PaperlayerView exact revision on arXiv

Source-linked AI summary

Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents

Varun Pratap Bhardwaj

arXiv:2602.22302v1cs.AIcs.MAcs.SE

TL;DR

AI agents are governed by prompts rather than formal behavioral specifications. This paper introduces Agent Behavioral Contracts to specify and enforce agent behavior; across models, contracted agents detected 5.2–6.8 soft violations per session that uncontracted agents missed.

  • Problem

    AI agents are governed by prompts without formal semantics or verifiable guarantees, unlike traditional software systems with specification tooling.

    Source: The Problem · p. 2

  • Method

    Agent Behavioral Contracts specify preconditions, hard and soft invariants, governance policies, and recovery, with probabilistic satisfaction accounting for LLM non-determinism.

    Source: §9 · p. 51

  • Results

    Across models, contracted agents detected 5.2–6.8 soft violations per session that uncontracted agents missed and achieved 88%–100% hard compliance.

    Source: §9 · p. 52

  • Takeaways & Limitations

    When recovery rate γ exceeds natural drift rate α, contract enforcement bounds expected drift to D*=α/γ.

    Source: §9 · p. 52

    The composition bound assumes conditional independence, which shared underlying LLMs can violate, potentially lowering end-to-end reliability below the product of per-agent reliabilities.

    Source: §8.2 · p. 48

Abstract

from arXiv · show

Traditional software relies on contracts -- APIs, type systems, assertions -- to specify and enforce correct behavior. AI agents, by contrast, operate on prompts and natural language instructions with no formal behavioral specification. This gap is the root cause of drift, governance failures, and frequent project failures in agentic AI deployments. We introduce Agent Behavioral Contracts (ABC), a formal framework that brings Design-by-Contract principles to autonomous AI agents. An ABC contract C = (P, I, G, R) specifies Preconditions, Invariants, Governance policies, and Recovery mechanisms as first-class, runtime-enforceable components. We define (p, delta, k)-satisfaction -- a probabilistic notion of contract compliance that accounts for LLM non-determinism and recovery -- and prove a Drift Bounds Theorem showing that contracts with recovery rate gamma > alpha (the natural drift rate) bound behavioral drift to D* = alpha/gamma in expectation, with Gaussian concentration in the stochastic setting. We establish sufficient conditions for safe contract composition in multi-agent chains and derive probabilistic degradation bounds. We implement ABC in AgentAssert, a runtime enforcement library, and evaluate on AgentContract-Bench, a benchmark of 200 scenarios across 7 models from 6 vendors. Results across 1,980 sessions show that contracted agents detect 5.2-6.8 soft violations per session that uncontracted baselines miss entirely (p < 0.0001, Cohen's d = 6.7-33.8), achieve 88-100% hard constraint compliance, and bound behavioral drift to D* < 0.27 across extended sessions, with 100% recovery for frontier models and 17-100% across all models, at overhead < 10 ms per action.

1 Introduction

The introduction identifies the absence of formal, enforceable behavioral guarantees for autonomous agents and presents Agent Behavioral Contracts as a framework for specifying, monitoring, and recovering from deviations. It previews theoretical guarantees, implementation tools, and benchmark results.

The Problem

  • Agents lack formal behavioral guarantees, and prompt-governed behavior can drift or violate governance; the self-evolution trilemma [Wang et al., 2026a] strengthens the case for active runtime enforcement.The paper contrasts prompt-based instructions with traditional software contracts such as type systems and assertions [Hoare, 1969, Meyer, 1992].Source: §1 · p. 1, The Problem · p. 2

Our Contribution

  • ABC defines contracts C = (P, I, G, R) with preconditions, hard and soft invariants and governance policies, and recovery; (p, δ, k)-satisfaction captures probabilistic compliance, tolerance, and recovery timing.Satisfaction accounts for LLM non-determinism: compliance probability is at least p, deviations remain within δ, and recovery occurs within k steps.Source: Our Contribution · p. 2
  • When recovery rate γ exceeds natural drift rate α, the Stochastic Drift Bound Theorem bounds expected drift to D*=α/γ, with Gaussian concentration and a closed-form contract design criterion.The result uses Lyapunov stability analysis of an Ornstein–Uhlenbeck drift model.Source: Our Contribution · p. 3
  • ContractSpec provides YAML-based contract specification and file-reference composition, AgentAssert enforces ABC at under 10 ms per action, and AgentContract-Bench covers 200 scenarios across 7 domains and 6 stress profiles.ContractSpec supports hard/soft constraint separation and expression-based predicates.Source: Our Contribution · p. 3
  • ABC contracts compose into end-to-end multi-agent chain guarantees under interface compatibility, assumption discharge, governance consistency, and recovery independence, with quantified probabilistic degradation bounds.These are the sufficient conditions established by the Compositionality Theorem.Source: Our Contribution · p. 3
  • Across 1,980 sessions on 7 models from 6 vendors, contracted agents detected 5.2–6.8 soft violations per session missed by baselines, bounded drift to D*<0.27, achieved 17–100% recovery, and had reliability Θ > 0.90 across all models.The evaluation covered AgentContract-Bench (Section 7).Source: Our Contribution · p. 3

2 Background and Related Work

ABC extends ideas from software contracts, cyber-physical systems, runtime verification, and agent safety into proactive behavioral contracts for autonomous sessions. The related work positions ABC as unifying formal behavioral specification, probabilistic guarantees, drift detection, compositionality, and runtime enforcement.

