🤖 AI

From Goals to Aspects, Revisited: An NFR Pattern Language for Agentic AI Systems

This paper revisits and extends the goals-to-aspects methodology to the agentic AI domain by presenting a pattern language of 12 reusable patterns across four NFR categories, which systematically maps i* goal models to concrete aspect implementations in Rust to modularize crosscutting concerns like security, reliability, observability, and cost management.

Original authors: Yijun Yu

Published 2026-03-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yijun Yu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a fleet of autonomous robot assistants. These aren't just simple chatbots; they are smart agents that can think, make decisions, open files, search the web, and even run commands on your computer.

The problem? When you build these robots, you often forget to build the "safety rails" and "accountability logs" until it's too late. You end up with code where security checks are scattered everywhere, costs are uncontrolled, and if something goes wrong, no one knows why. It's like building a high-speed race car but forgetting to install brakes, a speedometer, or a black box recorder, and then trying to tape them on later.

This paper proposes a better way to build these AI agents. It takes an old idea from 2004 and updates it for the age of AI. Here is the breakdown in simple terms:

1. The Core Problem: The "Spaghetti" of Safety

In traditional software, you build a feature (like "Send an Email") and that's it. But in AI agents, every single action (like "Send an Email") needs to be checked for five different things at once:

Security: Is this user allowed to do this?
Cost: Is this going to cost us too much money?
Reliability: What if the internet is down?
Observability: Did we record what happened?
Safety: Is this action dangerous?

In current AI projects, developers write these checks manually inside every single function. It's like putting a "Stop" sign, a "Speed Limit" sign, and a "Security Camera" sign inside every single room of a house, rather than having a central security system. This leads to messy, "tangled" code that breaks easily.

2. The Solution: The "Ghost Layer" (Aspects)

The authors suggest using a technique called Aspect-Oriented Programming (AOP).

The Analogy: Imagine you are a chef cooking a huge banquet.

The Main Dish (Functional Goal): You are making a steak. This is the core job.
The Crosscutting Concerns (The "Aspects"): You also need to ensure the steak is safe (no salmonella), timed (cooked for exactly 5 minutes), tracked (logged in the kitchen ledger), and cheap (didn't use too much butter).

In the old way, the chef would have to stop cooking the steak to check the thermometer, check the ledger, and check the safety manual every single time they flipped the meat. It's messy and slow.

The New Way (AOP): Imagine a Ghost Layer that wraps around the stove.

The chef just focuses on cooking the steak.
The Ghost Layer automatically checks the temperature, logs the time, and weighs the butter before, during, and after the cooking happens.
If the steak is too big, the Ghost Layer stops the fire. If the timer runs out, it sounds an alarm.

The chef doesn't need to know how the Ghost Layer works; they just know the steak gets cooked safely and efficiently.

3. The New "Rulebook" (The Pattern Language)

The authors created a Pattern Language—a catalog of 12 pre-made "Ghost Layers" specifically for AI agents. Think of it as a toolbox of safety plugins.

They identified 12 specific problems and provided a "plugin" for each:

The "Prompt Guard": A plugin that acts like a bouncer at a club, checking if the user's input is trying to trick the AI (a "prompt injection" attack) before letting it in.
The "Token Budget Manager": A plugin that acts like a wallet. It counts how much "money" (AI tokens) the agent is spending and stops it from going over budget.
The "Action Audit Trail": A plugin that acts like a black box recorder. It writes down exactly why the AI made a decision, so if it messes up, humans can investigate.
The "Tool Scope Sandbox": A plugin that acts like a playpen. It ensures the AI can only touch the specific files or tools it's allowed to, preventing it from accidentally deleting your whole hard drive.

4. The "V-Graph" Map

How do you know which plugins you need? The authors use a map called a V-Graph.

Imagine a map where the top of the "V" is the Goal (e.g., "Call the AI Provider"). The bottom of the "V" is the Task (e.g., "Send the message").

