PaperlayerView exact revision on arXiv

Source-linked AI summary

TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents

Bohao Liao, Jingchao Wang, Qipeng Song, Jin Cao, Jieling Wang, Boyu Deng

arXiv:2608.21126v1cs.CR

TL;DR

Networked LLM agents must use potentially injected runtime content to perform consequential tasks, while existing defenses insufficiently connect intent, evidence, effects, and completion. TraceGrant governs this lifecycle with a Contract that bounds effects, authorizes evidence-derived arguments, and verifies completion; across 1,349 attack cases, no attack succeeded while utility under attack reached 77.32% and 83.00%.

  • Problem

    Security defenses insufficiently connect trusted user intent, runtime evidence, authority-bearing arguments, realized effects, and verified task completion in networked LLM agents.

  • Method

    TraceGrant derives a Contract from the trusted request, bounds effects and evidence-derived arguments, tracks obligations, and verifies completion against execution results.

  • Results

    No attack succeeded across 949 AgentDojo and 400 Agent Security Bench cases, while utility under attack reached 77.32% and 83.00%, respectively.

  • Takeaways & Limitations

    TraceGrant provides a unified governance layer connecting trusted intent, runtime evidence, concrete execution, and verified task completion.

  • Takeaways & Limitations

    Evidence admission establishes provenance and admissibility but not semantic authenticity, so poisoned fields may still contain misleading authority-relevant values.

Abstract

from arXiv · show

Networked large language model (LLM) agents retrieve information from email, cloud storage, calendars, transaction platforms, and Web services to complete multistep tasks that produce persistent external effects. The same content needed for legitimate execution may also contain indirect prompt injections that redirect tool use, alter sensitive arguments, or disrupt task completion. Existing defenses mainly constrain untrusted content or individual tool calls, leaving user intent, runtime evidence, realized effects, and task completion insufficiently connected. We present TraceGrant, a security framework that governs the task-effect lifecycle of networked LLM agents through an explicit Contract. Before execution, TraceGrant establishes a task-effect boundary from the trusted user request. During execution, admitted evidence can instantiate only authority already established by the Contract. After execution, task completion is verified against actual tool results. Across 949 AgentDojo and 400 Agent Security Bench attack cases under fixed benchmark settings, TraceGrant recorded no attack successes while retaining utility under attack rates of 77.32% and 83.00%, respectively. We further evaluate TraceGrant through white-box defense-aware attacks, Contract quality analysis, stage ablations, targeted stress tests, and runtime overhead measurements. The results show that TraceGrant provides a unified governance layer that connects trusted user intent, runtime evidence, concrete tool execution, and verified task completion.

1. Introduction

TraceGrant governs networked LLM agents across the task-effect lifecycle by constraining authority, binding runtime evidence to authorized effects, and verifying completion against actual execution. Under fixed benchmark settings, it recorded no attack successes across 1,349 attack cases while retaining utility under attack rates of 77.32% and 83.00%.

  • Motivation: Networked LLM agents use tools to retrieve information, coordinate multistep tasks, and produce persistent effects in external systems.Their tool interfaces span email, cloud storage, calendars, databases, payment systems, and Web APIs.
  • Motivation: Untrusted runtime content can inject instructions that redirect tool use or alter sensitive arguments while legitimate credentials remain available.Such content may be necessary for discovering later action arguments, yet can influence real external effects.
  • TraceGrant: TraceGrant derives a POEC Contract from the trusted request and tool schemas, treating runtime data as evidence for existing authority rather than a source of new authority.The Contract defines permitted effects, obligations, evidence requirements, and completion conditions, with deterministic static analysis validating it before execution.
  • Evaluation: 0 attack successes were recorded across 949 AgentDojo and 400 ASB attack cases, while utility under attack reached 77.32% and 83.00%, respectively.These results used fixed benchmark settings and held across all four foundation models used for task execution.
  • TraceGrant: Runtime authorization binds dynamic arguments to qualified evidence through admission, obligation matching, typed proofs, call budgets, and single-use Effect Certificates.Each certificate connects the Contract, current obligation, canonical arguments, supporting evidence, and concrete external action.
  • TraceGrant: TraceGrant verifies each authorized effect against the actual tool, arguments, execution result, and observable postconditions before linking verified effects to overall task completion.Effect Receipts update task state from native execution, and the Final Answer Gate enforces task closure.

