PaperlayerView exact revision on arXiv

Source-linked AI summary

Who May Release an Agent's Promise? Standing over Commitments in Multi-Party Chat

Lan Wei, Bingyu Shen, Jiaqi Tang, Qing Lu, Kuan Huang, Meng Xu, Miles Q. Li, Bin Hu, Boyang Li

arXiv:2610.21203v1cs.AIcs.CL

TL;DR

In shared-team chats, an assistant’s promise is owed to a particular creditor, raising the question of who has standing to release it. The paper tests this in controlled chat episodes and finds distinct patterns in how models mishandle releases.

  • Problem

    Shared-channel assistants make promises to particular people, but instruction-conflict rankings do not establish who may release a promise owed to someone else.

    Source: §1 · p. 1

  • Method

    The paper defines standing and tests scripted commitment-release episodes that vary the speaker, message type, policy, and delay.

    Source: §1 · p. 1, §2 · p. 3, §3 · p. 3

  • Results

    Across six models, smaller open models override creditors while larger models drop promises on anyone’s direct word; oracle information reduces unauthorized release but not override unless it reveals whether the promise was released.

    Source: §1 · p. 2

  • Takeaways & Limitations

    A self-kept commitment ledger removes override in four of five models and, with a release policy, matches or beats the best oracle store.

    Source: §1 · p. 2

    The evaluation is a synthetic, English-only workplace with scripted channels and replies, only the creditor responding, and mostly one-sample runs.

    Source: Limitations · p. 9

Abstract

from arXiv · show

When an assistant serving a team makes a promise to Alice, who may cancel it? We call this standing: only the creditor (the person owed) or someone the creditor or operator policy authorizes may release a commitment, regardless of rank. In a controlled chat environment we vary who cancels and separate two errors: unauthorized release (obeying someone without standing) and override (executing a released promise). Across six models, smaller open ones override the creditor (Qwen3.5-9B: 69%); larger ones drop promises on a peer's direct word (Qwen3.8-27B: 89%; gpt-6.1-sol: 83%); nearly all act on a bystander's "go ahead after all". Oracles dissociate the errors: stating the rule or the creditor curbs unauthorized release but not override, which the latter even raises in three of four models; among them, only knowing whether the promise is still owed cuts override. Enabling thinking moves smaller models the way scale does. A self-kept commitment ledger stops override in four of five models; with a one-paragraph release policy it matches or beats the best oracle store, raising gpt-6-luna's strict accuracy from 49% (policy alone) to 83%. Code, prompts, outputs and labels are released.

1 Introduction

In shared-team chats, a promise is owed to a particular person, so authority to release it depends on standing over that commitment, not rank. The paper defines this distinction and studies how agents handle release attempts.

1 Introduction

  • A promise is owed to its creditor, so a colleague’s release attempt depends on their relation to that commitment rather than their rank.A peer named by the creditor may have standing, while a manager may not.Source: §1 · p. 1
  • The paper defines standing over commitments and an environment of 1,440 episodes that separates unauthorized release, creditor override, and forgetting.The episodes vary who cancels, how they communicate, policy, and how long the promise is held.Source: §1 · p. 2
  • Across six models, smaller open models override creditors, larger models drop promises on anyone’s direct word, and nearly all obey a bystander’s reinstatement.A one-paragraph policy repairs larger models’ unauthorized release but not smaller models’ override.Source: §1 · p. 2
  • Oracle interventions separate the errors: knowing the rule or creditor identity curbs unauthorized release but not override, while knowing whether the promise was released does.Knowing whom the promise is owed to can even raise override in some models.Source: §1 · p. 2
  • A commitment ledger removes override in four of five models and, with the policy, matches or beats the best oracle store.The ledger supplies the state and the policy supplies the rule.Source: §1 · p. 2

2 Standing

Standing is specific to a speaker and a commitment: it belongs to the creditor, named delegates, or people authorized by operator policy. The message type determines whether the agent should execute, drop, consult, or verify.

