{"id":"ba942e98-bf43-40cb-9229-d17cf6992f8f","arxiv_id":"2607.17225","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A requirements-engineering framework that justifies when agentic AI is warranted (AJR) and specifies graduated autonomy, memory, coordination, assurance, and evolution policies (ADP).","lead":"This paper proposes two planning documents that help teams decide when to build an AI agent and, if they do, what rules it must follow. The goal is to make the limits of an agent's freedom explicit, reviewable, and testable before it ships.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'central missing object' claim is asserted rather than evidenced; two consultations and a disclosure survey cannot establish a practice-wide gap.","rationale":"The reader's CONDITIONAL verdict already encodes the right amount of skepticism; my concern does not move it, but sharpens the reason. The central claim is load-bearing because if delegation-boundary specifications already exist under other names, the paper's contribution is a useful relabelling rather than a novel missing object. The concrete test would settle this by checking real artifacts rather than relying on the two-practitioner consultation. If the study finds the dimensions absent or buried, the claim is supported and the paper stands; if not, the verdict should become more skeptical, e.g., the 'central' part of the claim should be downgraded. The paper's worked examples are internally coherent and the practitioner-guidance citations add plausibility, but they do not establish the practice-wide gap. Hence the conditional acceptance remains appropriate pending the proposed empirical check.","tokens_in":8041,"tokens_out":7555,"duration_ms":71433,"concrete_test":"Run one structured artifact/interview study of 20–30 real agentic deployments across domains (e.g., healthcare, finance, DevOps). For each system, code whether the six ADP dimensions (purpose, authority, information/memory, coordination, assurance, evolution) are explicitly specified in any project artifact (SRS, security/access-control policy, architecture decision record, prompt suite, runtime config), and whether they are co-located or buried. If a majority of systems already specify equivalent delegation boundaries under other artifact names, the 'missing object' claim is weakened; if these dimensions are absent or buried in unstructured prompts/schemas and this predicts observed failures, the claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the delegated-autonomy boundary is 'the central missing object in current RE practice' (Section 1). That is a universal empirical claim about what RE teams actually specify, and the significance of the AJR/ADP artifacts derives from it. The support offered is thin in two specific ways. First, the artifact set was shaped by 'two senior practitioners' (Introduction), with no saturation, representativeness, or inter-rater evidence, and the Limitations section concedes that 'empirical validation on real-world agentic systems is the immediate next step.' Second, the cited evidence for under-specified agency includes the 2025 AI Agent Index finding that 25/30 deployed agents disclose no internal safety evaluations; but non-disclosure is not absence of specification, as the paper itself acknowledges in R3 ('rather than implying a complete absence of internal testing'). The paper also does not systematically compare against security/authorization requirements engineering, policy artifacts, or architecture decision records that may already capture authority, memory, and coordination under other names. If such artifacts are common, the delegated-autonomy boundary is not missing—it is simply not labelled as RE. If they are genuinely absent, the claim lands. As written, the 'central missing object' assertion is a plausible framing, not a demonstrated gap, and a mis-calibrated AJR/ADP could reject justified agents or legitimize unsafe ones.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that agentic AI systems introduce a requirements engineering (RE) problem distinct from conventional or ML-based systems: the specification of a `delegated-autonomy boundary`, i.e., what may be delegated to an agent, under what graduated authority, with what oversight, and when control returns to a human. To address this, it proposes two artifacts: an Agency Justification Record (AJR), which gates agentic architecture choices against simpler alternatives using six criteria and anti-criteria; and an Agentic Delegation Policy (ADP), which specifies six dimensions (purpose, authority, information/memory, coordination, assurance, evolution) with a three-tier authority model. The framework is illustrated with two worked examples: a hospital discharge coordination agent and an automated code review agent. The paper closes with four research directions and explicitly lists empirical validation as future work.","tokens_in":8290,"tokens_out":3353,"duration_ms":35607,"significance":"If the delegated-autonomy boundary is indeed a missing object in current RE practice, the proposed AJR and ADP would be a useful, actionable contribution: they operationalize minimal justified autonomy, provide a structured way to record authority tiers, memory scope, and stop conditions, and