2.1 Design by Contract

  • Design-by-Contract formalizes component obligations as preconditions, postconditions, and invariants, while ABC extends this tradition from individual LLM calls to autonomous sessions.Earlier DbC implementations include JML for Java and Spec# for C#; Leoveanu-Condrei [2025] addresses single LLM invocations, not session drift, recovery, governance, or multi-agent composition.Source: §2.1 · pp. 3–4

2.2 Contract Theory for Cyber-Physical Systems

  • CPS contract theory contributes assume-guarantee composition and probabilistic reasoning, while ABC adapts contracts to language, tool-use, and semantic state under LLM non-determinism.ABC also complements Ye and Tan [2026]: their resource contracts bound consumption, whereas ABC’s behavioral contracts bound actions and outputs; the frameworks could be composed.Source: §2.2 · p. 4

2.3 Runtime Monitoring and Verification

  • ABC evaluates contract predicates at each action without requiring the formal environment model needed for synthesized shields, and differs from VeriGuard and StepShield through specification-first contracts and drift-based preemptive intervention.Runtime verification provides online monitoring foundations; StepShield measures the timing of violation detection, while ABC detects drift as a leading indicator before violations materialize.Source: §2.3 · p. 5

2.4 AI Agent Safety and Governance

  • Training-time alignment complements ABC by improving baseline behavior, while NeMo Guardrails and Guardrails AI filter individual responses rather than enforce session-level contracts or detect multi-turn drift.The passage says these approaches do not provide formal runtime compliance guarantees or recovery mechanisms.Source: §2.4 · p. 5
  • AgentSpec, Pro2Guard, and Agent-C lack different combinations of ABC’s probabilistic guarantees, drift modeling, compositionality, or session-wide contract scope; AIR addresses incidents reactively, while AGENTSAFE and POLARIS provide higher-level governance.Pro2Guard learns from observed traces, whereas ABC specifies behavioral expectations before deployment; AIR could serve as an escalation layer when ABC recovery is exhausted.Source: §2.4 · p. 6

2.5 Agent Behavioral Drift

  • Prior work identifies measurable behavioral degradation over extended interactions, while ABC adapts concept drift to agent behavior using compliance gaps and Jensen–Shannon divergence.Impossibility results motivate continuous runtime enforcement, and findings that text-level safety does not transfer to tool-call safety support contracts operating at the action level.Source: §2.5 · pp. 6–7

2.6 Positioning ABC

  • ABC is presented as the only framework combining formal behavioral contracts, probabilistic compliance guarantees, drift detection, a specification DSL, multi-agent compositionality, and runtime enforcement.The authors identify AgentSpec, Pro2Guard, Agent-C, VeriGuard, and Ye and Tan [2026] as close works along individual dimensions, but say none combines ABC’s proactive specification, bounded drift, compositionality, DSL, and runtime library.Source: §2.6 · p. 7, Table 1 · p. 7

3 The ABC Framework

The ABC framework formalizes agent behavior by distinguishing hard constraints from recoverable soft violations and emerging drift from observed compliance failures. It also provides operational metrics for recovery, stress resilience, and overall reliability.

3.1 Contract Structure

  • ABC contracts specify initial-state preconditions, hard state and action constraints, soft state and action constraints, and corrective actions for soft violations.Recovery actions have a maximum length; if no automated recovery is available, the monitor emits a RecoveryFailed event and defers to external intervention.Source: §3.1 · p. 8

3.2 Contract Satisfaction (Deterministic)

  • Deterministic satisfaction requires valid preconditions, invariant and governance compliance across the trace, and recovery of every soft violation within k steps, but is too stringent for stochastic LLM outputs.The framework therefore treats deterministic satisfaction as a baseline before introducing probabilistic guarantees.Source: §3.2 · p. 9

3.3 Probabilistic (p, δ, k)-Satisfaction

  • The (p, δ, k)-satisfaction definition requires high-probability persistent hard compliance and recoverable soft compliance, making k a first-class bounded recovery horizon.The recovery window quantifies how long a transient deviation may persist before it becomes a reportable failure.Source: §3.3 · pp. 9–10

