Cognitive Admission Control: Risk-Conditioned Assurance for Consequential Actions in Agentic Distributed Systems

1.1 Contributions

• The admission interface addresses how required evidence, unresolved conditions, and dispatch-time requirements should be represented, rather than introducing new access-control expressiveness or proving general agent safety.The evaluation establishes selected prototype behaviors, not a production safety rate.Source: §1 · p. 1, §1.1 · p. 2

1 Introduction

• CAC maps a typed proposal and modeled risk to assurance obligations, classifies each as satisfied, violated, or unknown, and binds successful admission to witnesses and dispatch-time guards.Missing evidence triggers a remediation contract; affirmative violation produces denial.Source: §1 · p. 1

1.1 Contributions

• The paper contributes a typed risk-conditioned admission calculus, refinement conditions for guarded dispatch, and a TypeScript prototype evaluated in controlled trials and complete-path timing samples.The prototype uses bounded witness search and persistent local replay protection.Source: §1.1 · p. 2

2 From Authority to Readiness

• CAC specifies the evidence lifecycle around policy predicates—acquisition, provenance, conflict handling, expiration, and binding to dispatch—rather than requiring a more expressive policy engine.Identity-and-scope checks cannot determine operational conditions absent from their inputs.Source: §2 · p. 2

2.1 Resources, Evidence, and Discharge

• More compute does not certify that a particular observation was made or remains current; distinct predicates require evidence with the appropriate semantics.The paper frames resource use as producing evidence that the evaluator checks against required obligations.Source: §2.1 · p. 2

2.2 Independent Enforcement

• The proposer may suggest proofs or checks, but cannot set required predicates or mark them satisfied; model confidence substitutes for external observation only when policy explicitly justifies that role.Admission verdicts and canonical witness selection are deterministic for fixed inputs, while certificates also use issuance time and a fresh nonce.Source: §2.2 · p. 2

2.3 Consequential and Lightweight Paths

• Consequential actions require obligation-based admission, while operations below the policy threshold may use ordinary authorization and lightweight mediation.Read-only operations are not automatically low-risk, and a classification miss falls outside the conditional guarantee for correctly classified actions.Source: §2.3 · p. 2

3.1 State and Trust Boundary

• The agent cannot modify the trusted evaluator, keys, policy, or gateway, and model fidelity requires the live external state and relevant transitions to be covered by the snapshot model.The agent’s internal belief is separate from the controller-visible snapshot and supplies no privileged access to external state.Source: §3.1 · p. 2

3.2 Intent and Action

• A proposal is normalized and schema-validated, while consequentiality depends on whether worst-case modeled loss crosses a policy threshold; unsupported transition models require conservative classification or escalation.The proposal’s canonical form includes every field affecting interpretation or execution.Source: §3.2 · p. 3

3.3 Risk and Policy

• The policy maps a proposal, snapshot, and risk profile to obligations; its risk coordinates are ordered policy categories and are not calibrated probabilities unless an estimator is separately validated.Profiles may be incomparable under the product preorder.Source: §3.3 · p. 3

3.4 Evaluation Context and Receipts

• Receipts bind claims to source, observation time, scope, and state version, while comparable timestamps require a declared clock domain and distributed deployments need authenticated normalization with conservative skew bounds.Authenticity establishes origin and integrity under registered trust roots, not claim truth.Source: §3.4 · p. 3

3.5 Obligations and Witness Eligibility

• Obligations specify predicates, acceptable evidence classes, scope, freshness, and set constraints; witness validity checks source separation or other declared constraints, so receipt count alone does not establish independence.Both positive and negative witnesses must meet declared validity requirements.Source: §3.5 · p. 3

3.6 Structural Epistemic Fault Domains

• A structural cut of at least k excludes decisive corruption by fewer than k modeled roots only when erroneous approvals are covered, exposure maps are conservative, and the coalition rule matches actual authorization.This is a structural guarantee, not statistical independence.Source: §3.6 · p. 4