2 Standing

  • A commitment is the agent owing a creditor an action once a specified condition holds.In this setting, the agent creates it by promising in response to the creditor’s request.Source: §2 · p. 2
  • Standing belongs to a speaker-commitment pair, and operator policy can determine who has authority over a commitment.The same colleague can have standing over one promise and lack it over another.Source: §2 · p. 2
  • A direct or implicit release has force only from someone with standing; a second-hand report calls for asking the creditor, while a factual claim calls for checking it.A reinstatement from a speaker without standing has no more force than that speaker’s release.Source: §2 · p. 3
  • The creditor rule differs from last-speaker-wins and higher-rank-wins heuristics, each of which fails in cells where the creditor rule does not.Manager cases distinguish standing from rank.Source: §2 · p. 3, Table 1 · p. 3

3 Environment

The environment uses scripted workplace chats to test whether agents handle commitment releases according to standing. It crosses release scenarios with policies, delays, and commitment types, then scores agent actions and communication.

3 Environment

  • Each scripted episode keeps the promise wording fixed, then includes delegation where applicable, cancellation, possible reinstatement, and a later condition-holds event.Short and long gaps contain one or twenty intervening steps, with filler that does not mention the commitment.Source: §3 · p. 3
  • The test set contains 1,080 episodes from a design crossing fifteen cells with two policies, two gaps, eight commitment types, and three surface variants.Two commitment types form the development split; the other six form the reported test split.Source: §3 · p. 3
  • The explicit policy allows the requester or a named delegate to cancel, denies managers authority by default, and directs checks with the requester for other cancellations.Under the silent policy, direct and implicit manager cells are excluded from metrics except the rank effect.Source: §3 · p. 3
  • Four open-weight models and two API models run the episodes, with the two Qwen models also differing in precision and server.Most runs use one sample with thinking off; the Qwen models use temperature 0.7.Source: §3 · p. 3
  • Programmatic signals score execution, dropping, early action, and verification, while a language-model judge assesses consultation and notification messages.Strict accuracy also requires telling the creditor when acting on a delegate’s cancellation or a true factual claim.Source: §3 · pp. 3–4
  • Override measures execution after a release by someone with standing, while unauthorized release measures unconsulted drops after a non-standing direct or implicit message net of baseline forgetting.Intervals are 95% bootstrap intervals clustered by commitment type.Source: §3 · p. 4

4 Two regimes

The models split between overriding a creditor’s release and dropping promises on a non-standing speaker’s direct word; a policy helps larger models but not smaller models’ override. Nearly all models also act on a bystander’s reinstatement.

4 Two regimes

  • 69% of runs saw Qwen3.5-9B carry out the promise after the creditor’s direct cancellation; Qwen3.5-9B and Gemma also override creditor or delegate releases in 67% and 53% without policy.With policy, the latter rates are 62% and 43%; transcripts show Qwen3.5-9B acknowledging cancellation and later executing when the condition arrives.Source: §4 · p. 4
  • 89% and 83% of runs saw Qwen3.8-27B and gpt-6.1-sol drop promises after a peer’s direct cancellation without policy; manager cancellations raised these rates to 97% and 100%.The Qwen family shifts from Qwen3.5-9B’s creditor override (69%) to Qwen3.8-27B’s net unauthorized release (64%).Source: §4 · p. 4
  • The policy repairs the larger models: both consult instead of dropping, reaching 63% and 81% strict accuracy versus 35% and 50% without it, but it does not repair smaller models’ override.For gpt-6-luna, policy raises override O from 21% to 49%.Source: §4 · p. 4
  • Without policy, models acted on a peer’s reinstatement in 67% to 100% of runs, usually before the condition held; only gpt-6.1-sol resisted, at 8%.Policy reduced reinstatement obedience for Qwen3.8-27B to 11%, but not for Qwen3.5-9B or Gemma (89% and 94%).Source: §4 · p. 4
  • Second-hand cancellation reports and claims of impossibility rarely prompted checks without policy, while policy raised consultation after relayed reports to 49%–100%.Without policy, consultation after relayed reports was at most 10% for the three smaller open models and gpt-6-luna; checks of impossibility claims were at most 35% for those four.Source: §4 · p. 5

5 What information fixes which error

The oracle interventions distinguish unauthorized release from override: rule and ownership information can curb unauthorized release, while tracking whether a promise was released is the intervention that reduces override for most models.