3.4 Recovery Transforms Exponential Decay to Linear Decay

  • 0.95 recoverable-compliance bound versus 0.366 sustained-compliance probability without recovery is shown for q = 0.99, T = 100, and r = 0.95.The lemma characterizes recovery as converting exponential compliance decay into linear decay.Source: §3.4 · pp. 11–12

3.5 Behavioral Drift Score

  • The behavioral drift score combines constraint-compliance gaps with Jensen–Shannon divergence from a calibrated reference action distribution to signal emerging misalignment.When the action vocabulary is sparse, distributional estimates may be noisy; practitioners can increase the observation window or emphasize compliance in the component weights.Source: §3.5 · pp. 12–13
  • Distributional drift is a leading indicator of action-pattern shifts, while compliance drift is a lagging indicator that registers only after a constraint violation.Distributional shifts can warn of increased hedging, atypical tool use, or topic drift before explicit violations occur.Source: §3.5 · p. 13
  • The diagnostic decomposition vector separates precondition, invariant, and governance compliance gaps from distributional drift to guide targeted remediation.It helps operators identify whether drift stems from invariant violations, governance breaches, or distributional shift.Source: §3.5 · p. 13

3.6 Additional Operational Metrics

  • Recovery effectiveness accounts for the steps needed to restore compliance and violation severity; lower values indicate more effective recovery.Session-level recovery effectiveness averages across violation events.Source: §3.6 · p. 14
  • The stress resilience index measures compliance under stressed versus baseline sessions: S = 1 indicates no degradation, while S < 1 quantifies a stress penalty.Source: §3.6 · p. 14
  • The agent reliability index Θ combines session-averaged compliance and drift, recovery effectiveness, and stress resilience into an application-weighted score from 0 to 1.Weights sum to 1 and are application-specific; enterprise deployments typically prioritize compliance, then drift stability, recovery efficiency, and stress resilience.Source: §3.6 · p. 14

4 Drift Prevention via Contracts

The section models behavioral drift as a stochastic process and derives bounds for drift under enforcement. It also establishes conditions for composing contracts across agents and analyzes the cost of runtime checking.

4.1 Drift Dynamics Model

  • Drift combines natural deviation at rate α, contract recovery proportional to current drift at rate γ, and stochastic perturbations from LLM non-determinism.The recovery rate is controlled by invariant-checking frequency and recovery-policy aggressiveness; σ quantifies irreducible output noise.Source: §4.1 · pp. 14–15

4.2 Drift Bounds Theorem

  • The stationary drift is Gaussian with mean α/γ and variance σ²/(2γ), and higher γ quadratically reduces drift spread relative to noise.The design criterion selects a minimum recovery rate γ for a drift threshold Dmax and reliability 1 − ε; approximately, its terms cover α/Dmax and the additional margin for stochastic fluctuations.Source: §4.2 · pp. 15–16

4.3.1 Serial Composition

  • Contracts compose safely under C1–C4, with composed recovery window max(kA, kB) rather than a shared sum across agents.The conditions address interface compatibility, assumption discharge, governance consistency, and recovery independence; the latter two are novel ABC contributions motivated by cross-agent policy conflicts and recovery side effects.Source: §4.3.1 · p. 18

4.3.2 Probabilistic Composition

  • A five-agent chain with 95% per-agent contract satisfaction and 98% handoff reliability achieves ∼71.4% end-to-end reliability and accumulated drift of 0.14.Reliability degrades multiplicatively while drift accumulates additively; conditional independence supports the bound, but shared-model correlated failures can make it optimistic.Source: §4.3.2 · pp. 18–19

4.4 Complexity Analysis

  • O(k + |A|) per-action checking yields measured overhead below 10 ms for typical enterprise contracts.The analysis combines O(k) constraint evaluation, O(|A|) incremental drift updates, and O(1) weighted aggregation; typical contracts have k < 100 and |A| < 50.Source: §4.4 · pp. 19–20

5 ContractSpec and AgentAssert

ContractSpec expresses ABC contracts as validated DSL specifications, while AgentAssert operationalizes them through layered, per-turn monitoring and bounded recovery.

5.1 ContractSpec: A Domain-Specific Language for Agent Contracts

  • ContractSpec is a YAML DSL mapping the ABC tuple into machine-validatable contracts through declarative, hybrid constraints and file-reference composition.Contracts also configure satisfaction, drift, and reliability parameters; JSON Schema rejects malformed specifications before runtime evaluation.Source: §5.1 · pp. 20–21

5.2 AgentAssert Architecture

  • AgentAssert separates parsing and validation, constraint evaluation, metric tracking, runtime orchestration, integrations, and benchmarking into modular layers.The core library depends only on standard Python data-processing libraries for parsing, validation, and expression evaluation.Source: §5.2 · p. 22