4.1 Required Obligations

• Required obligations constrain admission, while advisory obligations yield diagnostics and cannot override a separately violated requirement.Policies may also require dual control when modeled risk exceeds autonomous authority.Source: §4.1 · p. 4

4.2 Discharge Semantics

• Positive and negative witnesses yield satisfied or violated outcomes when only one polarity is present; opposing witnesses yield conflict, and neither yields unknown.Canonical witness selection occurs after polarity is established; invalid, stale, incompatible, or missing evidence can leave no usable witness.Source: §4.2 · p. 4

4.3 Declarative Admissibility

• Admission requires valid authorization and static compliance, complete obligation resolution, satisfied required obligations, and compliant guards and invocation envelope.Admissibility is independent of operational budget and cannot establish obligations absent from policy.Source: §4.3 · p. 4

4.4 Operational Decisions and Remediation

• Unresolved obligations produce typed acquisition requests or reviewer escalation; decisive violations deny, successful checks permit, and bounded evaluation failure aborts.Each remediation turn captures a fresh evaluation context; useful completion still depends on available evidence and a sufficiently stable environment.Source: §4.4 · p. 5

4.5 Certificates and Expiration

• The certificate binds the proposal, witness digest, guards, policy epoch, authority context, and validity times; the earliest supporting-receipt expiry bounds its lifetime.A distributed clock must account conservatively for uncertainty when checking expiration.Source: §4.5 · p. 5

4.6 Gateway Validation and Dispatch

• The gateway validates live context and guards, then consumes a single-use nonce before dispatch; consumption and forwarding are not atomic, and guard reads are not atomic with target execution.A crash between consumption and forwarding can lose the operation; preserving conditions through the effect requires further mechanisms.Source: §4.6 · p. 5

5.1 Information and Non-Substitution

• An authorization mechanism that sees only a projection shared by ready and unready states cannot establish a readiness predicate absent from that projection.CAC cannot admit the unready state if a required obligation is soundly discharged only when that predicate holds.Source: §5.1 · p. 6
• Equal resource budgets do not determine admission when feasible evidence-acquisition procedures differ; a compensatory scalar score can also admit while a required obligation remains unsatisfied.The budget result assumes feasible procedures; the score result concerns attainable sequences where unrelated proxy features can grow without bound.Source: §5.1 · p. 6

5.2 Admission and Enforcement

• A PERMIT result from the specified algorithm implies admissibility and a valid manifest witness for every required obligation, assuming complete resolution, sound validation, and successful guard and envelope checks.This is a refinement result for the specified algorithm, not a proof that evidence is true or that an implementation meets every premise.Source: §5.2 · p. 6
• Modeled safety at the evaluated state requires evidence soundness and policy adequacy; external safety additionally requires model fidelity and preservation or atomic revalidation through the effect.These assumptions are not established by a certificate signature, and the prototype is not a verified implementation of the full specification.Source: §5.2 · p. 6, §5 · p. 6
• Envelope dispatch preserves manifest coverage only under correct gateway checks and the template’s semantic-coverage and guard-preservation assumptions.Parameter bounds or an approval signature alone do not prove semantic coverage.Source: §5.2 · p. 7
• Fail-closed guard checks reject dispatch when a required guard is false or unevaluable, while a durable shared nonce store permits at most one gateway dispatch per certificate.These are conditional properties; nonce consumption does not guarantee exactly-once effects or successful execution, and a crash can lose an operation.Source: §5.2 · pp. 6–7

5.3 Monotonicity and Structural Cuts

• With proposal, policy epoch, and non-risk inputs fixed, a threshold policy’s obligation set is monotone in comparable risk profiles.The proposition gives no result for incomparable profiles or changing non-risk inputs.Source: §5.3 · p. 7
• Under conservative exposure, closed causal accounting, authorization alignment, and verifier soundness, fewer than k active modeled roots cannot induce a decisive false approval when the structural-cut bound is at least k.The bound covers modeled roots, not omitted common causes, and gives no failure probability.Source: §5.3 · p. 7

