One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

Gaston Besanson

Source-linked AI summary

One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

Gaston Besanson

arXiv:2608.18360v1Aug 18, 2026cs.SEcs.AIcs.CY

TL;DR

Agentic systems often apply multiple stateful pre-action controls whose remediations can change what other controls evaluate. This paper formalizes that coupling and proposes remediate-and-regate composition, showing that remediation order matters because the implemented operators do not commute.

Problem
The underexplored gap is composing heterogeneous, stateful pre-action controls when one remediation mutates the action, evidence, or context evaluated by another.
Method
The paper formalizes remediation-induced control coupling and uses a remediate-and-regate protocol that re-evaluates controls after remediation.
Results
The implemented evidence-substitution and resource-downroute remediations do not commute, making remediation order part of control-plane semantics.
Takeaways & Limitations
A fixed remediation order and post-remediation re-evaluation are required for sound composition in the implemented bounded, idempotent setting.
Takeaways & Limitations
The work does not solve arbitrary non-idempotent remediators, cycles, global termination, unique fixed points, confluence, concurrent state updates, or multi-agent serializability.

Abstract

from arXiv · show

Agentic AI systems take consequential actions governed by more than one pre-action control at once: authority, resource, and evidence gates that can admit, degrade, or remediate an action before it executes. This paper's central object is remediation-induced control coupling: a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment. We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting under its stated assumptions. We further show that the two implemented remediation operators (evidence substitution and resource-budget downroute) do not commute -- a finite-model checker finds concrete counterexample instances -- making remediation order part of the control-plane semantics rather than an implementation detail. A governed evidence buffer that trusts its own most recent admitted write is a further instance of the same problem at the level of state -- current admissibility does not imply future reference trustworthiness -- and is vulnerable to poisoning from declared-uncovered defect classes; two mitigations reduce, not eliminate, that exposure. Supporting results establish the exact condition under which positive-weight linear aggregation of gate outcomes can compensate a member veto, a unified cross-control Evidence Set, and that composition manufactures no new detection coverage, reported honestly. Empirically, on a deterministic open-data artifact composing three published engines unmodified, CH1-CH5 meet their registered decision rules across all 30 pre-registered seeds; CH6 does so under W1 but not under the smaller W2 workflow, reported as such. This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.

1 Introduction

The paper studies heterogeneous, stateful pre-action controls whose remediation can mutate the action, evidence, or derived context evaluated by other controls, invalidating earlier judgments and creating order-dependent behavior. It formalizes this coupling, proposes remediate-regate composition, and supports its contributions with deterministic open-data experiments using three unmodified engines.

Novelty: Heterogeneous control semantics, control-local state, action and evidence mutation, and derived-context recomputation distinguish the underexplored problem from established composition literatures.The paper explicitly does not claim to invent pre-action-control composition or that composition itself is untreated.
Motivation: Remediation can invalidate other gates’ judgments: evidence substitution changes order quantity, authority-relevant order value, and resource-budget predictions before execution.Evaluating all gates once on the original action can therefore judge an action different from the one executed.
Contributions: The paper formalizes remediation-induced control coupling and evaluates a remediate-regate protocol that re-evaluates executing actions under the current idempotent setting.The protocol addresses the core problem that one control’s action transformation can invalidate another control’s earlier judgment.
Contributions: Governance state can become contaminated when admissible but uncovered defects enter future remediation state, motivating explicit trust policies for state updates.The paper treats state contamination as a further contribution alongside non-compensatory joins, unified evidence lineage, and no-manufactured-coverage verification.
Empirical scope: The empirical artifact composes three published Apache 2.0 engines unmodified using deterministic open data, with CH1–CH8 hypotheses preregistered before corresponding code execution.The artifact supports the paper’s mechanism demonstration rather than a claim about production prevalence.

2 Model and terminology

The model represents actions, contexts, evidence, and gate-local state explicitly, with soundness requiring every gate to approve the executed action at execution time. Its central concept is remediation-induced control coupling: one control’s remediation can change inputs evaluated by another control, making composition order-sensitive.

