Sovereign Agentic Loops: Decoupling AI Reasoning from Execution in Real-World Systems

1 Introduction

• Direct execution coupling is unsafe because stochastic models operate with partial observability and can issue valid commands against critical resources.Post-hoc logging and coarse permission boundaries do not verify appropriateness under true system state.Source: §1 · p. 1
• SAL formalizes the Decoupling Principle by treating model outputs as verifiable intents rather than direct execution authority.The control plane evaluates intent proposals against pre-execution policy constraints.Source: §1 · p. 2
• SAL isolates reasoning from identity-sensitive state through an obfuscation membrane while preserving structural information needed for decisions.The OpenKedge implementation limits model access to identity-sensitive information.Source: §1 · p. 2
• The Evidence Chain records intents, evaluations, and executed actions to support auditability and deterministic replay.Its cryptographic linkage connects system states, intents, and actions.Source: §1 · p. 2
• 12.4 ms median overhead accompanied pre-execution blocking of unsafe actions in the OpenKedge benchmark.The evaluation reports that unsafe actions can be blocked before execution.Source: §1 · p. 2
• SAL therefore places agent safety in execution architecture rather than delegating it solely to model behavior.This design uses mediated execution to constrain the effects of stochastic reasoning.Source: §1 · pp. 1–2

2.1 Agentic Tool Use and LLM-Based Systems

• Only four of 30 deployed agents in the 2025 AI Agent Index provide agent-specific safety evaluations, while 25 disclose no internal safety results.This transparency gap motivates structural execution governance.Source: §2.1 · p. 2
• Agentic tool-use frameworks commonly allow generated actions to execute after syntactic validation or lightweight guardrails.The related systems focus primarily on model reasoning or the model–tool interface.Source: §2.1 · p. 2
• SAL treats model outputs as intents requiring validation in a sovereign control plane rather than as executable commands.This shifts the focus from tool orchestration to execution governance.Source: §2.1 · p. 2

2.2 Guardrails and Runtime Validation

• Guardrail approaches constrain model behavior through prompts, output filtering, runtime rules, or monitoring, while AgentSpec and Pro2Guard add customizable and proactive enforcement.OAP synchronously intercepts tool calls and reports a 0% adversarial success rate under restrictive policies with 53 ms median latency.Source: §2.2 · p. 3
• Existing guardrails remain model-centric or action-centric and do not guarantee effects after execution or provide a complete reasoning-to-outcome causal chain.SAL instead enforces safety before execution over real system state and records the causal chain cryptographically.Source: §2.2 · p. 3

2.3 Runtime Verification and Formal Methods

• Runtime verification and formal methods commonly assume a known system model and observable execution traces.Agentic systems complicate this assumption because stochastic decisions may trigger execution without a formally verifiable boundary.Source: §2.3 · p. 3
• SAL complements runtime verification by enforcing policy compliance before state mutation and extending trace-based verification with deterministic replay.Its Evidence Chain provides a complete causal trace, while dynamic policy evaluation avoids requiring design-time hazard enumeration.Source: §2.3 · p. 3

2.4 Access Control and Policy Systems

• RBAC, ABAC, OPA, and Cedar provide structured mechanisms for regulating system access.These mechanisms form the conventional access-control baseline discussed by the paper.Source: §2.4 · p. 3
• Aethelgard dynamically scopes tool awareness through learned minimum viable capability sets, addressing capability overprovisioning.Its approach reduces the tools exposed to an agent according to task requirements.Source: §2.4 · pp. 3–4
• Traditional policy systems assume caller identity and request context reliably represent intent, but agents may act from incomplete or incorrect reasoning.SAL derives authority from validated intent, live state, and justification consistency instead.Source: §2.4 · p. 4
• SAL shifts authorization from static identity to dynamically validated intent, context, and policy evaluation.Even within an allowed capability set, every proposed action must pass deterministic evaluation before mutation.Source: §2.4 · p. 4

