Runtime Enforcement for AI Agents

Follow this topic Ask about this topic

Runtime enforcement governs what AI agents may do while they are running, especially when tool calls can change files, access data, spend money, or control devices. Common approaches intercept actions at a trusted boundary and apply permissions, policies, behavioral contracts, or formal checks; other systems track action history and provenance, require human approval, or verify effects before committing them. These controls are studied in settings such as coding and web agents, financial workflows, scientific tools, and robotics, with benchmarks measuring both blocked attacks and preserved task success. A central challenge is balancing safety with useful autonomy: policies must account for context and changing state, while evidence for guarantees often remains limited to specific environments and assumptions.

Latest papers

279 papers81 papers in the last four weeks, up 8% on the four weeks before. 0.5% of all new papers.

Intent Drift at SME Scale: Deployment Practice, Not Model Capability, Determines Agentic Compliance
Sep 5, 2026Ilia VoroshilovAI Agent Governance AI Regulatory Compliance
The Hong Kong University of Science and Technology Hong Kong SAR
Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound
Sep 5, 2026Genliang Zhu, Chu WangRuntime Enforcement for AI Agents Access Control
Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada +3
Replay-Gated Neural Execution: Decoupling Persistent Behavioral Specifications from Neural Realizations in Frozen Language Models
Sep 5, 2026Xianliang Zeng, Zhanzhan ZhaoRuntime Enforcement for AI Agents Neural Network Verification
The Chinese University of Hong Kong, Shenzhen Shenzhen, China
From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents
Sep 5, 2026Yu Zheng, Qizhi ZhangLLM Agent Security Tool Access Control for LLM Agents
University of California, Berkeley · Independent Researcher
FinalityBench: An Effect-Level Benchmark for Agent Decisions Under Delayed and Conflicting Financial Finality
Sep 4, 2026Abhishek SharmaAI Agent Benchmarks Runtime Enforcement for AI Agents
SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agents
Sep 4, 2026Chenyu Zhou, Qiliang Jiang, Shuning Wu +1Constrained RL Runtime Enforcement for AI Agents
School of Engineering, Institute of Science Tokyo, Japan · College of Control Science and Engineering, Zhejiang University, China · Department of Electrical and Computer Engineering, National University of Singapore, Singapore
Fresh Memory, Stale Plans: Derivation Currency for Distributed LLM-Agent Memory
Sep 3, 2026Evan Chen, Shiqiang Wang, Christopher G. BrintonData Provenance Runtime Enforcement for AI Agents
Purdue University · University of Exeter
MasterControl Seventeen Every Time
Sep 2, 2026MasterControl AI LabEnterprise Analytics LLM Agent Evaluation
MasterControl AI Lab
Where Reliability Lives: Experimental Localisation of Behavioural Properties in an Agent System
Sep 2, 2026Timothy Marsden, Matthew Collecutt, James MarsdenAI Agent Reliability Agent-Based Modeling
Taniwha AI
Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents
Sep 1, 2026Xiaofang Yang, Ziqi Miao, Chen Qian +3AI Agent Security AI Agent Security Benchmarks
Shanghai Artificial Intelligence Laboratory · Fudan University · Renmin University of China +1
REVISE: Validity-Guided Recovery for Online Revisions in Agent Workflows
Sep 1, 2026Ruoling Qi, Xuaner Wu, Penghang Liu +2Agentic Workflows LLM Agent Workflow Optimization
Institute of Artificial Intelligence, China Telecom (TeleAI) · 2Shanghai Jiao Tong University
The Irreversibility Budget: Fleet-Level Risk Accounting and Admission Control for Agent Operating Systems
Aug 31, 2026Bardia Mohammadi, Laurent BindschaedlerAI Risk Management Runtime Enforcement for AI Agents
Max Planck Institute for Software Systems Saarbrücken, Germany
VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows
Aug 30, 2026Lifei Liu, Haoran Yu, Xiaochong JiangRuntime Enforcement for AI Agents Access Control
Independent Researcher
Graph, Loop, and Harness Engineering for Zero-Trust Agentic Data Engineering and Analytical Processing
Aug 30, 2026Sagar Srinivas Sakhinana, Venkataramana RunkanaAgentic Workflows Runtime Enforcement for AI Agents
Tata Research Development and Design Centre
Towards Agentic Cloud Engineering: Graph and Loop Engineering with a Zero-Trust Agent Harness
Aug 30, 2026Sagar Srinivas Sakhinana, Venkataramana RunkanaAgentic Workflows LLM Agent Harnesses
Tata Research Development and Design Centre
Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOps
Aug 30, 2026Sagar Srinivas Sakhinana, Venkataramana RunkanaMLOps Software Engineering Agents
Tata Research Development and Design Centre
AgentKernel: The Trust-Native Agentic Operating System
Aug 29, 2026Zhenhua Zou, Sheng Guo, Qiuyang Zhan +3AI Agent Security Runtime Enforcement for AI Agents
DeepKernel Lab
If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary
Aug 27, 2026Marc Millstone, Tyler Akidau, Johannes Brüderl +1Runtime Enforcement for AI Agents Tool Access Control for LLM Agents
Redpanda Data
Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
Aug 27, 2026Yisen XiLLM Agent Security Runtime Enforcement for AI Agents
Independent Researcher, Beijing, China.
When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents
Aug 27, 2026Xiaokun Guo, Zhen Xu, Dongdong Huo +5Runtime Enforcement for AI Agents Tool Access Control for LLM Agents
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences
A Contract-Centered Architecture for Scalable and Manageable Agentic Runtimes
Aug 27, 2026Yaxiao Liu, Pengbo Liu, Yiwen Liu +3Runtime Enforcement for AI Agents AI Agent Governance
PwC China AI Center
Five Primitives for Governing Autonomous AI Agents at Runtime
Aug 27, 2026Jiten Oswal, John CadedduAI Agent Governance Runtime Enforcement for AI Agents
Aurite AI
Agent Mesh: Reliability Primitives for Non-Idempotent Agent Delegation - Identity Adequacy and Evidence Adequacy
Aug 26, 2026Mazhar Shaikh, Anurag Rajkumar Bombarde, Harshal PathakAgent Reliability Agent Failure Analysis
Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical World
Aug 25, 2026Zhonghao Zhan, Hamed HaddadiRuntime Enforcement for AI Agents Tool Access Control for LLM Agents
Imperial College London London, UK
Safe Skill Retirement for Physical Agents
Aug 25, 2026Zhonghao Zhan, Xiao Ma, Hamed HaddadiLLM Agent Safety Agent Skill Security Auditing
Imperial College London · Independent Researcher
Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races
Aug 25, 2026Zihao Zheng, Jiayu Long, Baichuan Li +1Runtime Enforcement for AI Agents LLM Agent Safety
Washington University in St. Louis, St. Louis, Missouri, USA · Southern Methodist University, Dallas, Texas, USA
Physical Agentic AI: An Architecture for Orchestrating a Robot Crew with LLMs
Aug 23, 2026Xinyuan Liu, Eren Sadikoglu, Riana Chatterjee +1Agentic AI for Robotics LLM Agent Orchestration
School of Computing and Augmented Intelligence, Arizona State University, AZ, USA
When May an Agent Stop? Evidence-Carrying Termination for Tool-Using LLMs
Aug 22, 2026Jason LiuLLM Agent Verification Tool-Using Agents
University of California San Diego
Rebuild Dossier: Mechanically-Enforced Specs for Agentic App Rebuilds, and What Model-Tier Failures Reveal
Aug 22, 2026Parker FawcettAgentic Code Generation LLM Agent Reliability
Independent Researcher
AID-Guard: Stateful Authorization for Delegated Agent Effects
Aug 21, 2026Yingzhe Tong, Leyu Dai, Songhui GuoAI Agent Security Tool-Use Authorization
Information Engineering University

