CoChat
Sign Up
PreprintCited by 1Access Control and TrustNetwork Security and Intrusion DetectionDistributed systems and fault tolerance

Agent Control Protocol: Admission Control for Agent Actions

Open access
Fernandez, Marcelo·2026·arXiv
DOI 10.48550/arxiv.2603.18829arXiv 2603.18829

Preprint — published as 10.5281/zenodo.19672575

Open this paper in CoChat — free account

Abstract

Autonomous agents can produce harmful behavioral patterns from individually valid requests -- a threat class per-request policy evaluation cannot address, because stateless engines evaluate each request in isolation. We present ACP, a temporal admission control protocol enforcing behavioral properties over execution traces via static risk scoring combined with stateful signals (anomaly accumulation, cooldown) through a LedgerQuerier abstraction. ACP blocks execution based on deterministic, history-aware risk scoring -- not anomaly detection. Under a 500-request workload where every request is individually valid (RS=35), a stateless engine approves all 500; ACP limits autonomous execution to 2 out of 500 (0.4%), escalating after 3 actions and denying after 11. We identify a state-mixing vulnerability in ACP-RISK-2.0 (cross-context false denials) and introduce ACP-RISK-3.0, scoping anomaly signals to PatternKey(agentID, capability, resource). Decision evaluation: 739-832 ns (p50); throughput 1,720,000 req/s. Safety and liveness model-checked via TLA+ (11 invariants + 4 temporal properties, 0 violations) across 4,294,930,695 distinct states. We formalize deviation collapse -- enforcement active but never exercised due to upstream constraints -- and introduce Boundary Activation Rate (BAR) as its detection mechanism. An adversary suppressing BAR to 0.00 is detected via DeltaBAR before collapse (BAR_C=1.00). N coordinated agents accumulate risk independently; coordination window CW_appr=2N with zero deviation: activity scales linearly, preventing superlinear amplification. ACP is Paper 1 of a 6-paper Agent Governance Series: P0 -- atomic decision boundaries; P2 -- behavioral drift detection (IML); P3/4 -- governance structure, fair allocation, and irreducibility; P5 -- runtime execution validity (RAM, arXiv:2604.22898); P6 -- operationalization of RAM.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2603.18829

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Hook systems allow operators to attach arbitrary logic to specific lifecycle events in the agent loop.

    “Hook systems generalize this pattern by allowing operators to attach arbitrary logic-shell scripts, validation checks, notification dispatches-to specific lifecycle events in the agent loop, such as tool invocation, file write, or subagent spawn [Lazaros et al., 2026, Fernandez, 2026].”

    From Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering (2026) · cites this paper as Fernandez, 2026

    Section 4.5 (p. 23) describes an ACP guard that intercepts tool calls before execution, but it does not describe hook systems that let operators attach arbitrary logic to lifecycle events. Searches for hooks, shell scripts, file writes, and subagent spawning found no passage addressing that claim. (LLM, conf=0.72)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Still being checked.