Core model: An action includes its context and finite evidence set, while each gate returns admit, substitute, degrade, escalate, or block using gate-local state.Evidence records include payload and metadata such as source, timing, version, and lineage, identified by content-addressed eids.
Soundness: Per-action soundness requires the executed action to satisfy every gate at execution time under the state then in force.The definition is per action; stream-level ordering across actions is explicitly out of scope.
Remediation-induced coupling: Remediation transforms an action, often changing its context, and can couple controls when another gate’s judgment differs before versus after that transformation.The evidence gate uses substitution, while the resource gate uses downroute; the central intuition is that remediation changes inputs consumed by other controls.
Coupling graph: The coupling graph links a remediating control to any downstream control whose judgment can change, including DQ → Authority and DQ → Resource in the current example.The concept applies beyond the paper’s named SARC variants to any pre-action control whose remediation changes a value another control reads.
Composition problems: Composition ranges from judging an unchanged action to enforcing intersecting hard constraints, with progressively harder problems arising when controls transform the action.For hard requirements, executability lies in F = F_authority ∩ F_resource ∩ F_evidence.

3 Hard constraints versus compensatory aggregation

The section defines composition by joining gate responses under a restrictiveness order, yielding an ordinal min-like admissibility rule. It characterizes exactly when weighted additive aggregation can admit vetoed profiles and reports exhaustive finite-grid confirmation, while distinguishing formal profiles from simulated decision instances.

Hard constraints: The composed response is the join of gate responses under admit ⊑ substitute ⊑ degrade ⊑ escalate ⊑ block, and admission is determined by whether that join lies in Exec.The winner gate is any argmax, with ties recorded.
Compensatory aggregation: A weighted additive aggregator admits a vetoed profile if and only if its threshold does not exceed L* = max_j L_j, whereas min never admits one for any positive threshold.Here L_j is the largest score achievable when gate j is vetoed.
Hard constraints: The join is the ordinal form of min on admissibility, generalizing the rule that any failed predicate blocks rather than treating additive scoring as inherently unsound.The linear-family lemma instead exactly characterizes when additive aggregation preserves the declared veto semantics.
Compensatory aggregation: 48 of 98 Held profiles were compensated at the strongest weighted-score grid cell, while exhaustive checking confirmed proposition_1_holds_exhaustively = True.The 98-profile denominator counts the discrete grid’s Held population, not simulated traffic instances.
Compensatory aggregation: The formal 48-of-98 result and simulated traffic counts use different denominators and are therefore not comparable measurements.The paper explicitly avoids conflating these quantities under one name.

4 Single-remediator composition

Single-remediator composition is order-invariant and no more permissive when gates do not rewrite inputs, but evidence substitution can alter values another control evaluates. Under bounded, idempotent remediation with recomputation and final regating, the protocol is per-action sound within its stated scope.

Single-remediator composition: Under non-rewriting gates, the composed verdict is invariant to evaluation order and duplication, and adding a gate never increases permissiveness.An exhaustive finite-response-lattice check covered 17,151 individual checks, all_hold = True.
Single-remediator composition: Evidence substitution can change order quantity, order value, and predicted spend, creating remediation-induced coupling with downstream controls.The evidence gate returns substitute with a governed value v′, defining ρsub(a) = a[v →v′], and c(ρsub(a)) may differ from c(a).
Soundness conditions: Per-action soundness follows when deterministic, bounded, idempotent, governed, recomputed, finally regated, and nonconcurrent conditions all hold.The theorem evaluates every gate on the final executable action, while the join preserves every Held verdict.
Soundness conditions: The soundness claim excludes concurrent state mutation between final evaluation and execution; stream-level concurrency lies outside the theorem’s scope.This is the explicit A7 boundary on the theorem’s applicability.

5 Multi-remediator composition

The second workflow adds resource-budget downrouting alongside evidence substitution, and the two remediation operators do not commute. Their order must therefore be specified, versioned, and auditable, although a fixed order is not a general solution for three or more operators.

5 Multi-remediator composition: Resource-budget downrouting scales committed quantity to fit remaining weekly cost and carbon budgets, then recomputes context before re-gating.This operator applies the remediate-and-regate pattern to a different action field than evidence substitution.
5 Multi-remediator composition: The two implemented remediators can disagree by order because a downstream budget check may evaluate a value before another remediation corrects it.This non-commutativity formally justifies the preregistered ordering of evidence gate first, then resource gate.
5 Multi-remediator composition: When remediation operators do not commute, their ordering is governance policy and must be specified, versioned, and auditable.A fixed order is required for the two operators implemented here, but with three or more operators one remediation can make an earlier operator relevant again.