connect requirements-level commitments to runtime-enforceable artifacts. The paper's strengths are its clear scoping, the graduated-authority model, the concrete worked examples, and the explicit limitation statement pointing to the need for empirical validation. However, the central claim that this boundary is `the central missing object in current RE practice` is not demonstrated; the evidence base is one consultation with two senior practitioners plus an interpretation of disclosure statistics. The artifacts are therefore better characterized as a well-motivated proposal than as a validated solution to an established gap. For a NIER-style contribution, this is acceptable as a starting point, but the paper should either soften the universal claim or substantially expand the evidence.","major_comments":[{"comment":"The paper's load-bearing claim, that the delegated-autonomy boundary is `the central missing object in current RE practice`, is asserted rather than established. The support cited is consultation with two senior practitioners and a small number of secondary sources; the Limitations section itself concedes that `empirical validation on real-world agentic systems is the immediate next step`. With only two informants, there is no saturation, representativeness, or inter-rater evidence for the six AJR criteria, six ADP dimensions, or three authority tiers. Since the novelty and significance of the artifacts rest on this gap, I recommend reframing the claim as a hypothesis or adding a systematic comparison with existing artifacts that may already capture parts of the boundary under other names (e.g., security/authorization requirements, policy-as-code, architecture decision records, Kubernete","section":"§1 (Introduction) and Limitations"},{"comment":"The citation of the 2025 AI Agent Index (25/30 deployed agents disclose no internal safety evaluations; 23/30 have no third-party testing) is used to argue for an `industry-wide absence of verifiable, requirements-level safety commitments`. The paper already acknowledges in R3 that non-disclosure does not imply absence of internal testing, but then draws the stronger conclusion anyway. This is a subtle but important slippage: the data support a disclosure/verifiability gap, not necessarily a specification gap. Since the latter is central to the paper's motivation, the argument should distinguish the two explicitly and, if only a verifiability gap is supported, adjust the wording of the central claim accordingly.","section":"§3, Assurance policy and R3"},{"comment":"The research directions are framed as if the AJR and ADP are accepted starting points, but the paper does not compare the ADP dimensions against prior work on authorization policies, safety contracts, or agent governance (e.g., OAuth scopes, safety cases, or operational design domains for autonomous vehicles). Without such a comparison, it is hard for a reader to judge whether the six dimensions are genuinely new, a re-labeling of existing concerns, or a subset. I recommend adding a short related-work paragraph that positions the ADP against security/authorization RE and policy artifacts, since this materially affects the claim of novelty. This can be addressed without new experiments, but it changes the strength of the contribution story.","section":"§4 / Limitations"}],"minor_comments":[{"comment":"The code review agent is explicitly rejected by the AJR, yet Table 2 still provides a full illustrative ADP for it. The text notes this is for illustration, but the table caption could be clearer, e.g., `Illustrative ADP shown for both examples; in practice a rejected AJR would not proceed to ADP.`","section":"Table 2 and surrounding text"},{"comment":"The code-review entry for C6 reads `Comment turnaround vs existing pipeline >90 days; threshold but little projected gain to justify agentic overhead`. The `>90 days` appears to refer to the baseline pipeline turnaround, but the phrasing is ambiguous. Please clarify what the baseline is and what the proposed threshold is.","section":"Table 1, row C6"},{"comment":"The phrase `each with at least more than ten years of industry experience` is redundant; `at least ten years` or `more than ten years` suffices.","section":"§1, Introduction"},{"comment":"Criterion 2's parenthetical about team-level decisions for semi-structured contexts is vague. Consider giving a concrete example or removing the parenthetical, as it currently reads as an escape clause rather than a decision criterion.","section":"§2, AJR criteria"},{"comment":"The sentence `Do they update them after incidents?` is a quoted example of an empirical question but is punctuated as a sentence fragment. It should be integrated into the surrounding text or turned into a proper non-quoted question.","section":"§4, R4"}],"recommendation":"major_revision","confidential_remarks":"This is a classic NIER/position paper: ambitious, clearly written, and with a plausible central idea. The main risk is not the artifacts themselves but the universality of the `central missing object` claim, which may attract criticism from reviewers in security/authorization RE or architecture communities. If the authors soften the claim and add a concise comparison with existing policy and authorization artifacts, the paper would be a solid accept for a workshop-style venue. I recommend major revision because the central claim is currently load-bearing and not yet supported by the evidence presented; however, I do not think the issues are fatal — they require reframing and a focused related-work addition rather than new experiments."