Research works printed but not linked: 26

  1. [1][1] Bowen Alpern and Fred B. Schneider. Defining liveness. Information Processing Letters , 21(4):181-185, 1985. -
  2. [5][5] Christel Baier and Joost-Pieter Katoen. Principles of Model Checking . MIT Press, 2008. -
  3. [6][6] Arnar Birgisson, Joe Gibbs Politz, Úlfar Erlingsson, Ankur Taly, Michael Vrable, and Mark Lentczner. Macaroons: Cookies with contextual caveats for decentralized authorization in the cloud. In Proceedings of the Network and Distributed System Security Symposium (NDSS) . Internet Society, 2014. -
  4. [8][8] Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramer. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems (NeurIPS) , 2024. -
  5. [10][10] Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. AI agents under threat: A survey of key security challenges and future pathways. ACM Computing Surveys , 57(7), 2025. -
  6. [11][11] Yliès Falcone, Jean-Claude Fernandez, and Laurent Mounier. What can you verify and enforce at runtime? International Journal on Software Tools for Technology Transfer , 14(3):349-382, 2012. Systematic framework for runtime enforcement monitors. Distinguishes enforceable properties (safety, co-safety, guarantee, persistence) and characterizes the enforcement mechanisms required for each class. -
  7. [14][14] Marcelo Fernandez. Atomic decision boundaries: A structural requirement for guaranteeing execution-time admissibility in autonomous systems. https://doi.org/10.5281/zenodo. 19670649 , 2026. Zenodo. DOI: 10.5281/zenodo.19670649. arXiv:2604.17511. - · DOI
  8. [15][15] Marcelo Fernandez. From admission to invariants: Measuring deviation in delegated agent systems. https://doi.org/10.5281/zenodo.19672589 , 2026. Zenodo. DOI: 10.5281/zenodo.19672589. arXiv:2604.17517. - · DOI
  9. [16][16] Marcelo Fernandez. Irreducible governance structure for autonomous agent systems: Fair allocation, strategy-proofness, and multi-scale composition. https://doi.org/10.5281/ zenodo.19708496 , 2026. Agent Governance Series, Paper 3/4 (consolidated). Zenodo. DOI: 10.5281/zenodo.19708496. arXiv: TBD. - · DOI
  10. [17][17] Marcelo Fernandez. Operationalizing reconstructive authority: Runtime construction, dependency resolution, and execution gating in autonomous agent systems. https://doi.org/10. 5281/zenodo.19699460 , 2026. Agent Governance Series, Paper 6. Zenodo. DOI: 10.5281/zenodo.19699460. arXiv: TBD. - · DOI
  11. [18][18] Marcelo Fernandez. Reconstructive authority model: Runtime execution validity under partial observability. https://doi.org/10.5281/zenodo.19669430 , 2026. Agent Governance Series, Paper 5. Zenodo. DOI: 10.5281/zenodo.19669430. arXiv: 2604.22898. - · DOI
  12. [24][24] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec@CCS) , 2023. -
  13. [31][31] Leslie Lamport. Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers . Addison-Wesley, 2002. -
  14. [33][33] Mark S. Miller and Jonathan S. Shapiro. Paradigm regained: Abstraction mechanisms for access control. In Advances in Computing Science - ASIAN 2003 , volume 2896 of Lecture Notes in Computer Science , pages 224-242. Springer, 2003. Foundational reference for capability-based security, which underlies ACP Capability Tokens. -
  15. [34][34] Sumeet Ramesh Motwani, Mikhail Baranchuk, Martin Strohmeier, Vijay Bolina, Philip H. S. Torr, Lewis Hammond, and Christian Schroeder de Witt. Secret collusion among AI agents: Multi-agent deception via steganography. In Advances in Neural Information Processing Systems (NeurIPS) , 2024. -
  16. [39][39] Amir Pnueli. The temporal logic of programs. In Proceedings of the 18th Annual Symposium on Foundations of Computer Science (FOCS) , pages 46-57. IEEE, 1977. -
  17. [42][42] Jerome H. Saltzer and Michael D. Schroeder. The protection of information in computer systems. Proceedings of the IEEE , 63(9):1278-1308, 1975. Foundational reference for the principle of least privilege and fail-closed design. -
  18. [43][43] Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. Role-based access control models. IEEE Computer , 29(2):38-47, 1996. -
  19. [44][44] Fred B. Schneider. Enforceable security policies. ACM Transactions on Information and System Security , 3(1):30-50, 2000. Formal characterization of which security properties can be enforced through execution monitoring (safety automata / security automata). Establishes the theoretical boundary between verifiable and enforceable properties. -
  20. [45][45] Bruce Schneier and John Kelsey. Secure audit logs to support computer forensics. ACM Transactions on Information and System Security , 2(2):159-176, 1999. -
  21. [48][48] Marilyn Strathern. Improving ratings: Audit in the British university system. European Review , 5(3):305-321, 1997. Coined the accessible formulation of Goodhart's Law: 'When a measure becomes a target, it ceases to be a good measure.'. -
  22. [49][49] Georgios Syros, Anshuman Suri, Jacob Ginesin, Cristina Nita-Rotaru, and Alina Oprea. SAGA: A security architecture for governing AI agentic systems, 2025. arXiv:2504.21034 [cs.CR]. - · arXiv