6 Stateful governance and evidence-buffer contamination

The governed evidence buffer can be contaminated because admission for the current action does not guarantee future reference trustworthiness. In 30-seed experiments, quarantine and rolling-median mitigations reduced poisoning under W1, while the preregistered rule was unsupported under W2.

Governance state: Admission determines current participation, whereas promotion into persistent remediation state requires stronger trust because the record can influence future actions.The buffer trusts its most recent admitted write when substituting for a later violation.
Evidence-buffer contamination: The buffer is sound against covered stale, superseded, contradictory, and malformed defects but vulnerable when an uncovered corrupted value passes the gate’s predicates and is admitted.This mechanism generalizes conceptually to caches, agent memories, feature stores, retrieval memories, policy state, and evidence registries without claiming their prevalence matches the experiment.
Mitigations: The implemented buffer-side mitigations are a quarantine window requiring three consecutive consistent admits and a rolling median-of-3.Both are external buffer-wrapping adapters rather than changes to the sarc_dq.gate package.

7 The unified Evidence Set

The unified Evidence Set emits one record per decision, joining gate evaluations, remediation details, and final outcomes while preserving ground-truth limitations. Its composed readout must explicitly report declared uncovered classes as uncovered, a property verified across every swept seed.

Record structure: Each decision record joins action context, per-gate inputs and verdicts, the final join, the winning gate, and ordered remediation operators.Evidence sections include substitution pre- and post-values, buffer keys, and record eids; resource sections include predicted cost, carbon, and budget state.
Coverage reporting: Ground-truth labels are never pruned, so declared uncovered classes remain uncovered in the composed readout.The readout must state this limitation honestly rather than implying that composition creates coverage.
Verification: The honest-readout property is established by a structural tautology and machine-verified across every swept seed.The full proof is provided in Appendix A.

8 Empirical validation

The preregistered artifact evaluates CH1–CH8 across 30 seeds using three unmodified published engines on open payload data with synthetic metadata. CH1–CH5 meet their registered rules, while CH6 meets them under W1 but not W2; the study reports these results as mechanism evidence rather than production-prevalence claims.

Experimental protocol: All hypotheses, seeds, weights, workflows, contamination measures, mitigations, and CH2 semantics were committed before corresponding results entered the repository.The artifact composes three published engines installed unmodified over open payload data with a declared synthetic metadata layer and injector.
Main results: CH1–CH4 meet their registered decision rules: remediate-regate yields zero executed gate violations, CH3 has zero false holds, and CH4 preserves union coverage without detecting uncovered classes.CH1 records 30/30 seeds with zero violations; CH3 reports a 30-seed false-hold rate of 0.000000; CH4 reports union_ok on 30/30 seeds and zero detection for declared uncovered classes.
Remediation and evaluation: CH2 demonstrates that post-remediation single-pass evaluation can be unsound, with remediate-regate and single-pass differing or exposing an audited violation in S4.The result is specific to the artifact’s construction and does not establish production frequency.
Control composition: CH5 finds compensation empirically unsafe, while CH7 shows that the two implemented remediation operators do not commute.These findings concern the implemented artifact and do not generalize to arbitrary remediation operators.
Buffer contamination: CH6 demonstrates buffer-poisoning propagation through governed remediation state and mitigation under W1, but the result is NOT SUPPORTED as written under W2.The section explicitly presents W2 as the concrete negative-results case and does not claim enterprise prevalence.
Robustness: CH8’s robustness readout tests each hypothesis’s registered decision rule across all 30 seeds and, for CH6, both workflows.The section identifies this as the cross-seed robustness result, with Table 7 providing the readout.

Appendix A

Appendix A reports machine-checked and generated support for the paper’s control-composition claims, while marking several results as checked-scope-only. It confirms the main 30-seed decision-rule results, including the W2 exception for CH6, and documents concrete coupling hazards and mitigations.

