Source-linked AI summary
Cordon: Semantic Transactions for Tool-Using LLM Agents
Zheng Chen, Hanqing Liu, Duling Xu, Dong Dong, Jialin Li, Bangzheng Pu, Jidong Zhai
TL;DR
Tool-using agent runtimes commonly expose isolated tool calls without a task-scoped boundary for multi-step effects, leaving composed risks difficult to validate before commit. Cordon introduces semantic transactions that track lineage and stage local and external effects, and its evaluation reports stronger pre-commit containment while preserving benign task correctness. The system does not provide universal containment for opaque or unsupported external boundaries.
Problem
Current agent runtimes expose tools as independent operations, but multi-step risks can depend on composed result lineage, mutations, effects, and delegated authority rather than any single call.
Method
Cordon uses task-scoped semantic transactions to track result lineage, execute reversible mutations in shadow state, stage external effects, and record recovery metadata before validation and commit.
Results
Cordon intercepted 45/45 policy-violating workflows before commit, while existing defense-boundary adapters intercepted 14/45, and benign benchmark correctness remained within measurement variance.
Takeaways & Limitations
Semantic transactions improve containment and recovery for cross-step semantic risks while preserving practical usability and benchmark-visible task correctness.
Takeaways & Limitations
Cordon does not provide complete semantic correctness or universal containment; unsupported plugins, dynamically changing services, and unobservable side effects may fall outside its containment scope.
Abstract
from arXiv · showhide
Tool-using LLM agents are shifting the unit of computation from explicit human-issued commands to model-driven tasks with stateful consequences. Yet today's agent runtimes still expose tools as isolated RPCs. This interface gives runtimes a convenient integration point, but it lacks a task-scoped execution boundary for commit, rollback, recovery, and audit across multi-step agent workflows. We argue that this mismatch calls for a runtime containment boundary rather than another per-call guardrail. This paper introduces Cordon, a transactional runtime system for staging and validating irreversible agent effects before commit. A semantic transaction is a task-level execution boundary that binds tool intents and runtime-tracked result lineage to reversible local state, staged external effects, delegated authority, and audit metadata. Cordon implements this abstraction with a transaction manager that tracks derived result objects, executes reversible mutations in shadow state, stages outward-facing actions in an effect outbox, and records recovery metadata. The runtime then validates the composed execution flow before it commits state or releases external effects. Our evaluation across adversarial and benign workflows shows that Cordon exposes cross-step violations missed by existing defenses. It also reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.
1 Introduction
Cordon addresses the mismatch between isolated tool-call execution and multi-step agent tasks whose risks emerge only across composed result lineage, local mutations, external effects, and delegated authority. It introduces task-scoped semantic transactions that stage, validate, and recover effects before irreversible commit.
- Problem: Existing runtimes treat each tool request as an independent operation, giving them the wrong execution boundary for long-running agent tasks.Approving or recovering an action can depend on the composed execution flow rather than any single call.
- Problem: Cross-step violations can emerge when a secret-bearing result becomes a derived summary and then feeds an external effect, despite individually justifiable tool calls.The incident-response example shows why isolated call checks can miss composed-task risks.
- Cordon: Cordon represents each agent task as a semantic transaction and delays irreversible effects until task-level validation is possible.The boundary covers result objects, speculative local mutations, pending external effects, delegated authority, and audit metadata.
- Evaluation: 45/45 risk-bearing workflows contained policy-violating effects before commit with Cordon, compared with 14/45 intercepted by existing defense-boundary adapters.The adapters left 31/45 policy-violating or post-hoc-only; Cordon also preserved benchmark correctness within measurement variance.
- Cordon: Cordon combines a transaction manager, shadow state, effect outbox, and recovery log to stage, validate, commit, abort, and audit agent effects.Results retain lineage so runtime containment properties can be checked over the composed execution flow.
2 Agent Tool Execution and Effect Boundaries
The paper models agent execution as a dependency-bearing history in which side effects may depend on evidence distributed across multiple steps. It argues that enforcement mechanisms differ by the execution projections and commit boundaries they observe, with transaction-level views exposing composed results, dependencies, mutations, and pending effects.
