Context Is Not Authority: Structured Runtime Governance for Financial Market Agents

Chen Dong; Qiangqiang Liu; Rui Tang; Xi Chen; Yichi Zhang; Youwei Yang

Context Is Not Authority: Structured Runtime Governance for Financial Market Agents

T0 review · 2 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read For financial agents, correct context is not authority: every response, trade, or policy must carry a typed, state-valid receipt.

desk verdict SAGE-Fin is a careful, well-scoped design and formalization of receipt-based runtime governance for financial agents; the formal claims hold under its stated trust assumptions, but the load-bearing compiler boundary is never tested on raw language and the empirical evidence is explicitly self-referential. read the letter →

arxiv 2608.09025 v2 pith:PHF3DW2D submitted 2026-08-10 cs.AI cs.CRstat.ML

Rui Tang , Qiangqiang Liu , Yichi Zhang , Youwei Yang , Xi Chen , Chen Dong This is my paper · ORCID

classification cs.AIcs.CRstat.ML

keywords financialAIagentsruntimegovernanceinfinanceagentsafetyauditabilityriskcontrolreceiptscontext-to-authorityfailure

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that financial agents can cause real harm—a customer-facing commitment, a trade, a deployed policy—while the words they emit are factually correct, fluent, and well sourced, because correct context is not the same as runtime authority. It presents SAGE-Fin, a finance-specific authority-handoff contract that makes the proposed effect, not its text, the object of control: a deterministic compiler turns each proposal into a typed candidate, missing or stale institutional obligations become visible 'coverage debt,' and no response, trade, or policy may be emitted without a receipt whose nominal type matches the consuming adapter and whose state bindings still hold at consumption. If the mechanism works as claimed, the failure class in which fluent language outruns structured verification—repeated emissions, stale fee quotes, verbal risk-control instructions becoming enforceable policy—is closed at the runtime boundary, without any assertion about profitability or legal compliance. The paper's evidence is deliberately scoped: 616/616 parity on an authored 616-case catalog with 3,080 specification outputs establishes executable conformance, not independent safety accuracy, and the production feedback is qualitative corroboration rather than an effect estimate.

What carries the argument

The load-bearing object is the authority-handoff contract that joins five components at consumption time: the re-derived typed candidate $c^\star_t = \Gamma(P_t, \xi_t)$ produced by the deterministic compiler; the witness and validator registries whose gaps surface as coverage debt $D_t$; the exact serialized artifact $x_t$; the current runtime state $\xi_t$; and a receipt $R$ whose nominal type belongs to {evd, bud, val, fxt, shd, commit, execAuth, deploy}, with only commit, execAuth, and deploy accepted by the response, execution, and policy adapters respectively. The consumption-time gate (Definition 7) conjoins trusted issuance, receipt-type membership, candidate and artifact hash bindings, subject, scope, and policy matches, the time window, consumption-time state predicates, empty blocking debt, permitted effects, and cap ordering on a per-adapter authority semilattice $(A_g, \preceq_g, \wedge_g)$. That conjunction—no single component in isolation—is what makes evidence and workflow progress unable to substitute for effect authority, and it is the mechanism the proofs in Theorems 1–5 run on.

What would settle it

Run an ambiguous natural-language proposal—for instance 'relax drawdown checks for institutional accounts after-hours,' which leaves the drawdown window, institutional witness, fallback, and rollback unspecified—through the compiler $\Gamma$ and policy adapter: if a deploy receipt is issued or enforcement begins while those unresolved fields are absent from coverage debt, the central claim fails. Equivalently, replay any stored trace in which a governed effect occurs with only a progress receipt (evd, bud, val, fxt, shd) present, or in which execution proceeds after a bound drawdown, freshness, regime, or incident predicate fails at consumption; Theorems 1 and 5 assert that both are impossible.

Watch

Extended reading notes

Core claim

The central claim is trace-level authority non-amplification: in any finite sequence of proposal, issuance, state-update, and consumption events, no governed effect occurs without an earlier trusted issuance event for a receipt of a type the consuming adapter accepts, whose candidate, exact-artifact, subject, scope, cap, policy, time, and state bindings all hold at consumption, with no blocking coverage debt (Theorem 1, Section 6.3). Progress receipts—evidence, budget, validation, fixture, shadow—can never authorize an effect because their nominal types lie outside the acceptance sets of the response, execution, and policy adapters, and an upstream evidence or language-validation pass can discharge an obligation but cannot compose into downstream permission (Proposition 2). Authority is re-derived rather than cached: the compiler $\Gamma$ recompiles the candidate from current proposal and state, so the same surface text can lose its authority between turns (Remark 1), and a receipt valid at issuance is rejected if any bound predicate fails at consumption (Theorems 5 and 3). The result is a soundness guarantee for a fully mediated runtime under the paper's stated trust assumptions; the 616-case catalog and 22 tests demonstrate that the prototype conforms to its own declared semantics, which the paper distinguishes from independent safety accuracy.