6 Reference Controller and Trust Boundary

• The implementation separates controller packages, but network confinement and authenticated remote interfaces remain deployment requirements.Figure 1 marks the intended deployment boundary; package separation alone does not establish those requirements.Source: §6 · p. 7

6.1 Trust Requirements

• The enforcement TCB comprises the policy resolver, evidence evaluator, mint, gateway, and replay store; external identity, time, telemetry, and topology services remain trusted inputs.The persistent local-file replay store passed an eight-process race and restart test, but its guarantees do not establish distributed linearizability or behavior under hardware failure.Source: §6.1 · pp. 7–8

6.2 Specification Algorithm

• Admission denies failed schema, authorization, or static-compliance checks; unresolved obligations escalate or defer, and unverified coverage, guards, or issuance bounds abort before permit.The algorithm mints a certificate only after required obligations are discharged and the final checks succeed.Source: §6.1 · p. 8, §6.2 · p. 8

6.3 Implementation Coverage

• The prototype implements typed receipts, signatures, guard templates, nonce consumption, bounded witness search, and fail-closed unsupported guards.Its normal permit path mints exact-action certificates; envelope utilities conservatively require readmission when a proposal changes, and 133 tests do not prove conformance to the full calculus.Source: §6.3 · p. 8

• The corrected CACBench suite contains thirteen constructed local failover state machines, not a representative sample of operational incidents.It includes useful completion, harmful execution, refusal, and ambiguous-response cases.Source: §7 · p. 8
• Scenarios model replication, standby health, rollback evidence, and independent control of initial evidence and acquisition; underprepared targets can supply missing telemetry, while unavailable sources cannot.Dispatch drift takes the candidate offline and revocation removes actor authority immediately before dispatch; the target can acknowledge a harmful effect or lose a response after a successful change.Source: §7 · pp. 8–9
• The correlated-witness case gives three approving sources one modeled root against a required structural cut of two, paired with an independent-root healthy case.These synthetic fixtures test declared exposure maps without language models, a formal solver, or deployed telemetry services; historical diagnostics remain archived and are not pooled into the corrected comparison.Source: §7 · p. 9

8.1 Execution and Observation

• Across 2,730 trials, thirteen local state machines and thirty parameter seeds test controller behavior against a privileged observer of target effects.The runner uses a local model rather than a deployed service, and no language-model API is invoked.Source: §8.1 · p. 9
• The observer labels effects from pre/post world snapshots and counters, while matched hooks inject state drift or revoke authority before each controller’s final gate.Response status is kept separate from completion and harm; the schedule does not test the later interval between forwarding and effect application.Source: §8.1 · p. 9

8.2 Comparators and Ablations

• LivePolicy rechecks authorization and typed observations but lacks certificates and structural cuts; four CAC ablations remove guards, cuts, remediation, or evidence typing.The outcome protocol reports counts without population-level confidence intervals or significance claims; archived historical results are excluded as unreliable evidence.Source: §8.2 · p. 9, §8.3 · p. 10

8.3 Outcomes and Reproducibility

• The reproducibility protocol saves traces and hashes, independently validates trial and timing counts, and reports 133 passing tests plus strict TypeScript checking.The historical 5,261-record batch cannot be repaired retrospectively, and its statistical and cost reports are not evidence for the corrected results.Source: §8.3 · p. 10

9.1 Completion, Refusal, and Harm

• Across 390 CAC trials, 120 effects complete without modeled harm and none are harmful; LivePolicy also completes 120 but admits 30 correlated-witness harmful effects.AuthOnly attempts all 390 effects and produces 180 harmful effects and 180 completions without modeled harm; these counts do not establish general utility over a competent live-policy check.Source: Table 2 · p. 10, §9.1 · p. 10

