🤖 AI

One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

This paper formalizes the challenges of remediation-induced control coupling in multi-gate Agentic AI systems, proposing a "remediate-and-regate" protocol to restore soundness while demonstrating that remediation order is semantically critical and that current mitigations cannot fully eliminate state-level poisoning risks.

Original authors: Gaston Besanson

Published 2026-08-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Gaston Besanson

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the emerging world of artificial intelligence, autonomous agents are being tasked with making decisions that have real-world consequences, from ordering supplies to managing energy grids. These agents do not operate in a vacuum; they must navigate a complex landscape of rules. Before an agent acts, it must pass through a series of digital checkpoints, or "gates," that ask three fundamental questions: Is the agent allowed to do this? Can the organization afford it? And is the evidence supporting the decision valid? For years, researchers have treated these questions as separate hurdles, checking each one independently before giving the green light. However, as these systems grow more sophisticated, a critical flaw has emerged: the act of fixing a problem in one area can inadvertently break the rules in another. If an agent changes its plan to stay within budget, that new plan might suddenly violate a permission rule it previously passed. The core challenge is no longer just about having multiple gates, but about understanding how the gates interact when one of them changes the very thing the others are measuring.

This paper tackles that specific, tangled problem by studying what happens when an AI agent's decision is altered by one control system and then re-evaluated by another. The researchers built a working demonstration using three distinct engines that handle permissions, financial budgets, and evidence validity. They discovered that if you simply run these checks once, in parallel, on the original plan, the system can be dangerously wrong. An agent might be approved for an action based on a corrupted piece of data, only to have that data corrected by a second gate. By the time the action is executed, the original approval is no longer valid because the underlying numbers have changed. The study proves that a single pass of checks is insufficient and can lead to actions that violate safety rules or exceed budgets, even though the system thought it was being careful.

To solve this, the author developed a "fix-and-recheck" protocol. Instead of just saying "yes" or "no" once, the system allows a gate to correct a flaw—such as swapping a bad data point for a verified one or reducing an order size to fit a budget—and then forces every single gate to re-evaluate the new, corrected plan. This ensures that the final decision is based on the actual action that will be performed, not the flawed version that was proposed. The researchers tested this method across thirty different simulated scenarios and found it to be sound, meaning that every action that was executed passed all the rules at the moment of execution. They also showed that this approach does not create false safety; if a specific type of error is not covered by any of the individual gates, the combined system will not magically detect it. It remains honest about what it can and cannot see.

A surprising and significant finding emerged when the researchers introduced a second type of correction. In their system, one gate could fix data errors, while another could scale down an order to save money. They tested whether the order in which these fixes were applied mattered. The answer was a definitive yes. Applying the data fix first and then the budget fix produced a different result than doing them in reverse. This means that the sequence of operations is not just a technical detail of how the software is written; it is a fundamental part of the governance policy itself. If the order is wrong, the system could silently approve an action that is actually over budget or unauthorized. The researchers used a rigorous computer checker to find dozens of specific examples where the order changed the outcome, proving that these systems cannot be left to run in any random sequence.

The study also uncovered a subtle risk regarding how the system remembers past decisions. When a corrected piece of evidence is accepted and stored for future use, it enters a trusted buffer. The researchers demonstrated that if a flawed piece of data slips through the initial checks and gets stored, it can poison future decisions. The system might trust this corrupted data later because it came from its own "trusted" memory. To address this, they tested two mitigation strategies: a "quarantine" period where new data must be consistent over several checks before being trusted, and a method of averaging multiple data points. In their simulations, these strategies significantly reduced the number of poisoned decisions, though they did not eliminate the risk entirely, particularly in scenarios with very few data points.

Ultimately, this work provides a clear blueprint for how to safely compose multiple AI governance controls. It moves beyond the idea of simply stacking rules on top of each other and instead establishes a dynamic process where corrections trigger re-evaluations. The researchers are careful to note that their findings are based on a specific, controlled demonstration and do not claim to solve every possible problem in AI governance. They do not assert that their system is perfect for all real-world deployments, nor do they claim to have solved the problem of infinite loops or complex, multi-agent interactions. However, for the specific setting they studied, they have proven that a single pass of checks is unsafe, that the order of fixes matters, and that a disciplined process of re-checking after every change is the only way to ensure that an agent's final action is truly compliant with all its governing rules.

