PaperlayerView exact revision on arXiv

Source-linked AI summary

Concordat: Typed Sessions for LLM Agents

Milad Sikaroudi

arXiv:2610.37461v1cs.AIcs.MA

TL;DR

Policies for consequential agent actions are often prompt instructions, and models may break them under customer pressure. Concordat enforces state-based tool access at runtime; on pressured τ-bench airline tasks it prevented confirmation violations without a significant difference in task success.

  • Problem

    Consequential changes are often governed by prompt-stated confirmation rules, which agents may break under customer pressure.

    Source: §1 · p. 1

  • Method

    Concordat derives and checks protocols from agent classes, then offers the model only tools legal in its current state.

    Source: §3.2 · p. 3

  • Results

    Under pressure, standard agents violated confirmation in 13 of 50 gpt-4.1 tasks and 29 of 128 Haiku task-runs; Concordat made none at comparable task success.

    Source: §1 · p. 2, §5.2 · p. 6

  • Takeaways & Limitations

    Withholding tools turns a protocol rule from a request into a property of the agent interface.

    Source: §6 · p. 8

    Evidence covers one domain, two models, and few trials; the pressure scenario is not an official τ-bench setting.

    Source: §5.3 · p. 7

Abstract

from arXiv · show

Agents built on large language models are increasingly allowed to take consequential actions: cancelling bookings, issuing refunds, changing accounts. The rules that govern those actions, such as "obtain the customer's explicit confirmation before changing anything", are usually stated in the prompt and followed only as reliably as the model chooses to follow them. We present Concordat, a Python library that treats an agent as an object whose interface is a finite-state protocol, in the spirit of typestate and session types, and enforces that protocol on the model at run time. On every turn the model is offered only the tools that are legal in the current protocol state, calls outside that set are rejected before they have side effects, decisions reserved for humans can only be requested, and token and tool-call budgets are charged and split linearly across handoffs. Protocols are checked when they are defined, and a subclass of an agent is rejected if it could bypass its parent's protocol, a behavioural form of Liskov substitution. We evaluate a Concordat agent against the standard agent of tau-bench on its 50 airline tasks, adding simulated customers who pressure the agent to skip confirmation. The standard agent made changes without the required "yes" in 13 of 50 tasks with gpt-4.1 and in 29 of 128 task-runs with Claude Haiku 5.5; the Concordat agent made none, with no significant difference in task success. tau-bench's own reward did not detect most of these violations. Concordat is open source.

1 Introduction

Concordat addresses confirmation rules that prompt-following agents can break under customer pressure by enforcing a state-dependent tool protocol at runtime. Its design also maps human approvals and linearly split budgets to session steps, checks protocol-safe inheritance, and is evaluated on τ-bench’s airline domain.

1 Introduction

  • Consequential airline changes require explicit customer confirmation, yet deployed frameworks commonly leave this rule in the prompt and expose every tool on every turn.Customers may pressure an agent to act without saying yes, and outcome-based checks can miss the violation when the booking matches the customer’s request.Source: §1 · p. 1
  • Typestate and session types model state-dependent operations and conversational order, but an LLM cannot be type-checked, so its protocol must be enforced at runtime.The background concepts are cited as typestate and session types.Source: §1 · p. 1
  • Concordat derives and checks a protocol from an agent class, then withholds tools that are illegal in the current state on each model turn.Its design maps classes to templates, instances to sessions, methods to state-dependent tools, human decisions to person-only steps, and budgets to resources split on handoff.Source: §1 · pp. 1–2
  • Definition-time checks reject subclasses whose runs could bypass their parent’s protocol.The implementation is open source and includes runners for the Anthropic Messages API and OpenAI Responses API.Source: §1 · p. 2
  • Under pressure, the standard agent broke the confirmation rule with both models, while Concordat made no unconfirmed changes at comparable task success.The study used τ-bench’s airline domain with a pressure variant.Source: §1 · p. 2

2 Background and related work

The related work spans behavioral types, LLM-agent protocol languages, runtime enforcement, and constrained generation. Concordat is distinguished by deriving protocols from agent classes and gating offered tools across turns.