Load-bearing premise

The guarantee collapses if the deterministic compiler cannot faithfully translate natural-language proposals into typed effect candidates, because every downstream receipt inherits whatever the compiler mis-reads; the paper's own evaluation never runs raw, adversarial, or out-of-domain language through that compiler, since its 616-case catalog is structured and authored.

Editorial extensions

If this is right

A correct, well-sourced answer cannot be emitted on context alone: the response adapter accepts only a commit receipt bound to the exact artifact and still valid under the current dialogue and account state.
Entering a workflow, reserving budget, passing a language or evidence check, or validating a policy grants audit evidence but never execution or deployment authority; only the matching execAuth or deploy receipt can do that.
Prior authorization is not portable across turns: because the candidate is recompiled from current state, effectively unchanged text can carry different authority after dialogue, freshness, portfolio, incident, or policy changes.
Stale or missing obligations become visible coverage debt that contracts or blocks the authority cap instead of being masked by fluent prose, and reconciliation of outcomes contracts future authority on the affected scope.
Every governed effect on a mediated runtime becomes reconstructable from its trace: the exact artifact, its receipt, the witnesses, and the state predicates that held at consumption.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the same contract shape—typed candidates, coverage debt, exact-artifact receipts, consumption-time revalidation—could be ported to other domains where natural language crosses an authority boundary, such as medical advice or legal commitments, by redefining candidate types, witness registries, and adapter receipts.
Editorial inference: the authors' own admission that one-shot reuse of the same receipt for the same artifact is outside the current prototype points to the natural next mechanism—an atomic spent-receipt ledger—which would extend Theorem 1 from 'an earlier issuance exists' to 'a single non-reusable consumption occurred.'
Editorial inference: because $\Gamma$ is the boundary where natural language becomes typed authority, an adversarial-robustness study of the compiler against ambiguous, contradictory, or jailbroken phrasing is the direct next experiment; the current evidence deliberately does not exercise raw adversarial language.
Editorial inference: a testable deployment extension is a privacy-preserving replay of historical customer-service interactions with independent labels, which would convert the paper's three qualitative predecessor episodes into a measurable interception rate and bounded false-block counts.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The short version: this is a solid design paper, not a validated safety result. The authors are unusually honest about what it is and is not.

What's actually new is the authority contract itself: typed candidates, coverage debt, non-substitutable commit/execAuth/deploy receipts, and consumption-time re-derivation. That packages complete mediation, ABAC, UCON, macaroons, and AgentSpec into a finance-specific object with a trace-level non-amplification theorem. It's a real contribution at the design and formalization level, and it fills a genuine gap in the agent-governance literature.

The paper does several things well. The formal model is coherent: Theorems 1-5 follow from the definitions and Assumption 1, and the authors don't oversell. They explicitly label 616/616 as conformance rather than independent safety accuracy, Section 10 owns the circularity (rules, mappings, and oracles developed against the same catalog), and the prospective replay protocol in Section 8.4 is a thoughtful template. The failure taxonomy is useful framing.

The main soft spot is the compiler boundary. The paper's motivating claim is that context cannot become authority, but the formal guarantee depends on Gamma faithfully compiling natural-language proposals into the correct typed candidate. If Gamma misreads "relax drawdown checks for institutional accounts after-hours"--the paper's own example--the candidate, witnesses, coverage debt, and receipt all inherit the error, and you get a valid receipt for the wrong effect. Theorem 1 is true and the gate is sound, but the real-world guarantee is only as good as Gamma's semantic fidelity. The evaluation never tests Gamma on raw, ambiguous, or adversarial language: the 616-case catalog is pre-typed, the 22 tests cover selected paths, and the production episodes are retrospective reconstructions rather than gate outputs. So the central practical claim is unverified at exactly the boundary the threat model targets.