Technical Summary: One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

1. Problem Statement

Agentic AI systems often require multiple pre-action controls (gates) to govern consequential actions simultaneously. These controls typically address distinct concerns: authority (permissions/obligations), resources (cost/carbon budgets), and evidence (data validity/metadata). While prior work has established individual gates (SARC, Green SARC, SARC-DQ) and studied the composition of enforcement monitors, a critical gap remains when these controls are heterogeneous and stateful.

The core problem addressed is remediation-induced control coupling. In many systems, a control does not merely block an action; it remediates it (e.g., substituting a corrupted data value or scaling down a resource request). When Control A remediates an action, it alters the action's context, evidence, or derived values (such as order value or predicted spend). If Control B evaluated the original action before Control A's remediation, Control B's judgment may become invalid.

This creates three specific challenges:

Invalidation: A single-pass evaluation (parallel or serial without re-evaluation) can lead to unsound execution where the final action violates a gate that was satisfied by the pre-remediation state.
Non-Commutativity: When multiple remediation operators exist (e.g., evidence substitution and resource downscaling), their order of application can change the final outcome. The order is not an implementation detail but a semantic property of the governance policy.
State Contamination: Admitting a record into a persistent governance buffer (e.g., for future substitution) based on current admissibility can propagate "uncovered defects" (flaws the current gate predicates do not detect) into future trusted state, compromising future decisions.

2. Methodology and Formalism

The paper formalizes these issues using a deterministic model where an action $a$ in context $c(a)$ is evaluated by a set of gates $G_i$ . Each gate maps inputs to a response in a lattice $R = \{admit, substitute, degrade, escalate, block\}$ .

Key Definitions

Remediation-Induced Control Coupling: Two controls $G_i$ and $G_j$ are coupled if a remediation operator $\rho_i$ applied by $G_i$ changes the input consumed by $G_j$ , such that $G_j(a) \neq G_j(\rho_i(a))$ .
Per-Action Soundness: A system is sound if the executed action $a_{exec}$ satisfies every gate at the moment of execution, given the state in force.
Non-Compensatory Join: The paper distinguishes between constraint satisfaction (where any veto blocks execution) and compensatory aggregation (where high scores in one area offset low scores in another). It proves that for hard governance requirements, additive weighted aggregation can fail to preserve veto rights unless specific threshold conditions are met.

The Remediate-and-Regate Protocol

To address single-pass unsoundness, the paper proposes a Remediate-and-Regate (RTR) protocol:

Phase I: Evaluate the evidence gate. If substitution occurs, form a remediated action $a' = \rho_{sub}(a)$ and recompute the context $c(a')$ . If a resource gate is present, it may further apply a downroute operator $\rho_{route}$ to $a'$ , recomputing context again.
Phase II: Re-evaluate all gates (including the evidence gate) on the final remediated action $a_{exec}$ and the updated context.
Join: Compute the composed verdict using a non-compensatory join (e.g., deny-overrides or min logic) on the Phase II responses.

The paper proves that under assumptions of determinism, bounded remediation (one-shot), and idempotence (substitution does not trigger further substitution), this protocol guarantees per-action soundness.

Handling Non-Commutativity

The paper demonstrates that the two specific remediation operators implemented in the artifact— $\rho_{sub}$ (evidence substitution) and $\rho_{route}$ (resource downscaling)—do not commute.

$\rho_{route}(\rho_{sub}(a)) \neq \rho_{sub}(\rho_{route}(a))$ in general for these operators.
A finite-model checker found concrete counterexamples where the order of operations changes whether an action is admitted or blocked.
Conclusion: Remediation order must be explicitly specified as part of the governance policy (e.g., "Evidence Gate first, then Resource Gate") rather than left to implementation. The paper notes this is a property of these specific operators and does not claim a general solution for arbitrary rewrite systems.

State Contamination and Mitigation

The paper identifies a vulnerability where "uncovered defects" (data flaws the gate predicates cannot detect) are admitted into a governed buffer and subsequently used to remediate future actions.

Mechanism: An admitted but defective value enters the buffer $\to$ Future actions substitute this defective value $\to$ The defect propagates.
Mitigations: Two strategies are demonstrated:
1. Quarantine Window: A write is only trusted after $N$ consecutive consistent admits.
2. Rolling Median-of-3: Using the median of recent values to filter outliers.
  Note: These reduce exposure but do not eliminate the fundamental vulnerability of stateful remediation with incomplete coverage.

