Pith. sign in

REVIEW 3 major objections 5 minor 28 references

Specifying agentic AI requires deciding not only what it should produce but what it may do, under whose authority, and when control returns to a human.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 18:37 UTC pith:4LVPJAE2

load-bearing objection A useful, clearly-written RE vision for agentic systems; the AJR/ADP artifacts are a real contribution, but the 'central missing object' claim is a framing choice, not a demonstrated fact. the 3 major comments →

arxiv 2607.17225 v1 pith:4LVPJAE2 submitted 2026-07-19 cs.SE cs.AI

Specifying the Delegated-Autonomy Boundary: Requirements Engineering for Agentic AI

Chetan Arora , Andreas Vogelsang , Abbi Sharma This is my paper
classification cs.SE cs.AI
keywords requirements engineeringagentic AIdelegated autonomyAI agentsautonomy boundaryAgency Justification RecordAgentic Delegation Policygraduated authority
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Agentic AI systems plan, keep state, and act across external systems, so the requirements question is no longer just 'what should the system output?' but 'what may the system do, to what resources, under whose authority, and when does control return to a human?' The paper names this set of decisions the delegated-autonomy boundary and argues it is the central missing object in current requirements-engineering practice, since today these commitments are buried in prompts, tool schemas, and runtime policies. To make the boundary explicit, the paper proposes two artifacts: an Agency Justification Record (AJR), a six-criterion gate that forces teams to justify an agentic architecture against simpler alternatives before building it, and an Agentic Delegation Policy (ADP), a six-dimension specification covering purpose, graduated authority, information and memory, coordination, assurance, and evolution. If the proposal is right, agentic systems would be developed against reviewable, testable delegation terms instead of ad hoc prompt tinkering, and rejected agent proposals would leave a documented rationale. A safety-critical discharge agent clears the gate while a code-review agent is rejected, illustrating that the gate's rejection path is as important as its acceptance path.

Core claim

The paper establishes a new requirements-engineering problem: when software becomes an agent, requirements must cover not just behavior but the scope, graduation, and governance of delegated action. The authors call this the delegated-autonomy boundary and claim it has been overlooked as a first-class RE concern. They operationalize it with two artifacts. The AJR is a pre-architecture decision record with six criteria—open-ended task structure, unstructured context, cross-system actions, evaluable progress, bounded risk, and advantage over baselines—plus anti-criteria that disqualify agency. The ADP is a specification artifact with six policy dimensions, the core of which is a three-tier aut

What carries the argument

The central mechanism is the delegated-autonomy boundary, defined as the set of decisions about what may be delegated to an agent, under what graduated authority, with what oversight, and how control is returned. It is carried by two artifacts. The Agency Justification Record (AJR) operationalizes the principle of minimal justified autonomy: six criteria that a task should mostly satisfy before an agent is warranted, plus anti-criteria that veto agency outright. The Agentic Delegation Policy (ADP) specifies the boundary across six dimensions: purpose, authority, information and memory, coordination, assurance, and evolution. The load-bearing structure inside the ADP is the three-tier authori

Load-bearing premise

The claim rests on the assumption that the AJR and ADP artifacts, built from two senior practitioners and two worked examples, are a sufficiently complete and correctly calibrated characterisation of delegated-autonomy requirements; if that set is incomplete or mis-weighted, the artifacts could legitimise unsafe agents or reject useful ones.