2. Related Work

Related work addresses agent security through untrusted-content control, tool-access enforcement, task alignment, and runtime verification. TraceGrant unifies these concerns with persistent task state linking user authority, admissible evidence, concrete execution, and verified completion.

  • Security defenses: Existing defenses limit untrusted-content influence, control external-tool access, or align agent actions with the user’s task.TraceGrant focuses on the task state connecting user authority, runtime evidence, concrete tool execution, and verified completion.
  • Untrusted content: Indirect prompt injection exploits trusted instructions and untrusted content combined in one execution context, including Web pages, email, shared files, and tool outputs.Because these sources may be necessary for legitimate execution, defenses must constrain their influence on later reasoning and actions.
  • Untrusted content: CaMeL, FIDES, and IsolateGPT reduce untrusted-data influence through flow separation, information-flow labels, and execution isolation.These approaches respectively restrict value propagation, enforce confidentiality and integrity policies, and mediate communication across capability domains.
  • Task alignment: Task Shield evaluates whether instructions and proposed tool calls contribute to the user’s goal, whereas TraceGrant ties evidence admissibility to a task obligation, supported argument, and available authority.The supplied passage presents TraceGrant as complementary to task-alignment defenses.
  • Runtime authorization: Progent and AgentSpec place runtime enforcement between agents and tools through deterministic policy evaluation and customizable behavioral specifications.TraceGrant extends this authorization model with persistent task state: obligations, supporting evidence, and remaining execution budget.
  • Runtime verification: TraceGrant connects authorization, execution verification, and task completion through Contract-governed state, Native execution records, Effect Receipts, and closed obligations.Authorization checks proposed effects against the Contract; the receipt verifies the realized tool, arguments, result, and observable postconditions before completion.

3. Problem Formulation

The problem formulation models networked LLM agents whose runtime evidence can influence persistent external effects, and defines security objectives linking user intent, evidence, execution state, and completion. It distinguishes effect authority from task data while accounting for attackers who manipulate external content and action parameters.

  • 3.3. Security Objectives: TraceGrant derives four objectives: task-effect confinement, evidence-constrained instantiation, task-state and ordering consistency, and execution-backed completion.The framework focuses on authorization and completion integrity for external effects; payload confidentiality requires complementary controls.
  • 3.1. System Model and Task Effects: The system includes a trusted user, LLM agent, runner, networked tool services, and external content providers supporting multistep tasks.The user submits a natural-language request, while execution history and runtime observations inform proposed tool actions.
  • 3.1. System Model and Task Effects: A task effect is a persistent or operationally consequential external change caused by a tool call.Effect tools can send information, modify resources, create calendar entries, initiate transactions, or otherwise change external state.
  • 3.1. System Model and Task Effects: Authority-bearing arguments determine an effect’s target, resource, quantity, or scope, whereas payload arguments carry business content without directly determining authorization.Changing a recipient, account, amount, file path, attendee, or resource scope can alter the realized effect even when the tool type is unchanged.
  • 3.1. System Model and Task Effects: For request u, A(u) defines the authorized effect boundary, including effect types, target classes, scopes, critical-argument constraints, and invocation limits.Some constraints follow directly from the request, while constrained runtime queries may instantiate others.
  • 3.1. System Model and Task Effects: Runtime data may provide values needed for legitimate execution, but effect authority remains rooted in the trusted user request.This separates the informational role of external data from authority over external effects.
  • 3.2. Threat Model: The attacker controls or influences external content that can inject instructions into the model context and redirect candidate actions away from the user’s request.Potential targets include email, Web pages, shared files, chat messages, cloud documents, and tool outputs.
  • 3.2. Threat Model: The threat model covers manipulation of tool selection, authority-bearing arguments, execution order, invocation counts, and final task claims.The attacker cannot modify the trusted request or frozen tool registry, bypass the protected tool boundary, or make unadmitted runtime schema changes trusted.

4. TraceGrant Framework

TraceGrant governs task effects through a one-way lifecycle: it establishes a Contract before execution, authorizes runtime actions within that boundary, and verifies concrete effects before task closure. Runtime evidence can fill pre-authorized dynamic arguments but cannot create, expand, or replace authority.