5 What information fixes which error

  • A sentence of principle reduced unauthorized release for Qwen3.8-27B from 64% to 37% and gpt-6.1-sol from 28% to 7%, while smaller-model override barely changed.Qwen3.5-9B override moved from 67% to 72%, and Gemma’s from 53% to 46%.Source: §5 · pp. 5–6
  • The ownership store reduced unauthorized release for most models but raised override for Gemma, Llama, and gpt-6-luna; stale open-commitment status led agents to execute after Alice cancelled.B3 unauthorized-release rates included 10% for Qwen3.8-27B, 0% for gpt-6.1-sol, and 49% for Llama.Source: §5 · pp. 5–6
  • Adding release status to the ownership store cut override by more than half for Qwen3.5-9B, Gemma, gpt-6-luna, and Qwen3.8-27B.The rates fell from 63% to 24%, 74% to 32%, 37% to 3%, and 9% to 0%, respectively.Source: §5 · p. 6, Figure 3 · p. 6
  • The errors dissociate: rule and ownership information curb unauthorized release, whereas status information reduces override; Llama’s override did not fall under any oracle.The B4 check-with-creditor note acted on unauthorized release, not override; the stated finding is that override reflects failure to track whether the promise remains owed.Source: Figure 3 · p. 6, §5 · p. 7

6 A ledger the agent keeps itself

An agent-kept ledger can help it remember release status, but without a release rule it records unauthorized messages as releases. Combining the ledger with policy improved strict accuracy over policy alone in all five tested models.

6 A ledger the agent keeps itself

  • The ledger records promise details and status after messages, while policy specifies who may release; together they require no oracle.The agent receives its ledger after every message and uses ledger_add and ledger_update tools.Source: §6 · p. 7
  • With a ledger but no policy, override fell from 67% to 6% for Qwen3.5-9B, 53% to 4% for Gemma, and 21% to 0% for gpt-6-luna.Llama recorded releases in 97% of runs but still acted on its ledger little (override 24%).Source: §6 · p. 7
  • Without policy, every model’s ledger recorded a non-standing message as a release in 42%–85% of runs, and net unauthorized release rose for Gemma and Qwen3.5-9B.The ledger made agents faithful to what they wrote down, but without a rule they wrote down whoever spoke last.Source: §6 · p. 7
  • With ledger and policy, strict accuracy exceeded policy alone in all five models, reaching 83% for gpt-6-luna from 49%.Four of five models exceeded their best oracle-store result without policy; Qwen3.5-9B matched its oracle result at 50%.Source: §6 · p. 7, Table 5 · p. 7

7 Discussion

The discussion distinguishes state-tracking failures from deference to speakers without standing: scale and reasoning improve the former but do not supply the rule. Builders should track both commitment status and who changed it, and scrutinize reinstatements as well as cancellations.

7 Discussion

  • Only a status line repairs smaller models’ override, while a rule, policy, or ownership store removes most unauthorized release in larger models.The authors characterize override as a state-tracking failure and unauthorized release as deference to whoever speaks.Source: §7 · p. 8
  • A store recording only the creditor trades unauthorized release for override; builders should also record commitment status and who changed it.A bystander’s “go ahead after all” warrants the same scrutiny as a cancellation.Source: §7 · p. 8
  • Thinking lowers override for Qwen3.5-9B from 67% to 33% and Gemma from 53% to 9%, but raises unauthorized release without policy.For two rerun models, paraphrases and other seeds preserve both errors and the policy’s failure to fix override; consultation frequency depends on wording.Source: §7 · p. 8

8 Related work

Related work treats authority as attached to speakers, instructions, resources, or permissions, and studies how agents retain state over time. This work instead locates authority in a speaker’s relation to a particular commitment and treats its ledger as a form of agent state.