Sep 5, 2026J/K move · Enter open · S save

Intent Drift at SME Scale: Deployment Practice, Not Model Capability, Determines Agentic Compliance

Ilia Voroshilov

The Hong Kong University of Science and Technology Hong Kong SAR

AI Agent Governance AI Regulatory Compliance Runtime Enforcement for AI Agents Tool Access Control for LLM Agents

Open paper AskPDF arXiv

We introduce Chain of Intent, a governance framework for agentic AI at small regulated firms, and validate it against a failure it was built to address. Existing agentic governance research assumes enterprise infrastructure that small firms do not have. In a simulated Hong Kong asset manager with 415 synthetic contact records, an agent performing a routine client-communications task was subjected to ordinary managerial pressure to increase its reach. With its authorised constraints written into its configuration, the agent held: it identified every ambiguity in the firm's records, cited privacy legislation it had never been shown, and refused six successive requests, breaching in two of fifteen runs. With the same task, data, pressure and model, but its purpose left unstated as resource-constrained firms routinely leave it, it breached in thirteen of fifteen runs, contacting up to 220 individuals of whom 94 per cent had no demonstrable marketing consent - conduct carrying a maximum of three years' imprisonment under Hong Kong law. Chain of Intent applies four controls requiring no security engineering: a machine-readable purpose, constrained tool access, a scope ledger, and a pre-action check. It eliminated unlawful contact in every run while preserving task completion, and ablation shows each control independently sufficient by a different mechanism. We further show that drift must be measured at two stages - agents widened their candidate sets in every pressured run while acting on them in roughly one in seven - and that governance applied at the point of intent costs roughly half as much as governance applied at the point of action.