What would settle it

Inspect a corpus of deployed or failed agentic systems: if any system that caused harm had a fully specified ADP yet the harmful action fell outside all six ADP dimensions and all three authority tiers, the completeness claim fails. A controlled study would do the same prospectively: teams using the artifacts to specify real agents would be checked for whether the artifacts force out the decisions that actually matter; any dimension practitioners must add ad hoc would falsify the claim that the boundary is captured.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A rejected AJR records why a simpler architecture was chosen, so unjustified agentic complexity is blocked before implementation, and the rejection rationale becomes part of the design history.
  • ADP stop conditions make 'keep trying' an explicit requirements decision, so runaway behavior caused by implicit persistence becomes preventable.
  • The three authority tiers can be compiled into executable guards: tool permission lists, human-approval gates, and hard prohibitions enforced by runtime monitors.
  • ADP dimensions give a basis for requirements-derived testing, targeting tier-boundary violations, provenance gaps, and escalation failures.
  • In regulated domains, documenting the delegation boundary before deployment makes auditability and compliance a requirements obligation rather than an afterthought.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The AJR's advantage-over-baseline threshold points toward a natural acceptance test the paper does not fully develop: if a deployed agent fails to meet its precommitted improvement threshold, the specification itself says the agent should be reverted to the simpler baseline.
  • The three-tier authority model could let regulators classify any agent deployment by its highest permitted tier, providing a fast risk signal with no further analysis.
  • The paper's rejection of multi-agent architectures 'for conceptual neatness' suggests a testable extension: measure whether multi-agent decompositions actually reduce coordination cost or just add handoff overhead.
  • If the delegated-autonomy boundary becomes central, requirements documents for agentic systems will need to be living artifacts, updated whenever models, tools, or escalation rules change, making evolution policy a continuous compliance burden.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper argues that agentic AI systems introduce a requirements engineering (RE) problem distinct from conventional or ML-based systems: the specification of a `delegated-autonomy boundary`, i.e., what may be delegated to an agent, under what graduated authority, with what oversight, and when control returns to a human. To address this, it proposes two artifacts: an Agency Justification Record (AJR), which gates agentic architecture choices against simpler alternatives using six criteria and anti-criteria; and an Agentic Delegation Policy (ADP), which specifies six dimensions (purpose, authority, information/memory, coordination, assurance, evolution) with a three-tier authority model. The framework is illustrated with two worked examples: a hospital discharge coordination agent and an automated code review agent. The paper closes with four research directions and explicitly lists empirical validation as future work.

Significance. If the delegated-autonomy boundary is indeed a missing object in current RE practice, the proposed AJR and ADP would be a useful, actionable contribution: they operationalize minimal justified autonomy, provide a structured way to record authority tiers, memory scope, and stop conditions, and connect requirements-level commitments to runtime-enforceable artifacts. The paper's strengths are its clear scoping, the graduated-authority model, the concrete worked examples, and the explicit limitation statement pointing to the need for empirical validation. However, the central claim that this boundary is `the central missing object in current RE practice` is not demonstrated; the evidence base is one consultation with two senior practitioners plus an interpretation of disclosure statistics. The artifacts are therefore better characterized as a well-motivated proposal than as a validated solution to an established gap. For a NIER-style contribution, this is acceptable as a starting point, but the paper should either soften the universal claim or substantially expand the evidence.

major comments (3)
  1. [§1 (Introduction) and Limitations] The paper's load-bearing claim, that the delegated-autonomy boundary is `the central missing object in current RE practice`, is asserted rather than established. The support cited is consultation with two senior practitioners and a small number of secondary sources; the Limitations section itself concedes that `empirical validation on real-world agentic systems is the immediate next step`. With only two informants, there is no saturation, representativeness, or inter-rater evidence for the six AJR criteria, six ADP dimensions, or three authority tiers. Since the novelty and significance of the artifacts rest on this gap, I recommend reframing the claim as a hypothesis or adding a systematic comparison with existing artifacts that may already capture parts of the boundary under other names (e.g., security/authorization requirements, policy-as-code, architecture decision records, Kubernete
  2. [§3, Assurance policy and R3] The citation of the 2025 AI Agent Index (25/30 deployed agents disclose no internal safety evaluations; 23/30 have no third-party testing) is used to argue for an `industry-wide absence of verifiable, requirements-level safety commitments`. The paper already acknowledges in R3 that non-disclosure does not imply absence of internal testing, but then draws the stronger conclusion anyway. This is a subtle but important slippage: the data support a disclosure/verifiability gap, not necessarily a specification gap. Since the latter is central to the paper's motivation, the argument should distinguish the two explicitly and, if only a verifiability gap is supported, adjust the wording of the central claim accordingly.
  3. [§4 / Limitations] The research directions are framed as if the AJR and ADP are accepted starting points, but the paper does not compare the ADP dimensions against prior work on authorization policies, safety contracts, or agent governance (e.g., OAuth scopes, safety cases, or operational design domains for autonomous vehicles). Without such a comparison, it is hard for a reader to judge whether the six dimensions are genuinely new, a re-labeling of existing concerns, or a subset. I recommend adding a short related-work paragraph that positions the ADP against security/authorization RE and policy artifacts, since this materially affects the claim of novelty. This can be addressed without new experiments, but it changes the strength of the contribution story.
minor comments (5)
  1. [Table 2 and surrounding text] The code review agent is explicitly rejected by the AJR, yet Table 2 still provides a full illustrative ADP for it. The text notes this is for illustration, but the table caption could be clearer, e.g., `Illustrative ADP shown for both examples; in practice a rejected AJR would not proceed to ADP.`
  2. [Table 1, row C6] The code-review entry for C6 reads `Comment turnaround vs existing pipeline >90 days; threshold but little projected gain to justify agentic overhead`. The `>90 days` appears to refer to the baseline pipeline turnaround, but the phrasing is ambiguous. Please clarify what the baseline is and what the proposed threshold is.
  3. [§1, Introduction] The phrase `each with at least more than ten years of industry experience` is redundant; `at least ten years` or `more than ten years` suffices.
  4. [§2, AJR criteria] Criterion 2's parenthetical about team-level decisions for semi-structured contexts is vague. Consider giving a concrete example or removing the parenthetical, as it currently reads as an escape clause rather than a decision criterion.
  5. [§4, R4] The sentence `Do they update them after incidents?` is a quoted example of an empirical question but is punctuated as a sentence fragment. It should be integrated into the surrounding text or turned into a proper non-quoted question.