The circularity is real but admitted; the full-policy row being 0/587 by construction is fine as a mechanism check, not as an independent safety estimate. No artifacts are released, so a referee cannot rerun anything. The production evidence is qualitative and de-identified to the point of being uninspectable; the 0/3 interception on three predecessor failures grounds the taxonomy but estimates nothing.

None of this is fatal to the paper as a design and formalization contribution. The internal logic holds, the scoping is disciplined, and it should not be read as a validated safety guarantee. It deserves a serious referee: the design is coherent, the limitations are honestly stated, and the weaknesses are addressable. I'd send it to peer review with the expectation of major revision, primarily asking for Gamma to be exercised on raw natural-language inputs and for the fixtures to be released.

Referee Report

2 major / 6 minor

Summary. The paper identifies a failure mode it calls 'context-to-authority': a financial LLM agent can retrieve correct, fluent, well-sourced context and still lack runtime authority to emit a recommendation, execute a trade, or deploy a risk-control policy. It introduces SAGE-Fin, a runtime authority control plane in which a deterministic compiler Gamma maps natural-language proposals into typed candidates; witness and validator registries expose missing evidence as coverage debt; a dynamic controller computes an adapter-specific authority cap; and typed, non-substitutable receipts (commit, execAuth, deploy) are required at consumption-time gates. The formal part defines the candidate, debt, authority semilattice, receipt, and gate, and proves trace-level authority non-amplification (Theorem 1), receipt non-substitutability (Theorem 2), upstream-validation non-escalation (Proposition 2), execution- and policy-gate soundness (Theorems 3 and 4), state-contingent receipt revocation (Theorem 5), and monotone cap contraction (Propositions 1, 3, 5). Empirically, the paper reports an authored 616-case catalog with 3,080 specification outputs, 616/616 binary reference–prototype parity, 22 prototype tests, a label-isolated parity harness, three de-identified predecessor failures with independently confirmed 0/3 interception, and qualitative deployment feedback from a confidential digital-asset platform.

Significance. If the paper's central mechanism claim is accepted, SAGE-Fin is a useful, clearly specified design for making runtime financial authority explicit, auditable, and state-contingent. The formalization is clean and the paper is unusually disciplined about what the evaluation can and cannot show: it explicitly labels 616/616 as conformance rather than independent accuracy, discloses that the full-policy evaluator row is zero by construction against its own rejection set, and separates the three predecessor episodes and the later deployment from the public catalog evidence. The causal-filtration statement for the HMM regime witness (Proposition 4) is a nice touch, and the prospective replay protocol with explicit falsifiers (Table 9) is a genuinely useful contribution to how such mechanisms could be evaluated. The non-substitutable receipt/gate abstraction, while built from classical complete-mediation and usage-control ideas, is adapted to the financial-agent boundary in a way that should be reusable by other systems.

major comments (2)

[§6.3, Assumption 1 and Definition 7; §8.2] Theorem 1 is sound as a theorem about the gate, but it does not establish that the runtime governs the effect the user or model actually proposed. The candidate hash h_c binds to c_t^* = Gamma(P_t, xi_t), so the required witnesses, coverage debt, and eventual receipt bindings all inherit Gamma's output. If Gamma miscompiles an ambiguous or adversarial natural-language proposal—for example, resolving 'relax drawdown checks for institutional accounts after-hours' with the wrong scope or threshold, or compiling a commitment as a descriptive claim—then a valid commit, execAuth, or deploy receipt can be issued for the wrong effect, and Theorem 1 certifies the trace relative to that miscompiled candidate. The evaluation never exercises this boundary: the 616 cases in §8.2 are structured inputs with supplied candidates, witnesses, and receipts, and the 22 tests in §8.1 cover selected paths rather than raw, ambiguous, or out-of-domain proposals. Section 10 discusses parse failures and false rejection, but not semantic miscompilation. I do not count this as an internal inconsistency, but it is the central gap between the formal guarantee and the motivating 'context-to-authority' failure. Please either add targeted adversarial/ambiguous natural-language-to-candidate tests, or explicitly and prominently restrict the central claim to 'assuming faithful compilation of the proposal into the typed candidate' and adjust the abstract and conclusion wording accordingly.
[§8.2, Table 6; §11] The headline empirical results cannot provide external evidence that SAGE-Fin would reject unauthorized effects, because the prototype mapping, the full-policy oracle, and the authored labels were developed against the same catalog, and the full-evaluator row of Table 6 is zero by construction against its own rejection set. The paper states this limitation accurately, so this is not a fatal defect, but it does mean the 616/616 parity and the 0/587 contrast are self-consistency checks rather than validation. Given that these are the only quantitative results for the mechanism, the conclusions in §11 should be read as claiming mechanism conformance only. I would recommend adding an independent-label held-out split or an independently authored second catalog, even if small, to increase the empirical weight of the central mechanism claim.