2.5 Multi-Agent Coordination and Failure Taxonomies

• Uncoordinated multi-agent systems amplified errors by up to 17×, whereas centralized validation bottlenecks contained amplification to approximately 4.4×.MAST identifies 14 failure modes across specification, inter-agent alignment, and task verification using 1,600 execution traces.Source: §2.5 · p. 4
• Multi-agent coordination can improve parallelizable-task performance by up to 80.9% but degrade sequential-reasoning performance by 39–70%.These results show that coordination effects depend on task structure.Source: §2.5 · p. 4
• SAL is composable with multi-agent architectures and provides a pre-execution invariant layer that prevents coordination errors from becoming infrastructure mutations.It can serve as the execution-boundary control plane for agents regardless of coordination topology.Source: §2.5 · p. 4

2.6 Control Theory and Feedback Systems

• SAL extends feedback control to stochastic agents by operating on intent proposals rather than direct control signals.Its evaluation, execution, and recording stages reestablish controllability when decisions are otherwise opaque.Source: §2.6 · p. 4

2.7 Data Privacy and Information-Theoretic Isolation

• Differential privacy, secure enclaves, and anonymization limit information leakage, while sovereign-AI work emphasizes strict data boundaries for foreign models.These approaches motivate SAL’s privacy boundary but do not describe its execution-control mechanism.Source: §2.7 · p. 4
• SAL’s obfuscation membrane transforms state so the reasoning model has no mutual information with identity-sensitive components.Unlike data-release privacy methods, SAL applies isolation directly to the decision-making interface.Source: §2.7 · pp. 4–5

• SAL decouples reasoning from execution authority, treating model outputs as proposals rather than directly executable commands.Source: §2.8 · p. 5
• The control plane enforces safety as a pre-execution constraint before actions can mutate system state.Source: §2.8 · p. 5
• Cryptographically linked evidence chains provide deterministic replay of agentic executions.Source: §2.8 · p. 5
• An obfuscation membrane establishes information-theoretic isolation between reasoning processes and infrastructure state.Source: §2.8 · p. 5
• SAL is designed to complement model capability, runtime enforcement, multi-agent coordination, and system verification.Source: §2.8 · p. 5

3.1 System Topology and State Representation

• The system decomposes state into identity-sensitive components such as node IDs and structural properties needed for reasoning.Source: §3.1 · p. 5
• The obfuscation membrane projects true state into an obfuscated representation that preserves structural topology while removing identity-sensitive information.The isolation claim requires that auxiliary side channels do not reintroduce identity information.Source: §3.1 · pp. 5–6

3.2 The Sovereign Agentic Loop Formulation

• A foreign reasoning model receives obfuscated state and generates a structured intent with an explanatory justification rather than direct execution authority.The model's conditional generation is defined without direct access to local infrastructure identity, assuming external signals do not reintroduce it.Source: §3.2 · p. 6
• Because the reasoning model is stochastic, similar scenarios can produce conflicting intents, motivating downstream validation of proposals.Source: §3.2 · pp. 6–7
• The deterministic evaluation function requires both policy compliance against full state and consistency between the intent, justification, and obfuscated context.Source: §3.2 · p. 7
• Authorized intents are reconstructed into concrete mutations inside the control plane, while the Evidence Chain records context, intents, executions, and chained hashes for audit and replay.Source: §3.2 · p. 8

3.3 Formal Safety Guarantees

• The formal guarantees rely on exclusive control-plane mediation of all state mutations; they do not extend to systems with external execution pathways.Source: §3.3 · pp. 8–9
• SAL guarantees policy-bounded execution, identity isolation, and deterministic cryptographic replay under assumptions A1–A4 and closed execution.The guarantees depend on deterministic evaluation and execution, complete evaluation context, and exclusive mediation of mutations by the execution operator.Source: §3.3 · pp. 8–9