Circularity Check

0 steps flagged

No circular derivation: AJR and ADP are proposed artifacts with illustrative examples, not results derived from their own conclusions.

full rationale

The paper makes no parameter-fitting, self-referential derivation, or construction-level reduction. The AJR criteria and ADP dimensions are presented as normative proposals grounded in practitioner consultation and cited industry guidance, and then illustrated on two worked examples; nothing is 'predicted' from a fitted input. The central assertion that the delegated-autonomy boundary is 'the central missing object in current RE practice' is an empirical framing, and the paper itself acknowledges its evidence base is limited: the artifacts 'were developed in consultation with two senior practitioners' and the Limitations section states that 'empirical validation on real-world agentic systems is the immediate next step.' The AI Agent Index statistics are used as motivating context, with the paper explicitly conceding in R3 that non-disclosure of safety evaluations does not imply their complete absence. Self-citations to prior RE surveys and testing reviews are background support, not load-bearing derivations from the authors' own results. Therefore, whatever the strength of the gap claim, there is no circularity in the paper's reasoning.

Axiom & Free-Parameter Ledger

0 free parameters · 3 axioms · 3 invented entities

The paper is a conceptual proposal with no numerical fits and no empirical validation. Its load-bearing assumptions are domain assumptions about current practice and about the adequacy of the proposed artifact set. The three 'invented entities' are design artifacts/concepts, not physical entities; they currently lack independent empirical evidence.

axioms (3)
  • domain assumption The delegated-autonomy boundary is currently under-specified in practice and is a first-class requirements concern.
    Asserted in Section 1 with anecdotal urgency and citations to practitioner guidance, but no empirical study of industry practice is presented.
  • ad hoc to paper The six AJR criteria, six ADP dimensions, and three-tier authority structure are sufficient to capture the specification needs of agentic systems.
    Nominated by the authors based on consultation with two senior practitioners; no validation that the set is complete, minimal, or correctly calibrated.
  • domain assumption Externalizing authority, memory, and coordination decisions from prompts and tool schemas into policy artifacts improves auditability and governability.
    The paper assumes this improves practice, but it is not tested; the Limitations section states empirical validation is the immediate next step.
invented entities (3)
  • Delegated-autonomy boundary no independent evidence
    purpose: First-class requirements object capturing what may be delegated, under what authority, with what oversight, and how control returns.
    Newly named concept; no empirical validation that naming it improves RE practice.
  • Agency Justification Record (AJR) no independent evidence
    purpose: Gate artifact to justify an agentic architecture against simpler alternatives.
    Proposed as a new artifact, illustrated on two examples; no external validation.
  • Agentic Delegation Policy (ADP) no independent evidence
    purpose: Specification artifact covering purpose, graduated authority, information, coordination, assurance, and evolution.
    Proposed as a new artifact, illustrated on two examples; no external validation.

pith-pipeline@v1.3.0-alltime-deepseek · 7657 in / 10379 out tokens · 95303 ms · 2026-08-01T18:37:52.818094+00:00 · methodology

0 comments
read the original abstract

Agentic AI systems do not just predict or recommend; they plan, maintain state, and act in external environments with varying degrees of autonomy. This changes the requirements engineering problem in a specific and under-addressed way: it introduces what we call the delegated-autonomy boundary -- the set of decisions about what may be delegated to the system, under what graduated authority, with what oversight, and how control is returned. Current practices bury these decisions inside prompts, tool schemas, and runtime policies, even though they are requirements-level commitments. This paper proposes two complementary artifacts. First, an Agency Justification Record (AJR) helps teams decide when an agent is warranted over simpler alternatives. Second, an Agentic Delegation Policy (ADP) captures what must be specified for safe and effective development: purpose, authority, information, coordination, assurance, and evolution. Crucially, authority in the ADP is modelled as graduated, i.e., a tiered structure. We illustrate the framework with two contrasting examples: a safety-critical hospital discharge coordination agent and an automated code review agent.