9.2 Isolated Mechanism Contrasts

• Mechanism contrasts find 30 harmful actions without guards, with wrong-class evidence, or without structural cuts; remediation raises completion from 90 to 120 in underprepared intents.CAC rejects a correlated cut of one but completes thirty independent-witness trials; unavailable evidence still blocks thirty otherwise-safe intents.Source: §9.2 · p. 10

9.3 Response Semantics and Boundaries

• Response codes, attempts, completion, and harm diverge in benign-failure and lost-response cases, while the corrected results establish behaviors only in a controlled model.Operational reliability still requires real workloads, deployment-level observers, and target-side concurrency tests.Source: §9.3 · p. 11

10 Complete Local Execution Costs

• Measurements used three fresh processes and 1,000 iterations per workload for one, four, or eight obligations and matching signed receipts; the archive retains all 9,000 samples.The setup was macOS/ARM64 with Node.js v25.2.1 and an Apple M4; host repetitions were not pooled into a population confidence interval.Source: §10 · p. 11

10.1 Measurement Boundary

• Each complete-path iteration resolves policy, discharges obligations, builds a witness manifest, mints a fresh certificate, reads live state, and invokes the gateway with that certificate.The gateway checks signature, binding, authorization, guards, time, and policy epoch; it persists a spent-nonce record before invoking an instrumented target callback.Source: §10.1 · p. 11
• The timed interval runs from resolution through awaited target return, includes local guard reads and persistent replay protection, and excludes evidence acquisition, inference, remote execution, and replay-check timing.The callback increments an execution counter rather than mutating a database.Source: §10.1 · p. 11

10.2 Scaling and Limits

• Separate sweeps time eligibility, full discharge, encoding, and complete manifests across receipt counts; EFD cut computation remained two across voter and root sizes of two through eight.Full-discharge timing includes eligibility and canonical selection, so the measured components are not a nonoverlapping decomposition.Source: §10.2 · p. 11
• Full-discharge medians rise from 0.072–0.079 ms for one receipt to 67.31–72.69 ms for twelve, supporting explicit input limits rather than large-pool extrapolation.Variation across three processes also cautions against treating one median or p99 as a stable service-level objective.Source: §10.2 · p. 11

11 Integration with Execution Systems

• A CAC certificate authorizes an attempt at a bounded operation; storage or workflow runtimes must still enforce isolation and settlement rules.An admitted migration may conflict with another transaction before commitment.Source: §11 · p. 11
• Atomic target-side preconditions can preserve certified versions at the effect’s linearization point, but multi-resource guards require a suitable transaction or coordination protocol.Checking one resource version does not atomically validate an arbitrary multi-resource guard set.Source: §11 · p. 12
• A capability broker can supply authentication, confinement, and revocation while CAC supplies evidence requirements and interpretation; this integration was not evaluated as a deployment.Source: §11 · p. 12
• Lessons and incident analyses may propose obligations, but active policy changes require governing approval; revisions to trusted configuration may invalidate existing certificates.Source: §11 · p. 12

12 Discussion and Limitations

• CAC exposes the obligations behind admission but cannot ensure policy completeness; omitted dependencies, permissive entailment, or incomplete envelope proofs can permit harm despite syntactic correctness.Source: §12 · p. 12
• Signatures establish provenance, not sensor truth, while structural-cut coverage depends on conservative exposure maps and coalition rules matching actual authorization.Undisclosed common dependencies can invalidate the modeled bound, and reconciliation cannot repair arbitrary coordinated falsehoods.Source: §12 · p. 12
• Conjunctive policies can block indefinitely when witnesses are unavailable, and bounded attempts do not guarantee completion; evidence collection may dominate controller processing.Diagnostic admission also needs a well-founded dependency discipline or bounded failure path.Source: §12 · p. 12
• The prototype uses small modeled preconditions and serial effects, not real replication, fencing, partitions, or recovery; its local callback and timing do not establish production reliability or high-throughput scaling.Source: §12 · p. 12
• Further validation should test separate services, realistic workloads, partial failures, crashes, distributed replay stores, post-forwarding races, and representative scenario sampling.The text also calls for comparison with a neighboring deterministic admission implementation and real proposer/verifier execution.Source: §12 · p. 12
• Multi-step migrations and progressive rollouts need fresh admission at relevant transitions and separate recovery semantics; monitoring properties remain outside the model.Source: §12 · p. 12