Soundness results: Single-pass composition is unsound under substitution in the implemented construction, whereas remediate-and-regate is sound under the stated checked-scope conditions.Single-pass soundness under gate invariance is retained only as a sufficiency result; necessity was retracted.
Evidence integrity: Evidence Set composition provides identity commitment and integrity relative to a content-addressed store, but not byte reconstruction, with support limited to checker-adjacent tests.The claim is retagged checked-scope-only after independent review.
Remediation coupling: The two remediators do not commute, so the implementation’s fixed remediation order is part of the control-plane semantics.The non-commutation result is machine-checked exhaustively.
Additional checks: Buffer contamination exists, both mitigations reduce it, compensation can admit vetoed actions over the full discrete grid, and composition manufactures no new coverage.The no-coverage result is described as machine-checked and tautological; compensation is reported as exhaustive.
Empirical checks: Across all 30 seeds, CH1–CH5 meet their registered decision rules, while CH6 meets them under W1 but not under W2.This result is reported as a W2 exception rather than generalized beyond the tested workflows.

Claims versus non-claims · 9 Related work

The paper’s contribution is the composition problem created when heterogeneous pre-action controls interact, not the novelty of each ingredient individually. It claims bounded soundness for remediate-and-regate and implemented order sensitivity, while limiting broader safety and convergence claims.

Claims versus non-claims: The implemented remediation operators are non-commutative, but the paper does not claim that all remediation operators are non-commutative.It also does not claim general convergence for arbitrary remediator systems.
Claims versus non-claims: Remediate-and-regate is sound in the current one-shot setting, whereas single-pass control can become unsound after remediation.The paper does not claim that all single-pass systems are unsound.
Claims versus non-claims: Composition preserves only member-control coverage and does not guarantee complete safety.The paper’s stated result is that composition manufactures no new detection coverage.
Claims versus non-claims: Evidence Sets preserve identity commitments, while hashes alone do not reconstruct source bytes and hard controls require non-compensatory feasibility semantics.The paper also does not claim that the demonstrated buffer-poisoning mechanism generalizes beyond its stated setting.
9 Related work: Edit automata (Ligatti, Bauer & Walker, doi 10.1007/s10207-004-0046-8) provide the canonical suppress, insert, or substitute enforcement vocabulary instantiated here for single pre-action decisions.The paper relates its gates to Schneider’s security automata, which monitor action sequences and can transform or block them (doi 10.1145/353323.353382).
9 Related work: The governed-buffer vulnerability is structurally analogous to trusting an admitted value without independent corroboration, while quarantine applies multi-observation-before-trust to a numeric buffer.The paper explicitly avoids claiming that the two threat models are identical.
9 Related work: The paper’s novelty is not any individual ingredient, but the specific composition problem created by their interaction.Related concepts include runtime enforcement, heterogeneous enterprise pre-action controls, rewriting, state-based policy, audit provenance, and Evidence Sets.

10 Limitations and open theory · 11 Conclusion

The paper concludes that remediation-induced changes make prior governance judgments contingent, so remediation order and future trust require explicit semantics. Its bounded semantics does not resolve general stateful composition, concurrency, or convergence, and its empirical claims remain limited by synthetic metadata and workflow-specific evidence.

10 Limitations and open theory: The evaluation uses open payloads with synthetic metadata, declared injection rates, cold-start resource estimates, and no prevalence claims.Stream-level budget ordering effects are defined away per action, and S4 is explicitly constructed.
10 Limitations and open theory: CH6’s mitigation holds on every seed under W1 but not W2, where the smaller per-seed substitution population sometimes produces zero poisoning events.This workflow dependence limits the scope of the mitigation-holds claim.
10 Limitations and open theory: The five-level response order is an operational policy for this composition plane, not a universal semantic ordering for other systems.Other systems may use different multi-remediator compositions.
10 Limitations and open theory: Some symmetric t-intervals for low non-negative-count metrics extend slightly below zero without indicating negative measurements.The intervals reflect symmetry around small sample means and were computed without truncation or bootstrap re-estimation.
11 Conclusion: Remediation can change the action, evidence, or context evaluated by another control, making prior judgments contingent on the governed object’s version.When multiple remediation operators exist, their ordering can affect the final governed action.
11 Conclusion: Promoting admitted information into persistent governance state requires distinguishing current admission from future trustworthiness.The conclusion identifies this distinction as another consequence of stateful composition.
10 Limitations and open theory: The paper establishes bounded compositional semantics for the current setting while leaving general convergence, concurrency, delegation, and arbitrary stateful remediation open.The unresolved theory requires fixed-point semantics, termination, confluence, cycle detection, state consistency, serialization, and concurrent multi-agent coordination.