Figures

Figures reproduced from arXiv: 2607.17225 by Abbi Sharma, Andreas Vogelsang, Chetan Arora.

Figure 1
Figure 1. Figure 1: RE for Agentic AI Overview 3 What Must Be Specified: the ADP If AJR justifies an agent, we extend conventional RE artifacts with an Agentic Delegation Policy (ADP). We favour“policy” overcontract because requirements alone cannot enforce mutual obligations; a policy defines delegation terms while keeping accountability an organisational concern. The ADP is distributed across prompts, schemas, policy engine… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

28 extracted references · 2 canonical work pages

  1. [1]

    Health Insurance Portability and Accountability Act of 1996

    1996. Health Insurance Portability and Accountability Act of 1996. Public Law 104-191, 110 Stat. 1936. https://hhs.gov

    1996

  2. [2]

    Khlood Ahmad, Mohamed Abdelrazek, Chetan Arora, Muneera Bano, and John Grundy. 2023. Requirements engineering for artificial intelligence systems: A systematic mapping study.Information and Software Technology158 (2023), 107176. https://doi.org/10.1016/j.infsof.2023.107176

    arXiv 2023

  3. [3]

    Anthropic. 2024. Building effective agents. Anthropic Research. https://www. anthropic.com/research/building-effective-agents Accessed: 2026-04-27

    2024

  4. [4]

    Anthropic. 2025. Our framework for developing safe and trustworthy agents. Anthropic News. https://www.anthropic.com/news/our-framework-for- developing-safe-and-trustworthy-agents Accessed: 2026-04-27

    2025

  5. [5]

    Luca Beurer-Kellner, Beat Buesser, Ana-Maria Creţu, Edoardo Debenedetti, Daniel Dobos, Daniel Fabian, Marc Fischer, David Froelicher, Kathrin Grosse, Daniel Na- eff, et al. 2025. Design patterns for securing llm agents against prompt injections. arXiv preprint arXiv:2506.08837(2025)

    Pith/arXiv arXiv 2025

  6. [6]

    Umm e Habiba, Markus Haug, Justus Bogner, and Stefan Wagner. 2024. How mature is requirements engineering for AI-based systems? A systematic mapping study on practices, challenges, and future research directions.Requirements Engineering29, 4 (2024), 567–600. https://doi.org/10.1007/s00766-024-00432-3

    work page doi:10.1007/s00766-024-00432-3 2024

  7. [7]

    Ahmed E Hassan, Hao Li, Dayi Lin, Bram Adams, Tse-Hsun Chen, Yutaro Kashiwa, and Dong Qiu. 2025. Agentic software engineering: Foundational pillars and a research roadmap.arXiv preprint arXiv:2509.06216(2025)

    Pith/arXiv arXiv 2025

  8. [8]

    Andreas Holzinger, Kurt Zatloukal, and Heimo Müller. 2025. Is human oversight to AI systems still possible? , 59–62 pages

    2025

  9. [9]

    Kaicheng Huang, Fanyu Wang, Yutan Huang, and Chetan Arora. 2025. Prompt engineering for requirements engineering: A literature review and roadmap. In2025 IEEE 33rd International Requirements Engineering Conference Workshops (REW). IEEE, 548–557

    2025

  10. [10]

    Yutan Huang, Chetan Arora, Wen Cheng Huong, Tanjila Kanij, Anuradha Madugalla, and John Grundy. 2026. Ethical concerns of generative AI and miti- gation strategies: A systematic mapping study.Applied Soft Computing(2026), 114789

    2026

  11. [11]

    Luca Nannini, Adam Leon Smith, Michele Joshua Maggini, Enrico Panai, San- dra Feliciano, Aleksandr Tiulkanov, Elena Maran, James Gealy, and Piercosma Bisconti. 2026. AI agents under EU law.arXiv preprint arXiv:2604.04604(2026)

    Pith/arXiv arXiv 2026

  12. [12]

    Michael T. Nygard. 2011. Documenting Architecture Decisions. https://cognitect. com/blog/2011/11/15/documenting-architecture-decisions

    2011

  13. [13]