5.3 Per-Turn Enforcement

  • Below 10 ms per step for contracts with up to 100 constraints, the runtime monitor evaluates constraints, updates metrics, emits alerts, and attempts bounded recovery.Compliance scores reflect pre-recovery state, and per-constraint attempt counters reset when constraints return to satisfaction.Source: §5.3 · pp. 22–23

5.4 Recovery Mechanisms

  • Recovery strategies escalate from prompt changes to human intervention or session termination, with fallback chains enforcing bounded recovery.More aggressive strategies realize higher effective recovery rates γ, which can be selected against a target drift bound; recovery effectiveness also feeds the reliability index.Source: §5.4 · p. 23

5.5 Implementation Summary

  • ContractSpec is intentionally not Turing-complete, and AgentAssert uses action dispatch rather than framework-specific API calls to preserve safety and platform independence.The trade-offs limit expression generality and add integration boilerplate while avoiding arbitrary code execution and keeping the library decoupled from agent runtimes.Source: §5.5 · p. 24

6 AgentContract-Bench

AgentContract-Bench evaluates runtime behavioral-contract enforcement across 200 synthetic scenarios, covering domain contracts, adversarial stress, and multi-agent composition. Its validation tests AgentAssert against annotated traces, while live LLM evaluation is reported separately.

6.1 Benchmark Design

  • The 200 scenarios comprise 100 across five agent domains, 50 governance-stress scenarios, and 50 composition scenarios, using 5–8-step traces with ground-truth annotations.Difficulty levels are 18 easy, 68 medium, and 114 hard scenarios.Source: §6 · p. 24, §6.1 · p. 25, Table 3 · p. 25

6.2 Stress Profiles

  • The 50 governance-stress scenarios test prompt injection, tool failure, conflicting instructions, time pressure, resource pressure, and social engineering against the five domain contracts.Stress resilience index S compares compliance under each profile with baseline domain scenarios.Source: §6.2 · pp. 25–26

6.3 Composition Testing

  • The 50 composition scenarios test clean handoffs and conditions C1–C4: interface mismatch, assumption failure, governance breach, and recovery coordination failure.They evaluate the compositionality theorem on a three-stage loan-processing pipeline in which each agent has its own contract.Source: §6.3 · p. 26

6.4 Evaluation Protocol

  • The protocol scores detection accuracy, hard and soft compliance, behavioral drift, reliability, and scenario outcomes at per-scenario, per-domain, and overall levels.Outcomes are classified as compliant, hard violation, or soft violation; the five metric dimensions are defined in the benchmark’s evaluation protocol.Source: §6.4 · pp. 26–27

6.5 Validation Results

  • Detection accuracy is 1.0000 across 200 scenarios and 7 domains; Θ ranges from 0.9675–0.9847 in agent domains, with 0.9739 for governance and 0.8865 for composition.This validates AgentAssert against the benchmark’s annotated synthetic traces, not detection accuracy on live LLM agents. Agent domains have hard compliance scores above 0.96; composition is the hardest tier.Source: Table 4 · p. 27, §6.5 · p. 27
  • Composition has hard compliance of 0.8603 and mean drift of 0.1835; across the 200 scenarios, 23 are compliant, 117 hard violations, and 60 soft violations.The hard-violation majority reflects the benchmark’s adversarial design: it tests the enforcement engine’s ability to detect, not prevent, contract breaches.Source: §6.5 · pp. 27–28

6.6 Comparison with Existing Benchmarks

  • Unlike AgentBench, HELM, and StepShield [Felicia et al., 2026], it tests formal contract violations across multi-step traces, adversarial stress, and multi-agent composition.The benchmark also combines ABC-grounded compliance metrics with systematic composition testing against the compositionality theorem’s conditions.Source: §6.6 · p. 28

7 Experiments

The experiments evaluate runtime-enforced ABC contracts across models and extended and adversarial tests, examining soft-constraint detection, hard-constraint compliance, behavioral drift, recovery, and latency. Ablations assess the roles of recovery, soft constraints, and monitoring, and the evaluation reports platform-guardrail interference requiring configuration changes.

7.1.1 Experimental Controls

  • Contracted and uncontracted conditions differed only in contract enforcement, used the same evaluator, and triggered genuine LLM re-prompting for soft—but not hard—violations.Recovery allowed at most one retry per turn; hard violations were logged without recovery attempts.Source: §7.1.1 · pp. 29–30

7.1.2 Evaluation Methods

  • A GPT-4o-mini LLM judge evaluated constraints across E1–E4, with heuristic extraction as a secondary method and human annotation used for calibration.The calibration sample covered 100 sessions, yielding 600 turn-level annotations and 7,200 constraint-level judgments.Source: §7.1.2 · pp. 30–31

7.1.3 Statistical Methodology

  • At observed effects of d ≥6.70, E1’s post-hoc power exceeded 0.9999 for every comparison with n = 30 per condition and αadj = 0.01.Between-condition tests used Welch’s t-test with Bonferroni correction.Source: §7.1.3 · pp. 31–32