A Proofs · CH7 (multi-remediator order dependence) · B Artifact manifest.

The proofs establish scoped guarantees for aggregation, remediation soundness, provenance, and coverage, while CH7 machine-checks that evidence substitution and resource downroute are order-dependent. The artifact manifest fixes the released engines, commits, licenses, preregistration hash, and seed for reproducibility.

A Proofs: The linear weighted-sum aggregator admits a vetoed profile exactly when τ ≤ L*, whereas min preserves veto unconditionally for τ > 0.Here L* = W − min_i w_i; the corrected lemma distinguishes exact block vetoes from the broader Held class.
A Proofs: Single-pass unsoundness is certified only for the implemented substituting-DQ construction: placing the cap between pre- and post-substitution values yields divergent admit or compliance outcomes.The construction is instantiated as S4 across 30 seeds; it does not claim arbitrary economics or gate implementations.
A Proofs: Under its stated one-shot branch and external DQ predicate contract, remediate_regate is sound because Phase II re-evaluates all three gates on the remediated action, context, and evidence.The theorem is checked-scope-only, and the join preserves every Held verdict rather than admitting an action held by any Phase-II gate.
A Proofs: The revised evidence schema records substitution provenance through pre-evidence identifiers and write-log events, but its certified scope is field presence and deterministic commitments, not byte reconstruction.The change addresses the review finding that content-addressed hashes commit to content without carrying original bytes or metadata.
A Proofs: Composition manufactures no detection coverage: the composed detected-class set equals the union of member gates’ detected classes, including all 30 swept seeds.Declared uncovered classes therefore remain uncovered, and the union property is machine-checked by construction and tripwire tests.
CH7 (multi-remediator order dependence): CH7 machine-checked a concrete non-confluent instance: evidence substitution and resource downroute can produce different outcomes depending on remediation order.Both operator orderings were evaluated over a 243-point finite grid, with the sample counterexample independently re-derived.
B Artifact manifest.: The artifact manifest records Apache-2.0 licensing, pinned engine commits and versions, prereg_v1_sha, and seed 26313.The listed engines are sarc-governance 0.4.1, sarc-dq 0.1.0, and sarc-governance 0.3.0 as shown in the manifest passages.

C Statistical methodology (V3 gate) · Validation note

The artifact uses preregistered 30-seed sampling and runtime-computed two-tailed 95% t-intervals, while four commissioned automated review rounds documented corrections and reproducibility evidence. Validation remains limited because automated review does not replace human peer review and adjudication was not independent.

C Statistical methodology (V3 gate): 30 seeds were frozen before Phase 3, and confidence intervals use exact runtime two-tailed 95% t-intervals with df=29.The sampling used random.Random(26313) without replacement; intervals were computed as mean +/- t_crit(df=29, alpha=0.05) * (stdev / sqrt(30)).
C Statistical methodology (V3 gate): The exact t critical value replaced a rounded constant that could shift confidence-interval endpoints by up to 3.77e-6.The exact value was obtained with scipy.stats.t.ppf(0.975, 29).
Validation note: Four commissioned adversarial automated review rounds informed corrections to claims, proofs, provenance, and reproducibility checks.The full reports, protocols, evidence, and process provenance are available in the companion repository.
Validation note: The terminal review reports independent replication and adversarial review across four rounds under the published protocols and identifies the corresponding report and evidence files.The supplied passages specify repository locations for the round-one through round-four reports, JSON mirrors, and evidence.
Validation note: Review protocols were authored before each round, commissioned by the author, and executed by a separate vendor’s automated agent in fresh sessions using only the public repository.Adjudication between rounds was performed by the same assistant that authored the protocols and was not independent; mechanical review claims are rerunnable from the repository.
Validation note: Versions 0.4 and 0.5 revise framing, positioning, related-work coverage, formal precision, and terminology while leaving measured results, claim semantics, proof-status tags, and counts unchanged.The revisions followed commissioned second and third review rounds.
Validation note: The draft fixes or weakens findings F1-F6 under the review policy and applies proof-tag reclassifications without claiming more than the review certified.The listed reclassifications include checked-scope-only for Proposition 3 and Lemma 1 and sufficiency-only for Corollary 1.