    2023.Artificial Intelligence Risk Management Framework (AI RMF 1.0)

    National Institute of Standards and Technology. 2023.Artificial Intelligence Risk Management Framework (AI RMF 1.0). Technical Report. U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1

    doi:10.6028/nist.ai.100-1 2023

  14. [14]

    2024.Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile

    National Institute of Standards and Technology. 2024.Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. Technical Report. U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.600-1

    doi:10.6028/nist.ai.600-1 2024

  15. [15]

    OpenAI. 2025. A practical guide to building agents. OpenAI Developers. https: //platform.openai.com/docs/guides/agents Accessed: 2026-04-27

    2025

  16. [16]

    OWASP Foundation. 2025. LLM Prompt Injection Prevention Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_ Prevention_Cheat_Sheet.html Accessed: 2026-04-27

    2025

  17. [17]

    Chanjin Park. 2026. Agentic Problem Frames: A Systematic Approach to Engi- neering Reliable Domain Agents.arXiv preprint arXiv:2602.19065(2026)

    arXiv 2026

  18. [18]

    Krishna Ronanki. 2025. Facilitating Trustworthy Human-Agent Collaboration in LLM-based Multi-Agent System oriented Software Engineering. InProceedings of the 33rd ACM International Conference on the Foundations of Software Engineering. 1333–1337

    2025

  19. [19]

    Leon Staufer, Kevin Feng, Kevin Wei, Luke Bailey, Yawen Duan, Mick Yang, A Pinar Ozisik, Stephen Casper, and Noam Kolt. 2026. The 2025 AI Agent Index: Documenting Technical and Safety Features of Deployed Agentic AI Systems. arXiv preprint arXiv:2602.17753(2026)

    Pith/arXiv arXiv 2026

  20. [20]

    Yongjian Tang and Thomas Runkler. 2026. LLM-Based Agentic Systems for Soft- ware Engineering: Challenges and Opportunities.arXiv preprint arXiv:2601.09822 (2026)

    Pith/arXiv arXiv 2026

  21. [21]

    Karthik Vaidhyanathan and Henry Muccini. 2025. Software Architecture in the Age of Agentic AI. InSoftware Architecture. Lecture Notes in Computer Science, Vol. 15982. Springer, 57–71. https://doi.org/10.1007/978-3-032-04403-7_5

    work page doi:10.1007/978-3-032-04403-7_5 2025

  22. [22]

    van Lamsweerde

    A. van Lamsweerde. 2001. Goal-oriented requirements engineering: a guided tour. InProceedings Fifth IEEE International Symposium on Requirements Engineering. 249–262. https://doi.org/10.1109/ISRE.2001.948567

    arXiv 2001

  23. [23]

    2009.Requirements engineering: From system goals to UML models to software

    Axel Van Lamsweerde. 2009.Requirements engineering: From system goals to UML models to software. Vol. 10. Chichester, UK: John Wiley & Sons

    2009

  24. [24]

    Andreas Vogelsang and Markus Borg. 2019. Requirements engineering for ma- chine learning: Perspectives from data scientists. In2019 IEEE 27th international requirements engineering conference workshops (REW). IEEE, 245–251

    2019

  25. [25]

    Fanyu Wang, Chetan Arora, Chakkrit Tantithamthavorn, Kaicheng Huang, and Aldeida Aleti. 2026. Requirements-driven automated software testing: A sys- tematic review.ACM Transactions on Software Engineering and Methodology (2026)

    2026

  26. [26]

    Yanlin Wang, Wanjun Zhong, Yanxian Huang, Ensheng Shi, Min Yang, Jiachi Chen, Hui Li, Yuchi Ma, Qianxiang Wang, and Zibin Zheng. 2025. Agents in soft- ware engineering: survey, landscape, and vision.Automated Software Engineering 32 (2025), 70. https://doi.org/10.1007/s10515-025-00544-2

    doi:10.1007/s10515-025-00544-2 2025

  27. [27]

    Jon Whittle, Pete Sawyer, Nelly Bencomo, Betty H. C. Cheng, and Jean-Michel Bruel. 2010. RELAX: a language to address uncertainty in self-adaptive systems requirement.Requirements Engineering15, 2 (2010), 177–196. https://doi.org/10. 1007/s00766-010-0101-0

    2010

  28. [28]

    Eric SK Yu. 1997. Towards modelling and reasoning support for early-phase requirements engineering. InProceedings of ISRE’97: 3rd IEEE International Sym- posium on Requirements Engineering. IEEE, 226–235

    1997