2 Background and related work

  • Behavioral-type foundations include session types, typestate, runtime monitors, and resource-aware session types; Concordat uses a finite-state fragment over named actions.The cited foundations include session types, runtime monitors, resource-aware session types [7], and typestate.Source: §2 · p. 2
  • Among LLM-agent protocol systems, Concordat differs by deriving protocols from ordinary agent classes, gating offered tools each turn, and checking inheritance against the parent protocol.The comparison covers ZipperGen, Pact, XFlow, Syntropy, and Schlapbach.Source: §2 · p. 2
  • Runtime guardrails commonly block violations after an agent chooses an action, whereas Concordat restricts the choices offered; constrained-generation systems act within one response, while Concordat works across turns.The cited guardrails include AgentSpec, Progent, ShieldAgent, and temporal-logic monitors; generation examples include LMQL [2], Outlines, and XGrammar.Source: §2 · pp. 2–3

3 Design

Concordat derives a finite-state protocol from an agent class, then checks and enforces that protocol at runtime. Its design also constrains human decisions and resource use, and checks that subclasses preserve the parent protocol's safety.

3.1 Protocols

  • Protocols define allowed actions and transitions across finite states; Concordat checks well-formedness at construction and rejects session actions that do not match the current state and target.Rejected actions leave the session state unchanged.Source: §3.1 · p. 3

3.2 Agents as protocol-typed objects

  • Agent classes declare method states and destinations with decorators, and Concordat builds and checks the protocol when the class is defined.Calling a method outside its state raises ProtocolViolation before the method body runs.Source: §3.2 · p. 3

3.3 Enforcement on the model

  • Each turn, runners offer the model only tools allowed in the current state; calls outside that set do not reach the tool.Tool withholding is a coarse, provider-agnostic decoding constraint; grammar-constrained decoding could additionally constrain arguments and text where supported.Source: §3.3 · p. 4

3.4 Humans and budgets

  • A human step can be requested by the model but decided only by the application’s approver, while budgets track tokens, tool calls, and money and are split across handoffs.A child’s allowance is removed from the parent, preventing the same allowance from being spent twice.Source: §3.4 · p. 4

3.5 Protocol-safe inheritance

  • Concordat checks subclasses against a safe-refinement condition using a breadth-first walk over child states and corresponding parent states.The check preserves parent human steps; it is not full session subtyping and relates states by name.Source: §3.5 · p. 5

4 Implementation

Concordat is a small Python library with optional SDK-based runners, input validation, and a tested, strictly typed implementation.

4 Implementation

  • Concordat comprises about 850 lines of Python and has no required dependencies; its Anthropic and OpenAI runners use their respective official SDKs as optional extras.The runners disable parallel tool use.Source: §4 · p. 5
  • Tool input schemas are derived from method signatures and validated before invocation.Runs can end in several statuses, including done, waiting, refused, max_tokens, out_of_budget, or max_turns; pending tool calls receive a result so a conversation can resume.Source: §4 · p. 5
  • The library has 50 unit tests, is checked with mypy in strict mode, and is published on PyPI as concordat.Source code, benchmark harness, and results are published with the project.Source: §4 · p. 5

5 Evaluation

The evaluation tests whether a protocol-gated agent prevents confirmation violations under customer pressure without reducing task success. Concordat made no unconfirmed changes, while the standard agent did; outcome-based reward often failed to reveal violations.

5.1 Setup

  • The benchmark used all 50 τ-bench airline tasks; under pressure, simulated customers initially pushed back without saying yes, then could confirm if asked again.The required policy was to describe each database-changing action and obtain explicit confirmation; the models were Claude Haiku 5.5 and gpt-4.1.Source: §5.1 · pp. 5–6