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nShort version: this is a solid NIER-style position paper. It names a real and timely problem—that specifying what an agent may do, with what authority and oversight, is a requirements-level decision that current practice leaves implicit—and it offers two concrete artifacts, the AJR and ADP, that are coherent and well-illustrated. That is a genuine contribution. The discharge and code-review examples are well chosen, and the ADP's graduated three-tier authority is a sensible design choice that goes beyond most goal-model or problem-frames work.\n\nThe paper is at its best when it stays in design-science mode. It is transparent that the AJR/ADP are proposals, not validated instruments, and the limitations section says the next step is empirical validation. That is the right frame for a workshop/NIER paper.\n\nWhere I have quibbles: the 'central missing object in current RE practice' assertion is the weakest sentence in the paper. It is a plausible framing, but the support is two practitioner consultations and a disclosure survey that the authors themselves correctly read as non-disclosure rather than absence. So the stress-test concern mostly lands—but it would only be a real problem if the paper leaned on that claim to overstate its own novelty. In fact, the paper later narrows the claim to 'a distinct RE problem,' which is more defensible. I would advise the authors to soften the 'central' language and add a short comparison to ADRs, security policies, and authorization models that might already capture some of this territory under other names.\n\nOne minor inconsistency: the rejected code-review agent still gets a full illustrative ADP (Table 2). The paper notes a rejected AJR would not proceed to an ADP, but then gives a detailed ADP anyway. A footnote or a one-line justification would fix it.\n\nBottom line: worth a serious referee. For someone working on RE for AI or agentic systems, this is a useful vocabulary and a starting point. It does not internally overclaim—the main overclaim is in the introduction and conclusion. I would accept it for peer review with a request to temper the 'central' language.","headline":"A useful, clearly-written RE vision for agentic systems; the AJR/ADP artifacts are a real contribution, but the 'central missing object' claim is a framing choice, not a demonstrated fact.","tokens_in":8793,"tokens_out":1887,"would_cite":true,"duration_ms":18714,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Specifying agentic AI requires deciding not only what it should produce but what it may do, under whose authority, and when control returns to a human.","keywords":["requirements engineering","agentic AI","delegated autonomy","AI agents","autonomy boundary","Agency Justification Record","Agentic Delegation Policy","graduated authority"],"falsifier":"Inspect a corpus of deployed or failed agentic systems: if any system that caused harm had a fully specified ADP yet the harmful action fell outside all six ADP dimensions and all three authority tiers, the completeness claim fails. A controlled study would do the same prospectively: teams using the artifacts to specify real agents would be checked for whether the artifacts force out the decisions that actually matter; any dimension practitioners must add ad hoc would falsify the claim that the boundary is captured.","tokens_in":7856,"feed_emoji":"🤖","tokens_out":4812,"duration_ms":40185,"temperature":0.7,"pith_summary":"Agentic AI systems plan, keep state, and act across external systems, so the requirements question is no longer just 'what should the system output?' but 'what may the system do, to what resources, under whose authority, and when does control return to a human?' The paper names this set of decisions the delegated-autonomy boundary and argues it is the central missing object in current requirements-engineering practice, since today these commitments are buried in prompts, tool schemas, and runtime policies. To make the boundary explicit, the paper proposes two artifacts: an Agency Justification Record (AJR), a six-criterion gate that forces teams to justify an agentic architecture against simpler alternatives before building it, and an Agentic Delegation Policy (ADP), a six-dimension specification covering purpose, graduated authority, information and memory, coordination, assurance, and evolution. If the proposal is right, agentic systems would be developed against reviewable, testable delegation terms instead of ad hoc prompt tinkering, and rejected agent proposals would leave a documented rationale. A safety-critical discharge agent clears the gate while a code-review agent is rejected, illustrating that the gate's rejection path is as important as its acceptance path.","feed_headline":"Two new artifacts make AI-agent autonomy explicit and testable","feed_subtitle":"A pre-build gate plus a six-part delegation policy turn 'what