13 Related Work

• CAC’s distinction from proof-carrying code is its evidence-acquisition protocol and dispatch binding, including time-sensitive observations and verifier receipts; it inherits the need to justify policy.Prior systems already address environmental access conditions, proof checking, deterministic admission, repair, commitment-time authorization, structural cuts, and capability boundaries [4] [7] [11] [13].Source: §13 · pp. 12–13

14 Conclusion

• Across the tested suite, CAC and the live-policy baseline achieve equal completion, while structural-cut enforcement blocks the constructed correlated-witness failure; practical value depends on evidence availability and cost.The conclusion limits these findings to controlled experiments and local dispatch behavior.Source: §14 · p. 13

A.1 Projection and Budget Counterexamples

• Two snapshots sharing authorization fields but differing in fencing cannot be distinguished by that authorization; equal observation budgets can likewise yield different evidence outcomes.A falsely signed fencing assertion defeats the safety premise, and an inaccessible required source can prevent either procedure from obtaining admission.Source: §A.1 · p. 14

A.2 Monotonicity Scope

• A scalar risk score can exceed a threshold while a required predicate fails, whereas an indicator encoding the full conjunction preserves that condition.The threshold result fixes the rule base and non-risk inputs; changing obligations or freshness semantics falls outside its scope.Source: §A.1 · p. 14, §A.2 · p. 14

A.3 Quorum Extension

• Adding an independent voter does not raise the cut if the coalition rule still permits approval by the original correlated pair; requiring two disjointly exposed members yields a cut of two under the stated coverage assumptions.Source: §A.3 · p. 14

A.4 Conflicts, Expiration, and Envelopes

• Opposite-polarity witnesses require an unknown verdict rather than identifier-based polarity selection, and the lower freshness bound excludes receipts dated after evaluation.Cross-host time comparison depends on normalization assumptions; exact proposal binding also cannot compensate for omitted guards or incomplete witness coverage.Source: §A.4 · p. 14

A.5 Bounded Exhaustive Cross-Checks

• Finite checks cover combinations and 348,488 fault states, finding that minimum coalition coverage agrees with direct propagation of faults to voters, and that no sub-cut fault set covers a decisive coalition.They also verify the quorum-extension counterexample and threshold monotonicity for all 216 comparable pairs in a three-coordinate, three-level risk domain. These finite checks neither prove the unbounded results nor test the TypeScript implementation.Source: §A.5 · p. 15

B Illustrative Policy Contract

• The failover policy example separates zero-lag evidence from fencing and target identity, requires guards or atomic preconditions, and shows that a valid certificate expires or becomes unusable when bound conditions change.The corrected local study does not validate real primary fencing or exclude concurrent database writes.Source: B Illustrative Policy Contract · p. 15

C Open Problems

• Dependency annotations provide candidate guards, not proof of completeness, and multi-resource guards need target-side preservation; risk classification must conservatively handle indirect effects and unresolved scope.Source: C Open Problems · p. 15
• Witness selection and fault-cut computation can be combinatorial, while recursive diagnostics may deadlock; sound approximation, bounded failure paths, and validated exposure maps remain open needs.Exposure maps must match actual evidence paths and authorization coalitions, but neither attestation nor empirical correlation studies prove all common causes are enumerated.Source: C Open Problems · p. 15