Embodied Agents: Runtime Governance for Policy-Constrained Execution
Apr 9, 2026Xue Qin, Simin Luan, John See +3Runtime Enforcement for AI Agents AI Agent Governance
School of Software, Harbin Institute of Technology, Harbin, China. · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China. · School of Mathematical and Computer Sciences, Heriot-Watt University, Malaysia Campus, Putrajaya, Malaysia. +2
AITH: A Post-Quantum Continuous Delegation Protocol for Human-AI Trust Establishment
Apr 9, 2026Zhaoliang ChenAI Agent Security Cybersecurity
Faculty of Business Administration, University of Macau, Macao SAR, China
OpenKedge: Governing Agentic Mutation with Execution-Bound Safety and Evidence Chains
Apr 7, 2026Jun He, Deying YuAI Agent Governance Runtime Enforcement for AI Agents
ClawLess: A Security Model of AI Agents
Apr 7, 2026Hongyi Lu, Nian Liu, Shuai Wang +1AI Agent Security Runtime Enforcement for AI Agents
Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, China · Department of Computer Science and Engineering, Southern University of Science and Technology · Department of Computer Science and Engineering, Hong Kong University of Science and Technology +3
From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI
Apr 6, 2026Christopher KochAI Agent Governance Runtime Enforcement for AI Agents
Independent Researcher
Governance-Aware Agent Telemetry for Closed-Loop Enforcement in Multi-Agent AI Systems
Apr 6, 2026Anshul Pathak, Nishant JainAI Agent Governance Runtime Enforcement for AI Agents
Nidus: Externalized Reasoning for AI-Assisted Engineering
Apr 6, 2026Danil GorinevskiAI Agent Governance Runtime Enforcement for AI Agents
cybiont GmbH, Schübelbach, Switzerland · cybiont GmbH, Kantonsstrasse 17, 8862 Schübelbach, Switzerland
Governance-Constrained Agentic AI: Blockchain-Enforced Human Oversight for Safety-Critical Wildfire Monitoring
Apr 5, 2026Ali Akarma, Toqeer Ali Syed, Salman Jan +2Human Oversight of AI AI Agent Governance
AI Center, Faculty of Computer and Information Systems, Islamic University of Madinah, Madinah 42351, Saudi Arabia · Faculty of Computer Studies, Arab Open University-Bahrain, Manama 32038, Bahrain · Department of Computer Science, The Islamia University of Bahawalpur, Bahawalpur 63100, Pakistan +1
Your Agent Has a Genome: Sequence-Level Behavioral Analysis and Runtime Governance of LLM-Powered Autonomous Agents
Apr 5, 2026Sidi DengAI Agent Governance Runtime Enforcement for AI Agents
Independent Researcher

Jun 10, 2026J/K move · Enter open · S save

Goal-Autopilot: A Verifiable Anti-Fabrication Firewall for Unattended Long-Horizon Agents

Youwang Deng

EpistemicaLab — Independent Research

LLM Agent Reliability LLM Hallucination Mitigation Long-Horizon Agent Evaluation LLM Agent Verification Runtime Enforcement for AI Agents Long-Horizon LLM Agents+2

Open paper AskPDF arXiv

Long-horizon LLM agents are not trusted to run unattended: with no human watching, they confidently report success they never verified. We treat honesty -- bounding what an agent may claim at termination -- as a first-class metric for unattended autonomy, distinct from capability. We present Autopilot, an execution model that makes silent fabricated success structurally impossible rather than merely rarer. Autopilot externalizes all working state into a durable, gated finite-state machine that a scheduler advances one stateless tick at a time; a hard floor forbids any terminal "done" claim whose falsifiable gate did not actually execute and pass. We prove a No-False-Success theorem -- under gate soundness, floor enforcement, and plan coverage, termination implies the goal holds -- whose only trust points are empirically measurable, and show the worst case degrades to an honest stall, never a fabricated success. Because each tick rehydrates only the state machine, per-step context cost is constant in the horizon. Across a 3,150-cell paired corpus (70 tasks

\times

3 systems

\times

3 models

\times

5 seeds, including 50 SWE-bench Lite tasks across 11 OSS repos), Autopilot fabricates on 0.95% of cells [95% CI 0.38--1.62] while Reflexion and StateFlow baselines fabricate on 8.10% [6.48--9.81] and 25.05% [22.48--27.62] respectively. The headline contrast lives in the hard regime: on SWE-bench Lite, the firewall reduces fabrication from 33.7% (StateFlow) to 0.67%, a paired difference of

-33.07

pp [95% CI

-36.53, -29.73

]. The mechanism is the gate, not the model: all ten Autopilot fabrications come from the strongest model, while two weaker mid-tier models never fabricate across 700 paired cells. The firewall trades coverage for honesty by design -- an honest stall is recoverable; a confident wrong output shipped downstream is not.