{"id":"225a8900-7114-4bf4-881d-d6637f45a7af","arxiv_id":"2606.30970","paper_version":2,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"AgentBound is a governance framework that composes delegated authorization, behavioral constitutions, and action contracts to produce cryptographically verifiable decisions on AI agent actions.","lead":"The paper introduces AgentBound, a runtime framework that checks AI agent actions against authorization, owner policies, and site contracts before execution and creates verifiable receipts. Smart generalists might read it to understand practical ways to add accountability layers to autonomous AI systems used in finance and workflows.","discovery_kind":"unclear","skeptic_critique":{"model":"grok-4.3","headline":"Conservative composition of three authorities lacks demonstrated handling of conflicts or edge cases without excessive false denials or undefined behavior","rationale":"The reader's weakest assumption is precisely the load-bearing point for the strongest claim. Because the supplied text is the abstract only and the full manuscript details on the decision model are absent from the provided input, the concern remains unaddressed; no adjustment to the UNVERDICTED verdict is warranted.","tokens_in":1753,"tokens_out":291,"duration_ms":12802,"concrete_test":"Extract the formal decision model (including any composition function or decision table) from the paper's formal foundation section; apply it to 50 synthetic scenarios with pairwise authority conflicts (e.g., delegation permits but constitution denies on the same action); report the fraction of outcomes that are undefined or produce false denials exceeding 20%.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that delegated authorization, owner-signed behavioral constitutions, and site action contracts compose conservatively via a formal decision model. The abstract asserts this composition determines permit/review/deny outcomes and enables verifiable receipts, but provides no equations, conflict-resolution rules, or proof that the model remains defined and non-excessive under realistic policy interactions. Without those specifics, it is impossible to confirm the composition avoids undefined states or high false-denial rates when authorities disagree on semantic or contextual grounds.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper claims to introduce AgentBound, a runtime governance framework for autonomous AI agents. It evaluates each proposed action using three independent authorities (delegated authorization, owner-signed behavioral constitutions, and site action contracts) whose judgments are conservatively composed through a formal decision model to determine permit/review/deny outcomes. The framework generates cryptographically verifiable governance receipts that bind every action to the exact delegation, policy, and semantic artifacts, introduces standing delegation for long-running agents, and presents AgentBound-Bench for evaluating governance correctness, authority composition, and accountability. It positions the approach as complementing model alignment with a deterministic, independently verifiable governance layer.","tokens_in":1845,"tokens_out":388,"duration_ms":18633,"significance":"If the formal decision model is sound, the conservative composition is well-defined, and the receipts enable independent verification without excessive false denials, the work could provide a meaningful contribution by shifting AI agent governance from trust-based to cryptographically verifiable, with potential applicability in high-stakes domains like finance and enterprise workflows.","major_comments":[{"comment":"Abstract: The central claim that the three authorities 'are conservatively composed through a formal decision model' to determine permit/review/deny outcomes lacks any equations, conflict-resolution rules, proof sketches, or handling of edge cases (e.g., semantic disagreements between authorities). This directly undermines verification of the claim that the composition remains defined and avoids excessive false denials or undefined behavior under realistic policy interactions.","section":"Abstract"}],"minor_comments":[{"comment":"The abstract states that the formal foundation, system architecture, governance receipt protocol, and AgentBound-Bench are presented, but provides no section references, equation numbers, or high-level pseudocode to allow readers to locate these elements.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for highlighting the need for greater clarity on the formal decision model. We address the comment below and will revise the manuscript accordingly.","responses":[{"response":"The abstract is intentionally concise, but the full manuscript defines the conservative composition in Section 3.2 via the decision function D(A1, A2, A3) = permit only if all authorities permit, review if any requires review and none deny, and deny otherwise. Conflict resolution uses conservative conjunction (any deny propagates to deny) with explicit rules for semantic mismatches resolved by requiring owner-signed policy provenance in receipts. Edge cases such as authority disagreement are handled by the receipt protocol enabling independent verification. We will expand the abstract with a one-sentence summary of the composition operator and a pointer to Section 3 to make this explicit without lengthening the abstract excessively.","revision_made":"yes","referee_comment":"[Abstract] Abstract: The central claim that the three authorities 'are conservatively composed through a formal decision model' to determine permit/review/deny outcomes lacks any equations, conflict-resolution rules, proof sketches, or handling of edge cases (e.g., semantic disagreements between authorities). This directly undermines verification of the claim that the composition remains defined and avoids excessive false denials or undefined behavior under realistic policy interactions."}],"tokens_in":1350,"tokens_out":286,"duration_ms":14442,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"AgentBound tries to fix the gap between identity-based authorization and actual behavioral control for autonomous agents by checking each action against delegated rights, owner-signed constitutions, and site contracts, then issuing cryptographic receipts that let anyone replay the decision.