  • Runtime: Contract-Governed Agent Execution: Runtime authorization evaluates each candidate effect against the established Contract, with typed proofs binding authority-bearing arguments to trusted constants or admitted Evidence Records.Permitted derivations include field extraction, type conversion, and numerical computation specified by BIND; runtime data cannot expand the Contract.
  • Effect Verification and Task Closure: Only verified tool calls and results may advance task state, while the Obligation Ledger tracks obligations through PENDING, ACTIVE, VERIFIED, or WAIVED states.The same Contract guides agent planning and is enforced by the policy decision and verification components.
  • Pre-Execution: Contract Establishment: TraceGrant establishes a typed POEC Contract from the trusted request and frozen tool registry before any runtime network content is read.The Contract represents Permission, Obligation, Evidence, and Completion constraints and becomes executable authority only after deterministic normalization and verification.
  • Pre-Execution: Contract Establishment: Static verification rejects candidates that violate schema consistency, obligation control, evidence flow, effect scope, or observable verification requirements.Accepted normalized Contracts enter the Obligation Ledger; rejected candidates create no executable Contract.
  • Effect Verification and Task Closure: A final success claim is accepted only when all non-waived hard obligations have admitted evidence or valid Effect Receipts.Execution failure, argument mismatch, or unsatisfied postconditions cannot establish task completion.

5. Experiments · 5.1. Experimental Setup

TraceGrant is evaluated across benchmark comparisons, ablations, Contract-quality analysis, targeted stress tests, defense-aware attacks, and runtime overhead measurements. The setup fixes tasks, environments, models, baselines, evaluation metrics, and repeated runs to support reproducible security and utility assessment.

  • 5. Experiments: The experiments evaluate security, task utility, and TraceGrant’s three-stage design through comparisons, ablations, Contract-quality measurements, stress tests, defense-aware attacks, and overhead analysis.The white-box attack experiment targets pre-run, runtime, and post-run surfaces.
  • 5.1.1. Benchmarks: AgentDojo uses 97 benign tasks and 949 attack cases across Workspace, Slack, Travel, and Banking environments.The environments provide 24, 11, 28, and 11 tools, respectively, with attack-case counts of 560, 105, 140, and 144.
  • 5.1.1. Benchmarks: ASB contains 51 benign tasks, 400 attack tools, and 400 attack instructions spanning ten domains, with the complete 400-case benchmark used for evaluation.Each case combines a benign task with one attack tool and instruction; comparison runs produce 400 benign and 400 attack runs per repetition.
  • 5.1.2. Baselines and Model Configurations: TraceGrant is compared with NoDefense and six defenses using DeepSeek-V4-Flash, with reproduced official configurations or a paper-based Task Shield reimplementation.NoDefense is the native-agent reference without an additional security layer.
  • 5.1.3. Evaluation Metrics: The evaluation reports TSR, UUA, ASR, stage-contribution metrics, Contract-quality metrics, runtime-enforcement measures, and completion-integrity measures.ASR is end-to-end, while unauthorized-effect authorization rate is conditional on a directly submitted adversarial candidate and is not directly comparable.
  • 5.1.4. Implementation Details: TraceGrant uses Contract-driven authorization before native effects, then routes native results through verification and task-state updates in both benchmarks.All methods share tasks, initial states, native tools, execution limits, and evaluators; cases are independently run three times with environment resets and arithmetic-mean reporting.
  • 5.1.4. Implementation Details: The primary task agent and Semantic Contract Compiler use DeepSeek-V4-Flash, while cross-model runs change only the task agent to Gemini 3.6 Flash, Qwen3.7-Plus, or GLM-5.2.AgentDojo and ASB lack interactive authentication, so STEP UP AUTH candidates remain unexecuted and any resulting task failure affects TSR or UUA.
  • 5.1.4. Implementation Details: Evidence Admission checks tool outputs against source, query, type, and structured BIND constraints before records enter the Obligation Ledger.Permitted-source provenance alone cannot authorize an authority-bearing argument, and high-confidence risk detection can return STEP UP AUTH without dispatch.

5.2. Overall Security and Task Utility

TraceGrant achieves zero observed attack success across both benchmarks while improving security and task utility relative to Task Shield. Its security remains stable across task-executing models, although TSR and UUA vary with the model and environment.