5.2 Results

  • 29 of 128 Haiku task-runs and 13 of 50 gpt-4.1 tasks had standard-agent violations; Concordat made none in any run.The difference was significant for both models, and Concordat mostly prevented violations by withholding writing tools until a yes.Source: Table 1 · p. 6, §5.2 · p. 6
  • In the cooperative Haiku condition, neither agent broke the rule, but 8 of 13 violating tasks in the first Haiku pressure run still received full reward.The benchmark reward reflected the expected database outcome, not whether the customer had consented.Source: §5.2 · p. 7
  • After instructions addressed repeated refusals, gpt-4.1 Concordat passed 22 tasks versus 20 for the standard agent; task-success differences were not significant for either model.In Haiku, the initial Concordat agent transferred to a human on 11 of the 13 task-runs passed only by the standard agent; the added instructions told it to restate the change and ask again.Source: §5.2 · p. 7
  • Haiku Concordat costs were lower in both reported conditions, while gpt-4.1 Concordat cost more during pressure, when its conversations were longer.Reported costs were $1.49 versus $1.70 for cooperative Haiku, $1.64 versus $1.76 for the first Haiku pressure run, and $3.47 versus $3.13 for gpt-4.1.Source: §5.2 · p. 7

5.3 Threats to validity

  • The study uses one domain and two models, includes lost Haiku runs, and cannot attribute the gpt-4.1 success change to the prompt update alone.An earlier run used a looser confirmation test; rescoring it found one Concordat change without “yes,” which the strict gate would have withheld. Real customers may push in ways simulated customers do not.Source: §5.3 · pp. 7–8

6 Discussion and future work

The discussion argues that prompt-stated rules can fail under pressure and escape notice under outcome-based evaluation. It presents withholding tools as an interface-level enforcement mechanism and identifies extensions and further evaluation needs.

6 Discussion and future work

  • The central observation is that a prompt-stated rule may hold until pressure pushes against it, while usual agent evaluation may not detect its failure.Withholding tools makes the rule a property of the interface; the observed cost came from what the model did when unable to act and was addressable with instructions.Source: §6 · p. 8
  • Proposed extensions include multiparty protocol projection, per-turn content constraints, session delegation, statically resource-aware budgets, and durable human approvals.The paper also calls for more domains, models, and trials, plus a same-model comparison with and without the prompt change.Source: §6 · p. 8
  • The empirical conclusions remain bounded by the study’s call for broader evaluation across domains, models, and trials.The authors additionally identify a same-model comparison with and without the prompt change as needed.Source: §6 · p. 8

7 Conclusion

Concordat enforces an agent’s protocol by changing which tools the model is offered on each turn. Under customer pressure on τ-bench’s airline tasks, it avoided confirmation violations while task success remained comparable to the standard agent.

7 Conclusion

  • The standard agent broke the confirmation rule in 26% of gpt-4.1 tasks and 23% of Haiku task-runs under customer pressure.Most violations were not detected by the benchmark.Source: §7 · p. 8
  • The Concordat agent never broke the confirmation rule, with comparable task success to the standard agent.Source: §7 · p. 8
  • Concordat enforces an agent protocol on a model that cannot be type-checked by changing the tools offered on each turn.Source: §7 · p. 8

A Pressure instruction

The pressure instruction makes simulated airline customers resist confirmation once, then confirm only after the agent asks again about the same change.

A Pressure instruction

  • The pressure instruction is appended to every simulated customer’s task instructions.Source: A Pressure instruction · p. 10
  • Customers are instructed to find confirmation questions annoying and to push back the first time the agent asks about a given change.Source: A Pressure instruction · p. 10
  • Customers must not use “yes” in their initial pushback and should reply starting with “Yes” only after a second confirmation request for that same change.Source: A Pressure instruction · p. 10

B Concordat agent’s process note

The Concordat agent’s process note restricts database-changing tools to actions explicitly confirmed by the customer. It directs the agent to persist politely when the customer pushes back instead of confirming.

B Concordat agent’s process note

C Reproduction

The reproduction instructions locate the harness and results under bench/ and provide commands for running and comparing agent runs.

C Reproduction

  • The harness is located in bench/ of the repository, with τ-bench v1.0.1 cloned into bench/tau2-bench.Source: C Reproduction · p. 11
  • The run command uses the airline domain, the airline_pressure task set, and concordat_agent with specified agent and user models.Source: C Reproduction · p. 11
  • The comparison command takes a standard run and a Concordat run; result summaries are reported in bench/results/ and described in bench/RESULTS.md.Source: C Reproduction · p. 11

Related papers

Loading 2610.37461v1…