8 Related work

  • Promise theory assigns the promisee power to demand performance and release the promisor, while social-commitment accounts assign release to the creditor or governing context.Dialogue theory also keeps a commitment store per participant (Hamblin, 1970; Walton and Krabbe, 1995).Source: §8 · p. 8
  • Prior multi-user work assigns authority to speakers, instructions, or resources; this work assigns it to a speaker’s relation to one commitment.Unlike prompt-injection settings, its speakers are legitimate team members (Greshake et al., 2023; Debenedetti et al., 2024).Source: §8 · p. 8
  • State-over-time research studies retained histories and memory, while this work treats its commitment ledger as agent state (Liu et al., 2024; Maharana et al., 2024; Wu et al., 2025).Agents may act on lapsed authority or keep revoked permissions live (Santos-Grueiro, 2026; Cerruti et al., 2026).Source: §8 · p. 8

9 Conclusion

The conclusion argues that standing, rather than rank, should determine who may release an agent’s promise. It contrasts promise-state failures with failures to apply the release rule, and identifies a self-kept ledger as a way to maintain that state.

9 Conclusion

  • Standing, not rank, should decide who may release an agent’s promise.Smaller models keep promises their creditor released, while larger or thinking models drop promises on anyone’s direct word.Source: §9 · p. 8
  • Nearly all models obey a bystander’s reinstatement of a promise.The conclusion says the rule repairs deference, while only state repairs override.Source: §9 · p. 8
  • An agent can keep commitment state in its own ledger and, given the rule, needs no oracle.Source: §9 · p. 8

Limitations

The paper’s evaluation is a synthetic, English-only workplace with scripted interaction and several constrained reply and episode designs. Its example illustrates how the assistant checks with the creditor, waits for the trigger, and then checks availability before acting.

Limitations

  • The evaluation is synthetic and English-only, with scripted channels and replies, only creditor responses, language-model-drafted strings, and one commitment type lacking the text to post.One author annotated the judge’s validation batch; most runs used one sample with thinking off, and the two Qwen models differ in precision and server.Source: Limitations · p. 9

A Environment details

  • The eight commitment types fix the promised action, check tool, trigger integration, cancellation utterances, and creditor replies; variants change people, channel, and wording.Episodes use scripted replies to direct messages or channel posts that mention the creditor; subsequent messages to the creditor receive only a thumbs-up.Source: A Environment details · p. 12

A.1 An example episode

  • Episodes keep each gap’s length and trigger index fixed, using filler chatter and lookup requests that never mention the commitment.In the example, the assistant asks Alice whether the promise remains binding, receives confirmation, and books after the agenda is final and the room is checked as free.Source: A Environment details · p. 12, §A.1 · p. 12

B Models and compute

Models ran across specified hardware and inference setups, with a cache supporting reproducibility; the experiments comprised 44,303 traces and 1,405,332 model calls.

B Models and compute

  • Open-weight models generally ran on one RTX 5090 with vLLM, with Qwen3.8-27B using 4-bit GGUF on llama.cpp and gpt-6.1-sol using its default temperature.Thinking was off for open-weight models except in the designated thinking runs; reruns on second machines agreed within intervals.Source: B Models and compute · p. 13
  • A cache keyed by episode, model, intervention, sample, and request allows every reported number to be rebuilt without a new model call.An episode took 28–43 calls on average, and a turn could chain up to eight tools.Source: B Models and compute · p. 13
  • Across all experiments, the runs comprised 44,303 episode traces and 1,405,332 model calls.Source: B Models and compute · p. 14

C Further results

This section presents further results and evaluation details on how policy, prompting, and a commitment ledger shape deference, relay accuracy, and overrides. It also reports validation and environment-related qualifications that bound interpretation of the findings.