7.2 Experimental Setup

  • The evaluation covered seven models from six vendors on a financial-advisor contract, with E1 comprising 420 sessions and 2,520 inference calls.E1 used 30 contracted and 30 uncontracted six-turn sessions per model; behavioral drift and reliability were reported only for contracted sessions.Source: §7.1.4 · p. 32, §7.2 · pp. 34–35, §7.3.3 · p. 36

7.1.6 Platform Guardrail Interference

  • Azure’s DefaultV2 filter blocked 40–60% of legitimate multi-turn financial-advisory sessions after contract language triggered its content filter.The experiments therefore used the less restrictive Default filter, softened contract wording, and handled filter errors gracefully.Source: §7.1.6 · p. 33

7.3.1 The Transparency Effect

  • Across seven models, contracted sessions surfaced 5.23–6.83 soft violations per session versus 0.00–0.30 uncontracted, with p < 0.0001 and Cohen’s d = 6.70–33.82.Table 9 reports the E1 results; the paper interprets the lower contracted soft compliance as greater visibility of violations, not a behavioral regression.Source: Table 9 · p. 35, §7.3.1 · pp. 35–36

7.3.2 Hard Compliance

  • Five of seven models achieved contracted hard compliance of Chard ≥0.989; GPT-5.2 and GPT-4o-mini reached Chard = 1.000 in both conditions.Mistral Large 3 improved by +4.5 percentage points under enforcement (p < 0.0001, Cohen’s d = 1.69); Claude Opus 4.6 improved by +3.2 pp (p < 0.0001, d = 1.09).Source: §7.3.2 · p. 36

7.3.6 Cost Efficiency

  • E1 cost $3.09 for 420 sessions and 2,520 calls ($0.0074 per session); E2 cost $7.22 for 240 sessions ($0.030 per session).E2's per-session cost was roughly 4× E1's, consistent with the doubled session length.Source: §7.3.6 · p. 37, §7.4.3 · p. 39

7.3.3 Behavioral Drift and Reliability

  • In E1, cross-model mean drift was D̄ = 0.099 and mean reliability Θ = 0.939; all models exceeded Θ > 0.90, while all seven soft-violation comparisons had p < 0.0001.Mistral Large 3 had the highest drift (D̄ = 0.154) and lowest Θ (0.908); GPT-5.2 had Chard = 1.000 in both conditions yet contracts detected 6.07 soft violations per session.Source: §7.3.3 · p. 36, §7.3.4 · p. 37, §7.3.5 · p. 37

7.4.2 Soft Violation Scaling

  • Recovery success varied by model: GPT-5.2 and Claude Opus 4.6 each reached 100%, versus 50% for Llama 3.3 70B and 17% for Mistral Large 3, within the prescribed recovery window.Source: §7.4.3 · p. 39

7.4.1 Drift Trajectory Analysis

  • Contracted-agent drift remained bounded across 12-turn sessions: maximum Dmax was 0.264, below the alert threshold, and the Ornstein–Uhlenbeck fit had R2 = 0.49–0.75.GPT-5.2 drift stayed near 0.083 for turns 1–8 before reaching 0.169 at turn 12; uncontracted agents had no measurable drift because they lacked a contract reference.Source: §7.4.1 · pp. 38–39, Figure 2 · p. 40

7.5.1 Hard Compliance Under Stress

  • Under adversarial stress, hard compliance never fell below 0.911; 7 of 12 model–stress combinations retained Cpost_hard = 1.000, and GPT-5.2 had zero degradation across all three stress types.The largest degradation was ΔChard = −0.067 for Llama 3.3 70B under conflicting advice, and it recovered within the k-window.Source: §7.5.1 · p. 41

7.5.2 Violation Detection Under Stress

  • Under boundary push, contracts surfaced 0.87–1.60 additional violations per session versus 0.03–0.77 uncontracted; Claude Opus 4.6 recovered at 0.33–0.91, while GPT-5.2 needed no recovery.Prompt injection produced negative violation spikes for GPT-5.2 (−2.07), Llama 3.3 70B (−0.70), and Mistral Large 3 (−3.17); conflicting advice was the most challenging stress type.Source: §7.5.2 · pp. 41–42, §7.5.3 · p. 42

7.6.3 Interpreting the Θ Paradox

  • Hard Only preserved hard compliance within ±0.001 and Drift Only reproduced each model’s drift value; higher Θ in under-monitored ablations reflects omitted measurement, not better behavior.Hard invariants are evaluated independently of soft constraints and recovery, and drift monitoring computes from raw action distributions regardless of constraint enforcement.Source: §7.6.3 · p. 44, §7.6.4 · p. 45