In old software, the task only touched one goal.
In AI, the task touches four or five goals at once (Security, Cost, Reliability, etc.).

The authors use this map to systematically find every place where safety checks are missing or scattered, ensuring nothing is overlooked.

5. The Proof: Testing on "ZeroClaw"

To prove this works, they tested it on a real, open-source AI framework called ZeroClaw (which is huge, with over 129,000 lines of code).

Before: They found that "Rate Limiting" (preventing the AI from talking too fast) was written in three different ways across 29 different files. It was messy and inconsistent.
After: They replaced all that messy code with one single "Ghost Layer" (Aspect).
Result: They cut out nearly 2,000 lines of messy code and replaced it with just a few lines of "plugin" instructions. The system became cleaner, safer, and easier to update.

The Big Takeaway

Building AI agents is hard because they are so complex and interconnected. You can't just "patch" safety in later.

This paper says: Don't build the safety checks into the main code. Instead, build a centralized safety system (the Aspect Layer) that wraps around everything. This makes your AI agents:

Safer (no accidental hacks or deletions).
Cheaper (no runaway costs).
Clearer (you know exactly what they did and why).
Easier to fix (if you need to change the security rule, you change it in one place, and it updates everywhere).

It's the difference from building a house where every brick has a different lock, versus building a house with one master security system that protects the whole structure.

1. Problem Statement

Agentic AI systems (autonomous agents powered by Large Language Models) are rapidly growing but suffer from a high failure rate in reaching production. A primary cause is the inadequate engineering of Non-Functional Requirements (NFRs).

Crosscutting Concerns: Agentic systems exhibit pervasive crosscutting concerns such as security (prompt injection, tool sandboxing), observability (audit trails), cost management (token budgets), and reliability.
Scattering and Tangling: In current implementations, these concerns are implemented in an ad-hoc manner, scattered across multiple modules (e.g., authorization checks in tool handlers, inconsistent logging, duplicated rate limiting). This leads to code tangling, maintenance difficulties, and security vulnerabilities.
Gap in Literature: Traditional Aspect-Oriented Programming (AOP) literature does not address agent-specific concerns like prompt injection defense or token budgeting. Furthermore, the density of crosscutting in agents (where a single task touches multiple NFRs simultaneously) exceeds that of traditional software, requiring a more robust discovery methodology.

2. Methodology: Goals-to-Aspects for Agents

The paper revisits and extends the Goals-to-Aspects methodology (originally proposed at RE 2004) specifically for the agentic AI domain. The process follows a three-phase approach:

Phase 1: Agent Goal Modeling

Framework: Uses the i* (i-star) framework to model the system.
Actors: Defines actors including the Agent User, Agent System, LLM Provider, Tool Provider, and Operator.
Decomposition: Constructs Strategic Rationale (SR) models that decompose functional goals (e.g., "Execute Tool") into tasks and link them to NFR softgoals (e.g., "Security," "Cost Efficiency").
Innovation: Identifies characteristic agent decompositions where a single task (e.g., "Call LLM Provider") contributes to multiple NFRs simultaneously.

Phase 2: V-Graph Analysis for Agents

Concept: Extends the V-graph model. A V-graph consists of a functional goal ( $g_f$ ), an NFR softgoal ( $g_{nf}$ ), and a set of tasks ( $T$ ) that contribute to both.
Crosscutting Density ( $\delta$ ): Introduces a metric for crosscutting density.
- $\delta(t) = 1$ : Single concern (traditional).
- $\delta(t) \ge 2$ : Multi-dimensional crosscutting (agent-specific).
- Example: The task "Call LLM Provider" has $\delta = 4$ , simultaneously impacting Security, Cost, Reliability, and Observability.
Algorithm: The AspectFinder for Agents algorithm enumerates tasks, constructs overlapping V-graphs, groups them by NFR, and validates findings by measuring concern scattering in the source code (counting files/modules containing the concern).