C Further results

  • Without policy, Qwen3.5-9B scores 31% in CRED direct, while policy raises direct-peer accuracy from 11% to 75% for Qwen3.8-27B and from 17% to 83% for gpt-6.1-sol.Delegate cells reach at most 17% without policy, while gpt-6.1-sol reaches 100% in DELEG direct with it; FACT TRUE remains at most 22%, and policy does not repair smaller models’ creditor cells.Source: C Further results · p. 14, Table 8 · p. 16
  • The policy shifts behavior toward consultation, but Gemma still executes in 14% of direct creditor runs after being told to leave the promise; reinstatement obedience also persists.Without policy, “acted before the trigger” covers 83% of Qwen3.5-9B and 64% of Qwen3.8-27B REINSTATE runs. The B4 creditor-check note does not reduce override, and Qwen3.5-9B obeys a bystander’s reinstatement in 89% under B3+; the second-machine reruns agree within intervals.Source: C Further results · p. 14, Figure 5 · p. 15, Table 9 · p. 18
  • Longer gaps increase unauthorized drops for Llama and Qwen3.8-27B but reduce them for gpt-6-luna, so gap effects trade promise forgetting against wrongful-cancellation forgetting.Llama’s baseline drop rises from 61% short to 67% long, while gpt-6-luna’s falls from 44% to 28%; intervals are wide for rates concentrated in a few commitment types, and net-rate intervals overlap.Source: C Further results · p. 14, Figure 6 · p. 16, Figure 7 · p. 17

C.1 Reasoning and robustness

  • Thinking cuts override and bystander reinstatement obedience, but without policy it raises unauthorized release; with policy, strict accuracy rises for both tested models.Override falls from 67% to 33% for Qwen3.5-9B and 53% to 9% for Gemma without policy; policy accuracy rises from 44% to 60% and 59% to 65%, respectively. Thinking tracks cancellation status but, without a rule, defers to whoever spoke last.Source: §C.1 · p. 16, Table 10 · p. 18
  • Across paraphrased prompts and seed reruns, the two errors and policy’s failure to fix override persist, although wording changes consultation rates.Qwen3.5-9B overrides in 64%–72% of runs without policy and 62%–78% with it; gpt-6-luna’s net unauthorized release reaches 42% without policy, and Qwen3.5-9B asks the creditor in 17% versus 49% after a relayed report under paraphrased versus original policy.Source: §C.1 · p. 16, Table 11 · p. 19

C.2 Artifacts of the environment

  • Removing the post_announcement template artifact leaves the §4 conclusions intact and raises gpt-6.1-sol’s strict accuracy with policy to 90%.The template omits the text to post, leading several models to ask for it and then never post; without this type, net unauthorized release without policy is 42% for Qwen3.8-27B and 27% for gpt-6.1-sol [19, 32]. In false-claim runs, unanswered follow-up questions can make larger models’ fact-checking look worse: 50% of gpt-6.1-sol’s no-policy runs check the claim and still drop.Source: §C.2 · pp. 18–19, Table 12 · p. 19

D Annotation and judge validation

  • Judge agreement is near perfect for consultation and off-topic labels, while notification rates and strict accuracy in delegate and true-fact cells should be read as upper bounds.The judge is more liberal than the human annotator on notification; gpt-6-astra agrees with the judge on nearly every label, while gpt-6-luna is closer to the human on notification but not off-topic.Source: D Annotation and judge validation · p. 20, Table 13 · p. 20

F Prompts

  • The prompt materials define a release policy requiring creditor or named-delegate authority, distinguish oracle stores with and without status, and describe a self-kept commitment ledger.The ledger records promises and updates when they are released, carried out, or put on hold; the oracle status remains open until an authorized person releases the commitment.Source: F Prompts · pp. 20–21
  • The ledger prompt records who a promise is owed to and what was promised, then tracks status, who caused a change, and a short note.Statuses are open, released, done, or on_hold.Source: F Prompts · p. 21
  • The appended workspace policy permits cancellation only by the requester or a named delegate, denies managers authority unless named, and requires confirmation with the requester when others request cancellation.When a named delegate cancels, the assistant must inform the requester.Source: F Prompts · p. 21
  • The judge classifies assistant messages with three yes/no questions: whether they consult the creditor, notify them of a caused cancellation, and concern something off-topic.Consultation includes asking whether to proceed, hold off, or drop the commitment; notification requires both the cancellation and its cause.Source: F Prompts · p. 22

Related papers

Loading 2610.21203v1…