- Execution history: An agent execution history contains observations, decisions, tool invocations, results, state changes, approvals, validation decisions, and external effects.Dependency edges connect events when earlier information or state influences later arguments, payloads, decisions, mutations, validation outcomes, or sinks.
- Semantic effects: A side effect is cross-step semantic when its commit decision depends on evidence distributed across its transitive dependency set rather than on the effect or one prior event alone.Secret-derived messages, untrusted-input-to-configuration writes, and rollback-sensitive multi-file edits are examples.
- Commit semantics: Local mutations commit when promoted to the real workspace, while external effects commit when dispatched to a service, user, network endpoint, or API.The effect boundary concerns when changes become durable or externally visible.
- Boundary projections: An enforcement mechanism observes a projection of execution history, so a valid and boundary-violating history can be indistinguishable when their visible projections are equal.In that case, the mechanism cannot reliably decide whether the side effect should commit.
- Existing mechanisms: Existing defenses inspect different projections, whereas a transaction-level projection includes composed result objects, dependencies, local mutations, and pending effects produced by a task.Cordon adds a task-level transaction boundary before irreversible commit.
3 Semantic Transaction Model
A semantic transaction exposes the composed task flow as a commit and recovery unit for tool-using agents. It groups results, reversible state, staged effects, delegated authority, and audit evidence so validation can govern local rollback and external accountability.
- A semantic transaction groups model-driven tool use, semantic results, reversible state, staged effects, delegated authority, and audit evidence into one validation contract.
- Cordon's three-phase protocol prepares intents and staged effects, validates lineage, authority, effects, and constraints, then commits or rolls back accordingly.Valid transactions promote recoverable state and release approved effects; invalid ones roll back local state, block staged effects, and seal an audit record.
- The transaction representation records scope, intents, observations, result objects, dependency lineage, recoverable writes and deletes, staged effects, authority, and lifecycle status.
- The transaction scope can span multiple model turns, artifacts, retries, and derived prompts serving one delegated task, while new tasks or authority changes create new scopes.
- Result objects include observed or derived values, mutations are recoverable local changes, and effects are externally visible actions whose release may cross an irreversible boundary.
- Typed lineage edges connect observations, transformations, mutations, and effects, allowing commit decisions to detect semantic dependence beyond exact string containment.The incident-response example follows a secret-bearing log through a derived summary to a pending Slack effect.
4 Runtime Architecture
Cordon inserts a task-scoped transaction context between agent tool calls and side effects, tracking execution history, speculative state, staged effects, authority, and recovery metadata. It validates the composed flow before separately promoting local changes and releasing external effects, with conservative recovery at irreversible boundaries.
- Runtime overview: Cordon inserts a transactional control plane between the agent planner and side-effecting tools, binding mediated calls to task transactions and runtime evidence.The architecture materializes evidence, stages effects, validates the composed transaction, and records state for recovery and audit.
- Runtime overview: The transaction context accumulates operation intents, object handles, lineage edges, speculative state, pending effects, scoped authority, and recovery records during execution.Validation consumes this online context rather than reconstructing dependencies from the final prompt or output.
- Shadow-state engine: Cordon executes local mutations in shadow state, exposing speculative changes within the transaction while keeping them invisible externally until commit.At abort, denial, timeout, or rollback, the shadow view is discarded and pre-transaction anchors are restored.
- Shadow-state engine: The shadow-state guarantee applies only to local state that Cordon can mediate; unsupported mutation channels are blocked or recorded as crossed recovery boundaries.This explicitly limits ACID-like behavior to operations inside the recoverable state boundary.
- Effects and commit: External actions enter an effect outbox carrying sink, payload lineage, authority, idempotency, and release metadata before validation and possible release.The commit protocol separates local promotion from external release because released external behavior cannot generally be physically undone.
- Commit and recovery: Cordon uses a commit manifest and transaction state to recover staged work, automatically abort prepared transactions, revalidate validating transactions, and manually review partially executed ones.Effects that may have crossed an external boundary remain pending or require audit or compensation unless idempotency evidence supports safe handling.
5 Implementation
Cordon is implemented as a Python-heavy research prototype with a gRPC interface separating framework adapters from durable state and side-effect mediation. A small framework adapter intercepts tool invocation while sandboxing command execution and staging workspace changes.