minor comments (6)

[Table 6] The caption and the table heading 'Approvals / 587' are easy to misread: make the first column definition explicit in the caption itself, stating that the 587 cases are the cases the full policy defines as non-approvable, so that the 0/587 row is not read as a general accuracy denominator.
[§8.2] The sentence 'The 29 full-policy approvals exercise permissive branches' initially appears to contradict Table 6's 0/587 full-policy row; clarify in the same paragraph that these 29 approvals are among the 90 cases that reach full evaluation (29 approved, 61 rejected), not approvals within the 587-case rejection set.
[§5.5 and Definition 6] The receipt abbreviation 'bud' is used in the non-substitutability discussion before Definition 6 lists the receipt types; define all receipt-type abbreviations (evd, bud, val, fxt, shd, commit, execAuth, deploy) at first use, ideally in Table 2 or in §5.5.
[Figure 1] The label 'deployed path' in Figure 1 is ambiguous between the policy-deployment path and the execution-adapter path; rename it to something like 'enforced policy path' or draw separate arrows so the reader can map it to the policy adapter gate.
[§7.1.3] The regime thresholds theta_S, theta_I, and theta_H are free parameters with no guidance on selection; Proposition 5's monotonicity does not depend on their precise values, but the prototype's gate behavior does. A sentence on how these thresholds are set in the prototype, or an explicit statement that they are configuration inputs, would help.
[§8.3] The wording 'second-analyst 0/3 confirmation' is clear, but the reader should also be reminded in the main text that the three episodes are a disclosure-approved convenience set, not a random sample, so their non-interception rate has no prevalence interpretation. The paper does say this later; moving a version of that caveat directly next to the 0/3 figure would prevent misreading.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the formal guarantee is a scoped soundness theorem, and the conformance study is explicitly labeled as conformance rather than independent validation.

full rationale

SAGE-Fin's central formal claim (Theorem 1, Section 6.3) is derived from Assumption 1 and Definition 7: 'every governed effect event e_t has an earlier trusted issuance event for an accepted-type receipt whose candidate, exact artifact, subject, scope, cap, policy, time, and state bindings hold at t, with no blocking debt.' The proof sketch applies Gate_g and reads off the receipt conditions. This is a standard soundness argument for an enforcement mechanism, not a circular prediction: the gate predicate is the mechanism, and the theorem states the property it guarantees. The paper explicitly scopes the result to the trust boundary: 'Assumption 1: ... The compiler, registries, witness providers, clocks, state feeds, hash bindings, and internal receipt issuer are trusted.' The 616-case evaluation is likewise carefully disclaimed: 'Because rules and labels are authored together, this is conformance rather than independent safety accuracy,' and 'The full row is zero by construction against its own rejection set.' Table 6 is presented as a mechanism contrast, not as an independent benchmark. The deployment evidence is qualitative, explicitly labeled as such, and organizationally independent of the implementers; no aggregate effect estimate is claimed. The self-citation to CBEA+LCV [24] is used only for positioning, and the paper states its language-control proxy 'does not reproduce the CBEA selector or full LCV pipeline.' The main untested link is the deterministic compiler Γ on raw natural language, but the paper lists this under limitations ('Inputs that Γ cannot parse fail closed, while incomplete compiled inputs surface as coverage debt') and does not claim an empirical evaluation of Γ on raw adversarial inputs; a validation gap is not circularity. No step in the paper's derivation chain is equivalent to its inputs by construction in a way that is presented as an independent result.