3. Key Contributions

Formalization of Remediation-Induced Coupling: The paper defines the conditions under which one control's remediation invalidates another's judgment, moving beyond simple monitor composition to the invalidation of semantic objects.
Soundness of Remediate-and-Regate: It establishes a protocol that restores soundness in a bounded, idempotent setting by ensuring every gate re-evaluates the final action.
Non-Commutativity of Specific Remediation Operators: It demonstrates that the two concrete remediation operators implemented in the artifact (evidence substitution and resource downscaling) do not commute, making the order of operations a semantic requirement for these specific controls. This is verified via a finite-model checker finding 86/243 grid points (and 150/200 off-grid points) where order changes the outcome. The paper explicitly does not claim this non-commutativity holds for arbitrary remediation operators.
Governance State Contamination: It demonstrates that admitting records into persistent state without full coverage can poison future remediation, and shows that mitigation strategies (quarantine, median filtering) reduce but do not eliminate this risk.
Linear Aggregation vs. Veto Semantics: It provides an exact condition (Lemma) for when a weighted-sum aggregator preserves veto rights: a vetoed profile is admitted if and only if the threshold $\tau$ does not exceed the aggregator's largest "leave-one-out" weight sum. This clarifies that additive scoring is not a substitute for conjunctive feasibility semantics in hard governance.
Unified Evidence Set: A mechanism for preserving full lineage across gates, recording pre- and post-remediation evidence IDs and the specific buffer writes used, ensuring identity commitment without claiming byte reconstruction.

4. Empirical Results

The paper validates these mechanisms using a deterministic artifact (suite-demo) composed of three unmodified Apache 2.0 engines (SARC, Green SARC, SARC-DQ) over 30 pre-registered seeds and two workflows (Daily and Weekly).

Soundness (CH1): Under the Remediate-and-Regate protocol, zero executed actions violated any gate at execution time across all 30 seeds.
Single-Pass Unsoundness (CH2): In the constructed scenario (S4), single-pass evaluation diverged from the sound protocol in 207.5 decisions (mean) per 30 seeds, often admitting actions that violated gates post-remediation.
Non-Commutativity (CH7): A model checker confirmed that the two specific remediation operators do not commute, validating the need for fixed ordering for these operators.
Coverage Honesty (CH4): The composed system detected exactly the union of the member gates' covered classes; no new detection coverage was "manufactured" by composition.
Buffer Contamination (CH6): In the "Daily" workflow (W1), the plain buffer produced an average of 14.70 poisoned substitutions. Both quarantine and median-of-3 mitigations strictly reduced this count. In the "Weekly" workflow (W2), the baseline poisoning rate was lower (1.83), and while mitigations reduced the count, the small sample size sometimes resulted in zero baseline events, making strict per-seed reduction impossible to satisfy statistically in all cases.
Compensation Safety (CH5): Empirical and exhaustive grid checks confirmed that additive weighted aggregation can admit vetoed actions (e.g., blocking a specific defect) if the threshold is not carefully calibrated, whereas min-join semantics strictly preserve veto.

5. Significance and Claims

The paper's significance lies in establishing bounded compositional semantics for stateful pre-action controls in Agentic AI. It argues that:

Remediation changes semantics: Once a control is permitted to transform an action, prior judgments become contingent on the version of the object evaluated. Correct governance requires explicit semantics for invalidating and recomputing dependent judgments.
Order matters: When multiple remediation operators exist, their ordering is part of the governance policy, not an implementation detail.
State requires trust policies: Admission into persistent governance state is distinct from future trust; admitted-but-uncovered defects can contaminate future remediation.

Scope and Limitations:
The paper explicitly limits its claims:

It is a mechanism demonstration, not a production-prevalence study.
It establishes soundness for the current one-shot, idempotent setting. It does not claim to solve general convergence, termination, or confluence for arbitrary non-idempotent remediators or cyclic dependencies.
It does not claim that weighted aggregation is inherently unsafe, but rather that it is unsuitable for implementing hard veto semantics without specific threshold constraints.
The mitigation of buffer contamination reduces exposure but does not eliminate the vulnerability of stateful remediation with incomplete coverage.
The demonstration of non-commutativity applies specifically to the two implemented operators (evidence substitution and resource downroute) and does not generalize to arbitrary remediation operators without re-deriving the checker.

The work provides a rigorous foundation for composing heterogeneous, stateful controls in AI agents, highlighting the necessity of re-evaluation, explicit ordering, and careful distinction between admission and trust.