7.6.4 Key Findings

  • Disabling recovery reduced mean Θ by −0.209 (±0.007), while Soft Only reduced it by −0.200 (±0.006); recovery caused the largest drop for 3 of 4 models.Across both degrading conditions, cross-model standard deviation of ΔΘ was < 0.01; Mistral Large 3 had the largest recovery contribution at ΔΘ = −0.215.Source: §7.6.4 · p. 44

7.6.5 Component Interaction Analysis

  • Θ drops by ∼0.20 with Soft Only and ∼0.21 without recovery, showing that detection without correction leaves behavior unimproved.Recovery converts soft-constraint detection into behavioral correction, so ABC contracts should pair recovery strategies with soft constraints.Source: §7.6.5 · p. 45

7.6.6 Statistical Considerations

  • A Θ drop of 0.20 is an order of magnitude larger than measurement noise (σΘ < 0.02) and consistent across all 4 models.Ablation comparisons share the task set and model, so the paper does not report Bonferroni-corrected p-values; Cohen’s d exceeds 10 for all degrading comparisons.Source: §7.6.6 · p. 45

7.7 Runtime Overhead

  • Below 10 ms per action across 2,520 LLM calls, enforcement overhead is less than 1% of typical frontier-model inference latency.Overhead scales linearly: it remains below 15 ms for k = 50 constraints and below 25 ms for k = 100; measurements exclude provider network latency.Source: §7.7 · p. 46

8 Discussion

The discussion interprets ABC’s runtime enforcement as making previously invisible violations measurable, while identifying implementation, validity, and deployment limitations. It presents contracts as a governance layer complementary to model alignment, but warns that assurance depends on contract quality and outlines open research directions.

8.1 Interpretation of Key Findings

  • 5.2–6.8 soft violations per session were surfaced by contracted agents across seven models from six vendors, while uncontracted agents missed them; C(t)hard was ≥0.88 in every contracted case.The authors interpret the lower soft compliance score as increased visibility, not degraded behavior: contracts detect existing violations. Near-perfect hard compliance in some models coexisted with C(t)hard = 0.882 for one contracted model, indicating residual violations that runtime enforcement can catch beyond training-time alignment.Source: The transparency effect · pp. 46–47
  • Dmean ranged from 0.073 to 0.154, and distributional drift registered action-distribution shifts before explicit violations, while six-turn sessions were too short to provoke severe drift.The (p, δ, k)-satisfaction framework makes governance requirements testable, and Theorem 4.3’s design criterion specifies the recovery rate γ needed to meet them; sustained sessions are needed to stress drift bounds.Source: The transparency effect · p. 47

8.2 Limitations

  • ABC requires precomputed state features, dedicated reference-distribution calibration, and deployer-defined corrective handlers; AgentAssert detects violations by default but does not correct them.Feature extraction from raw outputs is outside ABC, and stale calibration can cause false alarms in changing environments. Custom recovery strategies such as prompt or context rewriting must be supplied by deployers, creating integration and implementation burdens.Source: §8.2 · pp. 47–48
  • The drift bound’s stationarity approximation may be optimistic for short sessions, composition bounds assume conditionally independent failures, and the synthetic benchmark tests evaluator consistency rather than live detection.The finite-time bound partly addresses transient drift, but the simplified tail bound applies only under stationarity. Shared models can produce correlated failures, while the benchmark does not validate the full raw-output-to-feature pipeline.Source: §8.2 · pp. 48–49

8.3 Threats to Validity

  • Internal validity is limited by prompt sensitivity and untested temperature effects, while external validity is unestablished beyond 10 financial tasks over six-turn sessions.The study mitigates API non-determinism with 30 sessions per model per condition and reports p < 0.0001 for comparisons, but uses one prompt template per task and default temperatures. Broader live evaluation across domains, task complexities, and session lengths remains necessary.Source: §8.3 · p. 49
  • ABC metrics depend on application-specific weights and measure compliance relative to specified constraints, not agent quality independent of the contract.A contract with few constraints can yield high compliance despite poor behavior; sensitivity analysis of ±20% supports robustness to weight variation, but systematic weight-space exploration remains future work.Source: §8.3 · pp. 49–50

8.4 Broader Impact

  • ABC enables continuous, auditable governance and complements alignment [Bai et al., 2022] and RLHF [Ouyang et al., 2022] by enforcing deployment-specific behavior at runtime.The framework links (p, δ, k) requirements to technical monitoring; training-time alignment reduces natural drift α, while contracts increase recovery rate γ. The authors frame safety as a system property and extend the shielding idea of Alshiekh et al. [2018] to open-ended language environments.Source: §8.4 · pp. 50–51
  • Shallow or incomplete contracts risk creating false security, and future work includes adaptive contracts, contract inference, broader composition, resource governance, and longitudinal evaluation.The authors also propose testing contract effectiveness over weeks or months and whether transparency persists as operators adjust contracts in response to observed violations.Source: §8.4 · pp. 50–51

9 Conclusion

The conclusion presents Agent Behavioral Contracts (ABC) as a formal specification and runtime-enforcement framework for autonomous agents, reports benchmark findings, and identifies limitations and future directions.