- Prototype: Cordon comprises roughly 14.4 KLOC of handwritten runtime code and a 3.9 KLOC benchmark driver, primarily implemented in Python.The runtime includes the adapter, validation service, operation service, and shared transaction contracts.
- RPC interface: A protobuf/gRPC interface separates framework-facing adapters from the local service that owns durable state and side-effect mediation.The interface exposes validation-facing and operation-facing services for transaction lifecycle and effect handling.
- Framework integration: The framework adapter replaces normal tool invocation with a wrapper that records tool name, arguments, task identity, workspace, and authority context before forwarding calls.The bridge leaves the model loop unchanged while connecting framework calls to Cordon’s runtime paths.
6 Evaluation
Cordon is evaluated as a transaction boundary for containing cross-step risks, preserving usability, and supporting recovery across multi-tool agent workflows. It intercepts risky effects before commit, reduces model work in several execution modes, provides fast rollback, and preserves benign benchmark correctness, while its guarantees remain limited to mediated and observable operations.
- Experimental Setup: The evaluation covers 45 correlated-risk workflows across six agent domains, five deterministic rollback trajectories, and benign task-completion checks using consistent runtime and logging configurations.The correlated-risk suite combines nine defense-boundary categories with five transaction-level risk families.
- Security and Containment: Cordon intercepts all 45 correlated-risk cases before commit, whereas existing-defense strategy adapters prevent 14, miss 26, and detect 5 only after commit.The cases span local-view, effect-boundary, and post-hoc monitoring failure modes.
- Security and Containment: Cordon exposes staged, high-fanout deletion risk even when a cleanup command remains within an allowed workspace, then aborts before deletes become durable.The transaction view evaluates the composed delete set against a policy threshold rather than treating the command as locally permitted.
- Security and Containment: Cordon detects risks distributed across prior context, derived artifacts, command side effects, and pending external actions by validating lineage and effects as one composed flow.This task-level view differs from relying on a stronger classifier at a single prompt, tool, or output boundary.
- Limitations and Future Work: Cordon’s guarantees apply only to operations inside the mediated runtime whose mutations and effects are observable; opaque or unsupported external boundaries may fall outside containment.For such cases, the system records lineage, authority context, and recovery metadata for audit and compensation rather than assuming full reversibility.
7 Related Work
Cordon builds on work in transactions, provenance, agent runtimes, safety, and reference monitors, but applies these ideas to task-level semantic transactions for tool-call consequences.
- Transactions and recovery: Cordon adapts logging, commit, recovery, coordination-avoidance, and saga ideas to agent tool intents, result lineage, shadow state, staged effects, authority, and audit metadata.Its transaction object differs from conventional database or storage transactions.
- Provenance and flow: Cordon uses runtime-tracked result lineage as commit evidence for task-level state and effects rather than proving full noninterference.This connects provenance and information-flow concepts to transactional execution without claiming a full information-flow guarantee.
- Agent runtimes and benchmarks: Where prior agent systems make tool use a capability and evaluation target, Cordon targets the runtime substrate that stages, validates, commits, recovers, and audits tool-call consequences.The comparison spans agent reasoning-and-tool-use systems and benchmarks across software engineering, workplace, multi-turn API, and cross-application settings.
- Agent safety: Cordon complements agent-safety defenses by providing a commit and recovery abstraction across prompts, tools, local state, external effects, and delegated authority.The related work includes prompt-injection defenses, instruction hierarchies, approval, sandboxing, output guardrails, attack studies, and supply-chain scanners.
- Reference monitors: Cordon inherits reference-monitor mediation while making the task-level semantic transaction—not a syscall, permission check, or tool invocation—its unit of control.This aligns with mediation, capability restrictions, and well-formed transaction principles.
8 Conclusion
Cordon introduces semantic transactions that group agent execution state and effects into a single commit and rollback unit. Its evaluation shows improved containment and recovery for cross-step risks while preserving practical task correctness.
- Cordon groups tool intents, result lineage, staged local state, pending external effects, delegated authority, and recovery metadata into one commit and rollback unit.
- The runtime makes agent-produced consequences explicit before they become durable or externally visible.
- Cordon improves containment and recovery for cross-step semantic risks while preserving practical usability and benchmark-visible task correctness.