\n\nThe architecture description and the standing delegation mechanism for long-running agents are clear and address a real operational need. The benchmark idea for testing governance correctness is also a useful addition.\n\nThe soft spot is exactly the one the stress test flags: the paper claims a formal decision model that conservatively composes the three authorities, but supplies no equations, conflict-resolution rules, or examples of what happens when the authorities disagree on semantic grounds. Without those specifics it is impossible to judge false-denial rates or undefined states.\n\nThe work is aimed at engineers and researchers building agent systems that need auditable oversight rather than pure trust. A reader already working on policy enforcement or verifiable computation would find the high-level design worth seeing.\n\nIt deserves peer review so the authors can be asked to show the actual model and any initial evaluation results.","headline":"AgentBound sketches a governance layer using three authorities and crypto receipts but the formal composition rules remain too high-level to assess conflict handling.","tokens_in":2317,"tokens_out":286,"would_cite":false,"duration_ms":17823,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"AgentBound verifies each AI agent action against three authorities and binds the decision to cryptographic receipts for independent checking.","keywords":["AI agents","behavioral governance","verifiable receipts","policy composition","autonomous agents","delegated authorization","cryptographic accountability"],"falsifier":"Deploying AgentBound-Bench or live agent workloads and measuring the observed rate of false denials plus any undefined behaviors produced by the composition model under varied policies.","tokens_in":2650,"feed_emoji":"🔒","tokens_out":614,"duration_ms":18705,"temperature":0.7,"pith_summary":"The paper introduces AgentBound to give autonomous AI agents behavioral oversight that does not depend on trusting the authorization system alone. Each proposed action is checked by delegated authorization, owner-signed behavioral constitutions, and site action contracts. These three sources are combined through a formal decision model that outputs permit, review, or deny. The system then produces cryptographically verifiable governance receipts that record exactly which delegation, policies, and artifacts produced the outcome. This setup lets any party replay and confirm the governance process after the fact, while also supporting standing delegation for ongoing agent workloads.","feed_headline":"Crypto receipts let anyone verify AI agent governance decisions","feed_subtitle":"Three authorities are composed formally and every outcome is bound to the exact policies used, enabling replay checks.","key_machinery":"The formal decision model that conservatively composes judgments from the three authorities together with the governance receipt protocol that produces cryptographically verifiable records of each decision.","core_discovery":"AgentBound evaluates each proposed action using three independent authorities—delegated authorization, owner-signed behavioral constitutions, and site action contracts—whose judgments are conservatively composed through a formal decision model to determine whether the action should be permitted, reviewed, or denied before execution, and it generates cryptographically verifiable governance receipts that bind every action to the exact delegation, policy, and semantic artifacts governing the decision.","pith_inferences":["Receipt-based verification could support external audits of agent activity in domains that require regulatory records.","The conservative composition rule may trade some operational flexibility for reduced risk of unauthorized actions.","Because receipts are independent of the agent's internal model, policy changes can be applied and verified without retraining."],"forward_implications":["Every executed action carries a receipt that enables independent replay verification of the full governance path.","Standing delegation lets long-running agents refresh policies continuously while keeping authority bounded and revocable.","The deterministic layer sits between authorization and execution and therefore complements model alignment rather than replacing it.","AgentBound-Bench supplies a way to measure governance correctness, authority composition, and accountability for any given policy set."],"fun_headline_variants":["Three authorities decide AI actions before execution","Receipts bind every AI agent decision to policies","AgentBound verifies autonomous agent governance","Formal model controls AI agent behavioral decisions","Cryptographic receipts track AI governance provenance"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The three authorities can be composed conservatively through the formal decision model without producing excessive false denials or undefined behavior during real operation.","fun_headline_variants_meta":{"raw":{"variants":["Three authorities decide AI actions before execution","Receipts bind every AI agent decision to policies","AgentBound verifies autonomous agent governance","Formal model controls AI agent behavioral decisions","Cryptographic receipts track AI governance provenance"]},"model":"grok-4.3","cost_usd":0.010052,"raw_usage":{"total_tokens":4475,"prompt_tokens":693,"num_sources_used":0,"completion_tokens":60,"cost_in_usd_ticks":100524500,"prompt_tokens_details":{"text_tokens":693,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":3722,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":693,"tokens_out":60,"duration_ms":26568,"temperature":1.0,"reasoning_tokens":3722,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-03T22:24:38.049038+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Deploying AgentBound-Bench or live agent workloads and measuring the observed rate of false denials plus any undefined behaviors produced by the composition model under varied policies.","supporting_citations":[],"review_version":2}