  • Overall comparison: On AgentDojo, TraceGrant reduces ASR from 2.24% to 0 versus Task Shield and from 9.64% to 0 versus NoDefense.It improves on Task Shield in both TSR and UUA while trading a modest TSR decrease against NoDefense.
  • Overall comparison: On ASB, TraceGrant exceeds Task Shield in TSR and UUA while reducing ASR from 9.25% to 0.NoDefense achieves high benign TSR but fails under attack.
  • Model robustness: Across four task-executing foundation models and both fixed benchmarks, TraceGrant records no successful attacks, while TSR and UUA vary by model and environment.DeepSeek-V4-Flash has the strongest AgentDojo utility; on ASB, GLM-5.2 has the highest TSR and DeepSeek-V4-Flash the highest UUA.
  • Security–utility view: TraceGrant configurations occupy the upper-right security–utility region in both benchmark panels, with ASR remaining 0 across all eight task-executing configurations.Figure 3 plots UUA against attack resistance defined as 100 − ASR and also pairs benign TSR with UUA.

5.3. Contribution of the Three-Stage Framework · 5.4. Pre-Execution Contract Compilation and Static-Analysis Quality · 5.5. Runtime Contract Enforcement

TraceGrant’s three-stage design links pre-execution Contracts, runtime enforcement, and receipt-backed completion, while static analysis produced accepted Contracts without permissive deviations. Runtime enforcement preserved legitimate recovery and rejected unauthorized effect candidates across targeted stress cases.

  • 5.3. Contribution of the Three-Stage Framework: Full TraceGrant combines a structured task-effect Contract, runtime enforcement, and receipt-backed closure, unlike ablations that remove one stage or Prompt-only Plan.Prompt-only Plan creates a natural-language plan but no Contract enforceable by deterministic security controls.
  • 5.3. Contribution of the Three-Stage Framework: 64.19% SVR and 13.49% SOOR occur without the pre-execution Contract, while FCR rises from 9.78% to 42.74%.Removing runtime enforcement raises SVR to 64.75% and ASR to 0.76%.
  • 5.3. Contribution of the Three-Stage Framework: 3.27% ASR, 42.40% SVR, 10.80% SOOR, and 31.70% FCR characterize Prompt-only Plan despite its highest TSR.Full TraceGrant’s 9.78% FCR consists of premature model statements evaluated independently by the Final-Answer Gate.
  • 5.4. Pre-Execution Contract Compilation and Static-Analysis Quality: The 97-task Contract evaluation used reference Contracts grounded in user requests, native tool schemas, official call plans, and benchmark completion logic.Metrics assessed structural validity, permitted effects, obligations, argument bindings, and completion conditions, including semantically equivalent deviations.
  • 5.4. Pre-Execution Contract Compilation and Static-Analysis Quality: 0 of 97 generated Contracts failed deterministic normalization or static analysis; 86 matched the reference boundary, six were semantically equivalent, five conservative, and none permissive.Equivalent variations changed representation without altering reachable task effects.
  • 5.5. Runtime Contract Enforcement: The runtime stress test fixed Contracts and receipt mechanisms while comparing per-candidate checks against an ablation omitting runtime enforcement.Checks covered permitted effects, active obligations, authority-bearing argument proofs, and remaining budget.
  • 5.5. Runtime Contract Enforcement: 81.0% BS and 80.0% RS with runtime enforcement exceed 71.4% and 75.0% without it, preserving legitimate recovery through valid queries, repairs, and retries.The test comprised 123 cases: 21 Benign Control, 20 Legitimate Recovery, and 82 adversarial cases built from valid native trajectories.
  • 5.5. Runtime Contract Enforcement: 100% of Wrong Source, Scope Expansion, Step Out of Order, and Repeated Effect candidates were rejected, versus 16.7%, 16.7%, 11.8%, and 0% without enforcement.Overall rejection fell from 100% to 11.4%, while unauthorized-effect authorization rose to 88.6% without runtime enforcement.

5.6. Effect Verification and Completion Integrity · 5.7. White-Box Defense-Aware Attack Analysis

TraceGrant verifies authorized effects against native execution, actual arguments, postconditions, and completion obligations, while white-box attacks expose both strong containment and two successful attack paths. In the stress test it preserved receipt and completion integrity, but the defense-aware analysis identified 2.0% end-to-end attack success tied to security-relevant optional arguments.