Assumptions & free parameters 3 free parameters · 5 assumptions · 3 invented entities

The formal core introduces no fitted parameters: the authority lattice and gate definitions are generic. The listed free parameters are example-instantiation settings for the optional HMM regime witness and witness-freshness horizons; they are chosen by hand but do not enter the central soundness results. The main load-bearing premises are Assumption 1 (complete mediation and trusted components), the declared contractive coverage term, and the acceptance-set design; all are explicitly stated in the paper.

free parameters (3)

HMM regime thresholds θ_S, θ_I, θ_H = not specified
Hand-chosen thresholds for stress, illiquidity, and entropy contraction in the optional regime witness; they are demonstration constants, not fitted to support the central authority result.
HMM learning settings (rolling window W_t, Baum-Welch initialization) = not specified
Estimation choices local to the witness provider; the paper explicitly says the HMM is evaluated only by gate behavior on stored regime states, not by regime-estimation accuracy.
Freshness horizons per witness type (chain status seconds, fee schedules minutes, etc.) = not specified
Example-instance design choices for the witness registry; they define the demonstration catalog but do not enter the generic formal soundness results.

assumptions (5)

domain assumption Assumption 1: complete mediation and trusted compiler, registries, witness providers, clocks, state feeds, hash bindings, and receipt issuer
Stated in Section 6.3; all soundness theorems are conditional on it. If any of these components is compromised or buggy, the guarantees fail.
ad hoc to paper Coverage term is contractive in coverage debt (declared contract)
Proposition 1 proof relies on 'the declared contract of the coverage term'; monotonicity of authority in debt is assumed by design, not derived from independent principles.
domain assumption Gate_g acceptance sets define the only path to governed effects
Theorems 1 through 5 are proven from Definition 7; the acceptance sets Accept(exec) = {execAuth}, etc., are design choices that make the results true by construction.
domain assumption Unparseable or incomplete compiler inputs fail closed
Section 7.2 and Limitations state that inputs Γ cannot parse are rejected; the paper provides no adversarial robustness evaluation of Γ against natural-language attacks.
domain assumption HMM label stability via declared state-order constraints and overlap-window alignment
Section 7.1.1; used to keep regime labels stable across refits, but the paper does not validate this assumption empirically.

invented entities (3)

Coverage debt (D_t)
purpose: Represents missing, stale, unpromoted, or invalid witnesses and validators as explicit runtime state that contracts authority
A new conceptual object introduced by SAGE-Fin; validated only through self-authored catalog conformance, no independent public implementation or benchmark.
Non-substitutable adapter receipt types (commit, execAuth, deploy)
purpose: Bind authority to exact artifacts and prevent progress receipts from authorizing effects
Design artifact; the deployment evidence is qualitative and confidential, so there is no independent falsifiable handle outside this paper.
Authority semilattice (A_g, ⪯_g, ∧_g, ⊤_g)
purpose: Formal ordering of adapter-specific authority caps
A mathematical structure introduced for the formalization; it is standard order-theoretic content, and no independent empirical evidence is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Context Is Not Authority: Structured Runtime Governance for Financial Market Agents." pith.science (2026). https://pith.science/paper/PHF3DW2D

@misc{pith2026260809025,
  author       = {Pith},
  title        = {Pith review of: Context Is Not Authority: Structured Runtime Governance for Financial Market Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PHF3DW2D}},
  note         = {Machine review of arXiv:2608.09025}
}

read the original abstract

Financial agents can turn correct context into an unauthorized effect: a customer-facing commitment, trade, or deployed policy. We present SAGE-Fin, a finance-specific authority-handoff contract that makes the proposed effect, not merely its text, the object of runtime control. SAGE-Fin compiles proposals into typed, adapter-bound candidates; records missing or stale institutional obligations as coverage debt; contracts authority under current market, account, policy, and dialogue state; and requires an exact-artifact receipt whose nominal type matches the consuming response, execution, or policy adapter. Evidence and workflow progress cannot substitute for effect authority, and prior authorization is rechecked after state changes. Across an authored 616-case catalog, five deterministic specifications yield 3,080 outputs; a label-isolated harness obtains 616/616 binary reference-prototype parity, including 3/3 named response-gate fixtures, while 22 tests cover selected paths. These results establish executable conformance, not independent safety accuracy. Separately, SAGE-Fin's response gate processed real customer-facing production requests at a confidential digital-asset platform. An operational team independent of the implementation team reached a strongly positive post-deployment conclusion on practical usefulness and workflow fit, and end-user feedback was also strongly positive. Disclosure permits only the review's independence, stakeholder classes, assessed dimensions, and directional conclusion, so this is qualitative field corroboration rather than an aggregate effect estimate. Three distinct de-identified predecessor failures, with independently confirmed 0/3 interception, ground repeated-emission drift, stale account evidence, and missing escalation state without estimating prevalence or treatment effect.

Figures

Figures reproduced from arXiv: 2608.09025 by the authors.

Discussion (0). Continue with ORCID to comment.

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.