safety security
The Agent’s Tools Get a Mechanical Safety Boundary
A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.
Summary
A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.
Prompt-level rules are fragile when an agent can invoke consequential tools. This work places a formal execution harness between reasoning and action. Capabilities, approvals and budgets become marks in a Petri net; a transition fires only when its prerequisites remain present, so an injected request cannot talk its way past missing or already spent authority. Treating tool outcomes as uncontrollable, the conventional supervisor enforces the specified safety rules under four stated assumptions. The paper also shows that the most permissive safe supervisor can become needlessly intrusive when the agent replans after refusal, and derives a value-threshold refinement for a given proposer. In an autonomous-release example, safe deployment requires a step that can still be refused after rollout begins. This is a formal design under explicit assumptions, not universal certification of agent systems.
Why it matters
A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.
Limits and context
- Capabilities, approvals and budgets become marks in a Petri net; a transition fires only when its prerequisites remain present, so an injected request cannot talk its way past missing or already spent authority.
- This is a formal design under explicit assumptions, not universal certification of agent systems.
Key claims
A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.
Qualification: Capabilities, approvals and budgets become marks in a Petri net; a transition fires only when its prerequisites remain present, so an injected request cannot talk its way past missing or already spent authority.
Evidence: source-2026-10-24-002
Sources
- arXiv preprint 2610.31376, original v1arXiv · primary research
Corrections
No corrections have been recorded for this story.