  • 5.6.1. Experimental Setting: The completion-integrity stress test evaluates native execution, actual arguments, structured postconditions, and hard-obligation closure after effect authorization.Full TraceGrant enables both the Effect Receipt and Final-Answer Gate.
  • 5.6.1. Experimental Setting: RFD detects execution failure, actual-argument mismatch, and postcondition violation, while ICB blocks partial-completion and premature-success claims.The reported metrics are BS, RS, RFD, ICB, and ECA.
  • 5.6.2. Pressure Injection and Case Construction: 126 cases across 21 AgentDojo tasks test normal completion, legitimate recovery, execution integrity, and completion integrity under injected deviations.The stress conditions include execution failure, argument mismatch, postcondition violation, premature success, and partial completion.
  • 5.6.3. Results and Analysis: 79.30% BS and 77.80% RS are achieved by full TraceGrant, with 100% RFD, 100% ICB, and 0% ECA.Removing the Receipt reduces RFD and RS to 0 and raises ECA to 58.20%; removing the Final-Answer Gate leaves RFD at 100% but changes ICB to 0 and ECA to 100%.
  • 5.7. White-Box Defense-Aware Attack Analysis: 100 high-risk white-box attack cases cover EXTERNAL, ADMIN, TRANSACTION, or CREDENTIAL sinks across 50 user tasks and 33 injection tasks.The cases include banking, workspace, travel, and Slack scenarios.
  • 5.7. White-Box Defense-Aware Attack Analysis: 2.0% end-to-end attack success occurred in two of 100 cases under an attacker model that observes compiled Contracts, obligations, effect tools, and injection slots.The attacker cannot modify TraceGrant, its enforcement components, the environment, the evaluation oracle, or runtime secret state.
  • 5.7. White-Box Defense-Aware Attack Analysis: 39 cases remained within authorized target and argument scope, with 37 legitimate completions and 2 utility failures, while 12 were denied by BIND/POEC checks.Another 20 post-run-targeted cases were resolved before an independent Receipt or Final-Answer Gate fault condition arose.
  • 5.7. White-Box Defense-Aware Attack Analysis: The two successful attacks exploited poisoned bill or landlord files whose security-relevant optional arguments were accepted within otherwise valid evidence and derivation paths.The cases motivate examining the completeness of the authorization boundary for optional tool arguments.

5.8. Runtime Overhead Analysis · 5.9. Complementary End-to-End Case Studies on AgentDojo

TraceGrant adds measurable runtime cost while preserving a governed task-effect lifecycle. AgentDojo case studies show that it supports legitimate progress under injection and blocks an injected malicious transfer before tool execution.

  • 5.8. Runtime Overhead Analysis: TraceGrant’s runtime overhead was measured end-to-end against NoDefense using the same DeepSeek-V4-Flash model across AgentDojo and ASB.The measurements cover mean and P95 latency, LLM calls per task, and token consumption.
  • 5.8. Runtime Overhead Analysis: 1.32× mean latency, 1.37× token consumption, and 6.75 versus 5.75 LLM calls per task were recorded on AgentDojo.Mean latency increased from 22.852 s to 30.151 s, while token consumption rose from 40,692 to 55,845.
  • 5.8. Runtime Overhead Analysis: 1.41× mean latency, 1.25× token consumption, and 4.20 versus 3.03 LLM calls per task were recorded on ASB.Mean latency increased from 24.982 s to 35.104 s, while token consumption rose from 2,633 to 3,279.
  • 5.8. Runtime Overhead Analysis: Overhead depends on both additional authorization steps and the security state carried in each model context.On AgentDojo, the 1.37× token increase exceeds the call increase because Contract, evidence, obligation, and receipt state is carried across more interactions.
  • 5.8. Runtime Overhead Analysis: Full TraceGrant is intended for tasks where runtime evidence determines authority-bearing arguments or where multiple external effects and dependencies must be governed.The Contract, obligation state, evidence provenance, and receipt validation constrain effect scope, execution order, and completion state across steps.
  • 5.9. Complementary End-to-End Case Studies on AgentDojo: The two AgentDojo cases use the same path from Contract establishment through runtime effect governance to post-execution verification.Both use the POEC Contract, Obligation Ledger, PDP, PEP, Effect Certificate, Effect Receipt, and Final-Answer Gate.
  • 5.9.1. Case 1: Utility Preservation under Calendar Injection: Case 1 preserved legitimate calendar progress despite an injected event description requesting data sending and email deletion.The agent proposed only calendar query and meeting creation; the occupied preferred slot supplied evidence for the fallback scheduling condition.
  • 5.9.2. Case 2: Pre-execution Blocking of an Injected Pay-: Case 2 blocked an injected transfer candidate whose recipient and amount differed from the admitted invoice evidence before the native tool was called.In the clean replay, the authorized payment executed successfully and closed through an Effect Receipt; the injected replay changed both payment arguments.