Summary of contributions

  • ABC defines probabilistic contract satisfaction and separates zero-tolerance hard constraints from soft constraints recoverable within a bounded window k.Its contract tuple is C = (P, Ihard, Isoft, Ghard, Gsoft, R); recovery transforms exponential compliance decay into linear decay, and behavioral drift is bounded in expectation by D∗ = α/γ when γ > α.Source: §9 · pp. 51–52
  • The framework establishes sufficient conditions for compositional guarantees across multi-agent chains and introduces SPRT certification, ContractSpec, and AgentAssert.AgentAssert has sub-10ms per-action overhead; the composition results include quantified reliability degradation bounds.Source: §9 · p. 52

Key experimental findings

  • Across 1,980 sessions, contracted agents detected 5.2–6.8 soft violations per session versus 0.0–0.3 uncontracted and achieved 88%–100% hard compliance.The evaluation covered 7 models from 6 vendors. The authors characterize the additional detections as previously unobservable violations, not regression.Source: §9 · p. 52
  • In 12-turn E2 sessions, contracted agents had mean drift D(t) = 0.139 and maximum Dmax = 0.264; frontier-model recovery restored soft compliance in 100% of violation events.Ablation showed each contract component lowered reliability index Θ by 0.19–0.22. Azure DefaultV2 blocked 40–60% of legitimate multi-turn conversations, while ABC under lighter filtering achieved equivalent or better domain compliance with zero false blocking.Source: §9 · pp. 52–53

Practical impact

  • ABC provides auditable governance criteria, a design rule for recovery rates, and a shared 200-scenario, 7-domain benchmark for reproducible evaluation.The framework is presented as an alternative to deploying agents without formal guarantees or relying solely on platform guardrails that cannot express domain-specific requirements or compose across pipelines.Source: §9 · p. 53

Limitations

  • The implementation relies on heuristic state extraction and LLM-as-Judge evaluation, with validation concentrated in financial advisory rather than tool-calling, multimodal, or live production settings.The judge layer adds API cost and latency, and its production-scale optimization remains unresolved.Source: Limitations · p. 53

Future work

  • Future work includes guardrail coordination, broader composition verification, online SPRT certification, automatic contract inference, and support for multimodal agents.The proposed composition extensions cover parallel, hierarchical, and cyclic topologies.Source: Limitations · p. 53

A Full Proofs · A.1 Full Proof of the Stochastic Drift Bounds Theorem

The proof develops the Stochastic Drift Bounds Theorem through four stages, from a deterministic Lyapunov warm-up to stochastic analysis, ergodicity, and a contract design criterion.

A.1 Full Proof of the Stochastic Drift Bounds Theorem

  • The proof proceeds from a deterministic Lyapunov warm-up through an Itô-calculus stochastic extension and Foster–Lyapunov ergodicity analysis, ending with a contract design criterion.These are presented as increasingly general arguments for the theorem.Source: §A.1 · p. 54

A.1.1 Deterministic Case (Warm-up)

In the deterministic case, drift is injected at rate α and countered by mean-reversion strength γ. The equilibrium D* = α/γ is globally asymptotically stable, with exponentially decaying error.

A.1.1 Deterministic Case (Warm-up)

  • α > 0 is the drift injection rate, while γ > 0 is the mean-reversion strength.Source: §A.1.1 · p. 54
  • D* = α/γ is globally asymptotically stable, and its Lyapunov function decays as V(t) = V(0)e^-2γt.The proof uses V(e) = e^2 and establishes global asymptotic stability via Lyapunov’s theorem.Source: §A.1.1 · p. 54

A.1.2 Stochastic Extension via Itô Calculus

The stochastic extension models behavioral drift as an Ornstein–Uhlenbeck process and establishes mean-square convergence to a stationary variance. Its convergence rate is 2γ.

A.1.2 Stochastic Extension via Itô Calculus

  • The stochastic drift converges in mean square to stationary variance σ²/(2γ), at rate 2γ.The error is centered at D* = α/γ.Source: §A.1.2 · pp. 55–56
  • The proof applies Itô’s formula to the error process and takes expectations, where the stochastic integral vanishes as a martingale.The drift perturbations are modeled as an Ornstein–Uhlenbeck process driven by a standard Wiener process with volatility σ > 0.Source: §A.1.2 · p. 55

A.1.3 Ergodicity via the Foster–Lyapunov Criterion

The Foster–Lyapunov criterion establishes a unique stationary distribution for the stochastic drift process, whose stationary second moment is exactly σ2/(2γ).