the agent may do' into reviewable requirements.","key_machinery":"The central mechanism is the delegated-autonomy boundary, defined as the set of decisions about what may be delegated to an agent, under what graduated authority, with what oversight, and how control is returned. It is carried by two artifacts. The Agency Justification Record (AJR) operationalizes the principle of minimal justified autonomy: six criteria that a task should mostly satisfy before an agent is warranted, plus anti-criteria that veto agency outright. The Agentic Delegation Policy (ADP) specifies the boundary across six dimensions: purpose, authority, information and memory, coordination, assurance, and evolution. The load-bearing structure inside the ADP is the three-tier authori","core_discovery":"The paper establishes a new requirements-engineering problem: when software becomes an agent, requirements must cover not just behavior but the scope, graduation, and governance of delegated action. The authors call this the delegated-autonomy boundary and claim it has been overlooked as a first-class RE concern. They operationalize it with two artifacts. The AJR is a pre-architecture decision record with six criteria—open-ended task structure, unstructured context, cross-system actions, evaluable progress, bounded risk, and advantage over baselines—plus anti-criteria that disqualify agency. The ADP is a specification artifact with six policy dimensions, the core of which is a three-tier aut","pith_inferences":["The AJR's advantage-over-baseline threshold points toward a natural acceptance test the paper does not fully develop: if a deployed agent fails to meet its precommitted improvement threshold, the specification itself says the agent should be reverted to the simpler baseline.","The three-tier authority model could let regulators classify any agent deployment by its highest permitted tier, providing a fast risk signal with no further analysis.","The paper's rejection of multi-agent architectures 'for conceptual neatness' suggests a testable extension: measure whether multi-agent decompositions actually reduce coordination cost or just add handoff overhead.","If the delegated-autonomy boundary becomes central, requirements documents for agentic systems will need to be living artifacts, updated whenever models, tools, or escalation rules change, making evolution policy a continuous compliance burden."],"forward_implications":["A rejected AJR records why a simpler architecture was chosen, so unjustified agentic complexity is blocked before implementation, and the rejection rationale becomes part of the design history.","ADP stop conditions make 'keep trying' an explicit requirements decision, so runaway behavior caused by implicit persistence becomes preventable.","The three authority tiers can be compiled into executable guards: tool permission lists, human-approval gates, and hard prohibitions enforced by runtime monitors.","ADP dimensions give a basis for requirements-derived testing, targeting tier-boundary violations, provenance gaps, and escalation failures.","In regulated domains, documenting the delegation boundary before deployment makes auditability and compliance a requirements obligation rather than an afterthought."],"fun_headline_variants":["Two artifacts define the delegated-autonomy boundary for agentic AI","Agency Justification Record and Delegation Policy specify AI autonomy","New RE artifacts: when an AI should act and how much authority","Graduated authority: AJR and ADP guide safe agentic AI"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The claim rests on the assumption that the AJR and ADP artifacts, built from two senior practitioners and two worked examples, are a sufficiently complete and correctly calibrated characterisation of delegated-autonomy requirements; if that set is incomplete or mis-weighted, the artifacts could legitimise unsafe agents or reject useful ones.","fun_headline_variants_meta":{"raw":{"variants":["Two artifacts define the delegated-autonomy boundary for agentic AI","Agency Justification Record and Delegation Policy specify AI autonomy","New RE artifacts: when an AI should act and how much authority","Graduated authority: AJR and ADP guide safe agentic AI"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000244,"raw_usage":{"total_tokens":1351,"prompt_tokens":708,"completion_tokens":643,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":452,"completion_tokens_details":{"reasoning_tokens":569}},"tokens_in":452,"tokens_out":643,"duration_ms":6319,"temperature":1.0,"reasoning_tokens":569,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T18:37:52.818094+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Inspect a corpus of deployed or failed agentic systems: if any system that caused harm had a fully specified ADP yet the harmful action fell outside all six ADP dimensions and all three authority tiers, the completeness claim fails. A controlled study would do the same prospectively: teams using the artifacts to specify real agents would be checked for whether the artifacts force out the decisions that actually matter; any dimension practitioners must add ad hoc would falsify the claim that the boundary is captured.","supporting_citations":[],"review_version":1}