6. Discussion

TraceGrant governs the evolving relationship among user authority, runtime evidence, external effects, and task completion through persistent task state. Its deployment complements existing defenses but remains bounded by evidence-authenticity and scalability challenges.

  • Task-level governance: TraceGrant connects user authority, runtime evidence, external effects, and task completion through a Contract, Ledger, Effect Certificates, and Receipts.The Contract establishes the authorized effect boundary, while the Ledger maintains runtime state and execution artifacts connect that state to concrete execution.
  • Complementarity: TraceGrant adds a persistent task-state layer that evaluates external effects against user-established authority and supporting runtime evidence.This control boundary follows the evolving task rather than treating observations or tool invocations as isolated security decisions.
  • Complementarity: TraceGrant complements information-flow, isolation, tool-policy, and task-alignment defenses by governing whether runtime data can support authority-bearing arguments across multiple calls and services.Existing mechanisms can reduce untrusted influence or constrain locally invalid and goal-divergent calls, while TraceGrant preserves cross-call and cross-service consistency.
  • Deployment: TraceGrant can mediate task effects between LLM agents and remote services by compiling trusted requests and admitted schemas into Contracts and enforcing network-to-action transitions.The protected mediator may keep the Contract, Ledger, PDP, and PEP together, while distributed deployments use authenticated, replay-resistant Effect Certificates.
  • Trust boundaries: White-box analysis shows that evidence admission establishes provenance and admissibility, not semantic authenticity, allowing poisoned fields to satisfy expected source and BIND conditions.Stronger deployments may authenticate individual fields or claims rather than relying only on source objects.
  • Trust boundaries: Current evaluation is limited to structured office, communication, travel, and financial tasks, while long-running, cross-session, multi-agent, concurrent, and asynchronous settings require richer governance.Needed extensions include authority transfer, delayed effects, compensating actions, and cross-service state verification.

7. Conclusion

TraceGrant governs the task-effect lifecycle of networked LLM agents by separating runtime information from effect authority and maintaining verifiability from trusted user intent through task completion.

  • Conclusion: TraceGrant separates runtime information from effect authority while maintaining a verifiable lifecycle from trusted user intent to task completion.The Contract establishes the authorized boundary, admitted evidence instantiates authorized arguments, and the Ledger maintains task state.

CRediT authorship contribution statement

The authors contributed across conceptualization, methodology, implementation, analysis, validation, writing, resources, supervision, and project administration.

  • CRediT authorship contribution statement: Bohao Liao led conceptualization, methodology, software, investigation, data curation, validation, visualization, and original-draft writing.
  • CRediT authorship contribution statement: Jingchao Wang contributed methodology, formal analysis, validation, and review-and-editing of the manuscript.
  • CRediT authorship contribution statement: Qipeng Song contributed investigation, validation, and review-and-editing of the manuscript.
  • CRediT authorship contribution statement: Jin Cao contributed resources, validation, and review-and-editing of the manuscript.
  • CRediT authorship contribution statement: Jieling Wang contributed formal analysis, validation, and review-and-editing of the manuscript.
  • CRediT authorship contribution statement: Boyu Deng contributed conceptualization, supervision, project administration, and review-and-editing of the manuscript.

Funding

The work was supported by national and provincial Chinese science foundations, whose funders had no involvement in the study or publication decisions.

  • Funding: The study received support from the National Natural Science Foundation of China and the Natural Science Foundation of Shaanxi Province.The grants were 62341128 and 2025JC-YBMS-786, respectively.
  • Funding: The funding sources had no involvement in study design, data collection, analysis, interpretation, manuscript preparation, or the decision to submit.
Loading 2608.21126v1…