A.1.3 Ergodicity via the Foster–Lyapunov Criterion

  • The Foster–Lyapunov criterion yields a unique stationary distribution when LV(x) ≤ −λV(x) + b for all x, with λ > 0 and b ≥ 0.The criterion assumes a continuous-time Markov process and a function V mapping Rd to [1, ∞).Source: §A.1.3 · p. 56
  • The drift process admits a unique stationary distribution π, with Eπ[e2] = σ2/(2γ).The proposition states the bound Eπ[e2] ≤ σ2/(2γ), and the direct calculation gives equality.Source: §A.1.3 · p. 56
  • Using Ṽ(e) = e2 + 1 gives L Ṽ(e) = −2γe2 + σ2, which satisfies the Foster–Lyapunov condition globally.Because the bound holds globally, any compact set containing the origin can be used; the direct calculation gives Eπ[e2] = σ2/(2γ).Source: §A.1.3 · p. 56

A.1.4 Gaussian Tail Bound

This appendix bounds the stationary probability that drift exceeds α/γ + η using a Gaussian-tail argument for the OU process.

A.1.4 Gaussian Tail Bound

  • Proposition A.5 considers the stationary probability that drift exceeds α/γ + η.The proof applies a standard Gaussian tail bound using mean α/γ and variance σ²/(2γ) for the stationary OU process; the supplied passages omit the resulting probability expression.Source: §A.1.4 · pp. 56–57
  • The argument establishes part (iv) of the main theorem.Source: §A.1.4 · p. 57

A.1.5 Contract Design Criterion

This section translates a target drift tolerance and exceedance probability into a minimum correction-strength criterion, then derives an approximate form under a small-noise condition.

A.1.5 Contract Design Criterion

  • To keep drift beyond Dmax below ε with probability at most ε, the correction strength must satisfy γΔ² ≥ σ² ln(1/ε), where Δ = Dmax − α/γ; γ must be at least the larger root.Proposition A.6 gives the sufficient minimum correction strength for the prescribed tolerance.Source: §A.1.5 · p. 57
  • The proof sets η = Dmax − α/γ > 0 in Proposition A.5’s bound, solves for η, and substitutes back to obtain criterion (43).Source: §A.1.5 · p. 57
  • When σ² ln(1/ε) ≪ 2αDmax, a first-order expansion recovers a simpler approximate correction-strength criterion.Source: §A.1.5 · p. 57

A.2 Proof of the Recovery Lemma … Author Biography

The appendix formalizes recovery-augmented compliance and deterministic and probabilistic contract composition, then compares Hoeffding and sequential-testing sample requirements for certification. It also describes continuous SPRT monitoring and includes an author biography.

A.2 Proof of the Recovery Lemma

  • Without recovery, compliance over T steps is q^T; with recovery effectiveness r, each step’s unrecoverable-failure probability is (1 − q)(1 − r).The union bound is conservative because recovery induces negative autocorrelation; a renewal-theoretic bound on expected violation fraction is tight as T → ∞.Source: §A.2 · p. 58

A.3 Proof of the Compositionality Theorem

  • Deterministic composition holds when handoff invariants and pre/postconditions chain, governance constraints do not conflict, and each agent’s recovery preserves the other’s contract.Under these conditions, the composed chain satisfies the composed contract.Source: §A.3 · p. 59

A.4 Proof of Probabilistic Compositionality

  • For probabilistic composition, pA⊕B ≥ pA · ph · pB under conditional independence, while worst-case deviations accumulate additively across agents and handoffs.The N-agent extension implies multiplicative reliability degradation with chain length; the paper motivates intermediate checkpointing and recovery for long chains.Source: §A.4 · pp. 60–61

A.5 Sample Complexity for (p, δ, k)-Satisfaction Certification

  • Hoeffding certification requires at least 18,445 sessions to estimate compliance within ε = 0.01 at confidence 1 − α = 0.95.The baseline is for i.i.d. Bernoulli observations of per-session compliance.Source: §A.5 · p. 61
  • SPRT testing expects 150–300 sessions under H1, a 60×–120× reduction over the Hoeffding baseline, for H0: p ≤ 0.90 versus H1: p ≥ 0.95 with α = β = 0.05.Continuous monitoring updates the SPRT statistic per interaction, certifying at the upper boundary or flagging remediation at the lower boundary; windowed or decaying variants can accommodate non-stationary compliance rates.Source: §A.5 · pp. 61–62

Author Biography

  • The author biography identifies Varun Pratap Bhardwaj as an Accenture Senior Manager and Solution Architect with 15 years of enterprise-technology experience and dual technology and law qualifications.His stated research interests include formal methods for AI safety, behavioral contracts for autonomous agents, and enterprise-grade agent governance.Source: Author Biography · p. 62

Related papers

Loading 2602.22302v1…