  23. [50][50] Lillian Tsai and Eugene Bagdasarian. Contextual agent security: A policy for every purpose. In Proceedings of the 20th Workshop on Hot Topics in Operating Systems (HotOS) , 2025. HotOS 2025. -
  24. [51][51] Haoyu Wang, Christopher M. Poskitt, and Jun Sun. AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents. In Proceedings of the 48th International Conference on Software Engineering (ICSE) , 2026. -
  25. [52][52] Yuan Yu, Panagiotis Manolios, and Leslie Lamport. Model checking TLA+ specifications. In Correct Hardware Design and Verification Methods (CHARME) , pages 54-66. Springer, 1999. -
  26. [53][53] Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for Computational Linguistics (ACL) , 2024. Table 27: ACR-1.0 sequence test vectors. All 5/5 pass in library mode with the Go reference implementation. Table 28: Alignment across TLA+ formal model, ACR-1.0 runner, and ACP-RISK-2.0 engine. Table 29: Experiment 9: Boundary Activation Rate (BAR) across three phases. Phase B confirms deviation collapse under upstream sanitization. Phase C confirms that the enforcement boundary is structurally intact. n A = n B = 20; n C = 60 (3 mutations × 20 base cases). Table 30: Experiment 9 Phase D: BAR-Monitor output across 5 drift batches (window N = 40, θ = 0 . 10, δ = -0 . 15). ∆BAR fires AlertTrend at Batch 2 (BAR = 0 . 57 ≫ θ ) - three batches before the threshold condition confirms collapse at Batch 5. Table 31: Threshold detection probability for BAR-Monitor ( W = 40, τ = 0 . 10, baseline p 0 = 0 . 70). p 1 is the fraction of boundary-activating requests under attack. Detection fires when BAR 40 < 0 . 10. Table 32: Experiment 10 Phase E: BAR-Monitor output under progressive knowledge-aware evasion. AlertTrend fires at Batch 2 (BAR = 0 . 57, ∆BAR = -0 . 25), three batches before the threshold condition at Batch 5. Window = 40; θ = 0 . 10; δ = -0 . 15. Table 33: Threshold configurations evaluated in Experiment 11. Table 34: Experiment 11: threshold sensitivity results across five configurations. Dataset: 20 cases from Experiment 9 baseline. False-denial rate: fraction of T3-APPROVED cases that become DENIED under this configuration. Table 35: Tool risk scores used in Experiment 12 (clean-state, ACP-RISK-3.0 default). Table 36: Experiment 12: three-phase admission control results. Adversary model: A = (formulaaware, flood, B =8). Table 37: Experiment 13: coordination window across N agents. CW appr : total approved actions before first DENIED . CW total : approved + escalated. TTB: total request count at the first DENIED . Table 38: Capability matrix: stateful vs. stateless enforcement over a 10-request trace. ✓ = correct enforcement; × = cannot enforce without external state. ACP stateless and OPA pure are structurally equivalent: both evaluate each request in isolation with F anom = 0. Table 39: LedgerQuerier backend options. The admission control logic ( pkg/risk.Evaluate ) is stateless and backend-agnostic; all state transitions are delegated to the LedgerQuerier abstraction. Redis throughput from Experiment 3 (Docker loopback, Intel i7-8665U, Go 1.22). Pipelining reduces RTTs from ∼ 7-8 to 2; see Table 18. Table 40: ACP deployment maturity tiers. Each tier adds durability, observability, and assurance guarantees. BAR-Monitor is mandatory at Tier 3 because tamper-evident ledgers justify proactive governance monitoring. Table 41: Recommended PolicyConfig starting values by threat profile. All profiles use PolicyHash pinning and APPROVED ≤ 39 / DENIED ≥ 70 thresholds (ACP-RISK-3.0 defaults). Expected BAR baseline is the healthy operational range for a deployment at that profile under normal (non-attack) traffic; sustained BAR below the lower bound indicates deviation collapse (§17.6). † Polling agents may require higher Y to suppress false escalations from legitimate repeated reads. Table 42: ACP-RISK-2.0 vs. ACP-RISK-3.0: behavioral and interface differences. All other fields, formulas, and thresholds are identical. Existing deployments need only provide resource in EvalRequest and upgrade the pkg/risk package. Table 43: Adversary taxonomy: mapping of ACP experiments to ( K,S,B ) adversary classes. Table 44: ACP Glossary. Table 45: ACP prohibited behaviors (ACP-CONF-1.2). Exhibiting any disqualifies conformance at all levels. Table 46: Verification coverage of ACP-RISK-2.0 components. ✓ = covered; × = not covered in that layer.

Cited by

Sorted by citations

Related

Authors
Fernandez, M.
Affiliations
TraslaIA
Corresponding author
Fernandez, Marcelo
ORCID
Fernandez, Marcelo
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2603.18829
arXiv
2603.18829
OpenAlex
W7139918873
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
Locations
arXiv (Cornell University) (cc-by)
Topics
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Computer Networks and Communications › Distributed systems and fault tolerance
Keywords
admission control, autonomous agents, agent governance, agent coordination

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review