Phase 3: Pattern Instantiation

Output: Converts validated aspect candidates into a Pattern Language.
Structure: Each pattern includes:
1. Problem: The crosscutting concern in the agent context.
2. i* Goal Model: The softgoal decomposition.
3. Solution: Concrete implementation using ASPECT-RS (an AOP framework for Rust).
4. Composition: Rules for stacking aspects (e.g., Authentication $\to$ Scope $\to$ Guard $\to$ Throttle $\to$ Budget $\to$ Protect $\to$ Observe $\to$ Audit).

3. Key Contributions

A. A Pattern Language of 12 Reusable Patterns

The paper presents a catalog of 12 patterns organized into four NFR categories. Four are novel agent-specific patterns:

Tool Scope Sandbox (Security): Enforces filesystem boundaries and command allowlists to prevent unauthorized agent actions.
Prompt Guard (Security): Detects and mitigates prompt injection attacks (OWASP Top 10 #1) before LLM calls.
Token Budget Manager (Cost): Monitors and enforces token limits to prevent runaway costs during reasoning loops.
Action Audit Trail (Observability): Records structured provenance of agent decisions and actions for compliance and debugging.
The remaining eight patterns adapt existing AOP concepts (e.g., Circuit Breaker, Rate Limiter, Structured Logger) to the agent domain.

B. Extended V-Graph Model

The authors extend the V-graph model to handle overlapping V-graphs, capturing the reality that a single agent task often satisfies multiple functional and non-functional goals simultaneously. This allows for the systematic discovery of high-density crosscutting concerns that traditional methods might miss.

C. Empirical Validation via Case Study

The methodology was validated against ZEROCLAW, a large open-source autonomous agent framework (192 files, ~129k LOC).

Scattering Analysis: The study quantified the scattering of 11 crosscutting concerns across 200 files.
- Example: Rate limiting was implemented in 3 different ways across 29 files.
- Example: Path validation had 3 divergent implementations.
Missing NFRs: The analysis revealed that critical concerns like prompt injection defense and structured audit trails were entirely absent from the framework's modular design.
Refactoring Proof-of-Concept: The authors refactored the scattered rate-limiting code (195 lines across 8 functions) into a single aspect with 8 declarative annotations, achieving a 96% reduction in concern-specific code.

4. Results

Quantitative Evidence: The case study confirmed that crosscutting concerns are structurally stable; as the codebase grew by 120% across four versions, the scattering ratios remained constant (e.g., error handling stayed at ~81% of files). This proves that without architectural intervention, crosscutting code grows linearly with the system.
Discovery of Gaps: The V-graph analysis successfully identified not only scattered concerns but also missing NFRs (e.g., token budgeting was present but scattered; prompt injection defense was absent).
Modularity Improvement: Applying the pattern language consolidates duplicated logic into single, reusable aspects, ensuring consistency (e.g., uniform path validation strategies) and traceability from requirements to code.

5. Significance

Bridging RE and Implementation: The paper provides a principled, end-to-end approach linking early-phase requirements engineering (i* models) to concrete software implementation (Rust AOP), solving the "gap" between what is needed and how it is built.
Essential for Agentic AI: It argues that due to the high density of crosscutting concerns in agents (security, cost, safety, reliability all intersecting at the same join points), aspect-oriented modularization is not just beneficial but essential for building reliable, production-ready agentic systems.
Regulatory Compliance: The patterns (specifically Audit Trail and Tool Sandbox) provide concrete mechanisms to meet emerging AI governance regulations (e.g., EU AI Act, NIST AI RMF) by ensuring accountability and containment.
Sustainability: By introducing token budget management, the approach directly addresses the computational sustainability and cost control of LLM-based agents.

In summary, this paper demonstrates that the "Goals-to-Aspects" methodology, when extended with multi-dimensional V-graph analysis and a specific pattern language, offers a robust solution to the architectural challenges of modern Agentic AI systems.