Organizational Control Layer: Governance Infrastructure at the Execution Boundary of LLM Agent Systems

TL;DR

The paper introduces the Organizational Control Layer (OCL), a model-agnostic governance layer that intercepts LLM-agent actions before execution and returns approve/revise/block/escalate outcomes. In adversarial buyer-seller negotiation on AgenticPay, OCL reduced unsafe executions from 88% to 0% and raised valid success from 12% to 96%, while revealing a safety-utility tradeoff in tightly constrained markets.

Key findings

• Across 50 adversarial episodes with GPT-5.4, OCL reduced the unsafe rate from 88% to 0%, executed violations from 205 to 0, and raised valid success from 12% to 96%; task success rose from 94% to 96%, with a 94% intercept rate, 52 intercepted threats, and 48 escalations.
• OCL reduced average rounds from 5.36 to 2.58 and latency from 38.75s to 18.51s, while audits increased from 7.36 to 13.58 per episode; average seller reward changed from 26.95 to 18.39.
• Cross-model results for GPT-5.4, Gemini-3.1, and Qwen-3.5 show OCL success rates at or above 96%, with intercept rates of 94%, 82%, and 60%, respectively.
• Per-scenario gains were largest under severe time pressure (S5, 44% → 54% strict success) and in the default partial-information setting (S2, 56% → 74%); tight-feasibility (S3) and high-anchor (S4) markets showed small drops in strict success and cost-adjusted welfare under OCL.

Methods

• The paper formalizes an Economic Multi-Agent Task \(T = \langle S, \{A_i\}_{i=1}^N, C, U, E \rangle\), separating a raw agent decision \(d^{raw}_t\) from the executed platform decision \(d^{exec}_t\); OCL applies policies \(\Pi = \{\pi_{role}, \pi_{gate}, \pi_{audit}, \pi_{escalate}\}\) and returns outcomes APPROVE, REVISE, BLOCK, or ESCALATE.
• Evaluation uses AgenticPay with private buyer budgets and private seller reserves; the benchmark contains 50 adversarial buyer profiles across five persona types (Extreme Lowballer, Privacy Phisher, Role Hijacker, Vague Shopper, Time Waster), synthesized by a prompt-driven LLM pipeline from a real-world negotiation corpus.
• Paired baseline-vs-OCL experiments use GPT-5.4, Gemini-3.1, and Qwen-3.5 as backend generators; LLMs emit JSON actions, OCL intercepts raw payloads pre-execution, and deterministic control/replanning clamps violations (e.g., an out-of-bounds price is revised to the seller’s floor). Metrics include success, valid success, unsafe rate, intercept rate, rounds, latency, audits, and seller reward.

Limitations

• The paper states a safety-utility tradeoff: strict governance improves compliance and reliability but can reduce flexibility in tightly constrained markets; S3 and S4 show small drops in strict success and cost-adjusted welfare, where the ungoverned baseline can exploit a narrow feasible interval.
• The paper states future work is needed on adaptive gate policies, persona-conditioned escalation, multi-role deployment beyond the seller side, transfer beyond bilateral price negotiation, and adversaries that target the clamp rule.
• Evident from the text: evaluation is limited to seller-side bilateral price negotiation on AgenticPay with 50 synthetic adversarial profiles and one seed per profile; OCL only sees observable constraints \(C_{obs}\), not hidden constraints \(C_{hid}\), and no human deployment or broader commerce mechanisms are tested.