4 System Design and Implementation

• SAL intercepts, translates, evaluates, and governs agent-initiated mutations before they reach infrastructure APIs.Source: §4 · p. 9

4.1 Architectural Principles

• The architecture enforces execution sovereignty, minimal trust in reasoning, deterministic replayability, and pluggable enforcement through existing policy systems.Source: §4.1 · p. 9
• Six stateless modules normalize intents, obfuscate state, aggregate context, evaluate policies, adapt execution, and append evidence while localizing persistence to the evidence log.Source: §4.1 · p. 9

4.2 State Obfuscation and Intent Abstraction

• The obfuscation membrane replaces identity-sensitive infrastructure metadata with ephemeral tokens while preserving dependency-graph topology for model reasoning.Source: §4.2 · pp. 9–10
• Structured intents encode action type, target token, parameters, and justification, separating semantic reasoning from executable commands and reducing direct script or API-payload generation.Source: §4.2 · p. 10

4.3 Deterministic Sovereign Evaluation

• Deterministic evaluation rejects policy violations and justification–state contradictions before execution, using OPA rules and live contextual consistency checks.Source: §4.3 · p. 10

4.4 Mediated Execution and Evidence Chaining

• Authorized intents receive short-lived scoped IAM credentials, while the Evidence Chain records hashed decisions and supports replay, audit, and forensic inspection.Source: §4.4 · p. 10
• A default-deny fallback records failures and preserves control-plane execution authority when parsing, context checks, or adapters fail.Source: §4.4 · p. 10

5.1 Experimental Setup

• The evaluation used 10,000 intent traces comprising 7,500 benign requests and 2,500 adversarial intents targeting simulated cloud infrastructure operations.Source: §5.1 · p. 11

5.2 Latency Overhead

• 12.4 ms was the measured median end-to-end latency overhead for intent ingestion, evaluation, and Evidence Ledger serialization.OPA evaluation contributed 6.8 ms, consistency evaluation 2.3 ms, and cryptographic hashing plus ledger serialization 1.2 ms.Source: §5.2 · p. 11

5.3 Safety Effectiveness

• 100% of adversarial intents were blocked before execution: 93.0% by policy rules and the remaining 7.0% by contextual consistency checks.No unsafe intent bypassed evaluation to execute on the underlying infrastructure.Source: §5.3 · p. 11

5.4 Replay Verification

• Replay reconstruction matched every conditionally executed mutation across the dataset, yielding a 100% verification match rate with no cryptographic desynchronization.The preserved contextual input and justification enabled reconstruction of each policy decision.Source: §5.4 · p. 12

5.5 Summary

• The benchmark results indicate that mediated execution can block unsafe intents while adding roughly 12.4 ms median latency.Source: §5.5 · p. 12

6 Conclusion

• SAL separates semantic reasoning from system-state mutation by routing agent intents through a control-plane mediation pipeline.Source: §6 · p. 12
• Under the stated assumptions, SAL provides policy-bounded execution, identity isolation through obfuscation, and auditable replay through the Evidence Chain.Source: §6 · p. 12
• The OpenKedge evaluation blocked unsafe intents before execution while the mediation pipeline added approximately 12.4 ms median latency.Source: §6 · p. 12
• SAL constrains stochastic agent effects at the execution boundary rather than relying solely on prompt design or alignment.Source: §6 · p. 12
• The architecture treats model outputs as proposals that must be validated against system state and policy before execution.Source: §6 · p. 12

A Notation

• Table 1 summarizes the notation used in the SAL model.Source: Table 1 · p. 14

• The correspondence is provided to ensure consistency between SAL’s architectural and mathematical representations.Source: B Figure-to-Notation Mapping · p. 14
• The mapping connects Figure 2’s conceptual components to the formal notation of the SAL model.Source: B Figure-to-Notation Mapping · p. 14, Table 2 · p. 15
• Table 2 presents the Figure 2 component-to-notation mapping for the SAL model.Source: Table 2 · p. 15