ARCHIVES

1. Agentic Control Plane. AgentGovBench, 2026. Source revision e0ce93ae1753. URL: https://github.com/agentic-control-plane/agentgovbench.
2. Agentic Control Plane. Agentic Control Plane: Governance model and AgentGovBench score-card (v0.2.6). https://agenticcontrolplane.com/benchmark, 2026. Accessed 2026- 09-28.
3. Victor Barres, Honghua Dong, Soham Ray, Xujie Si, and Karthik Narasimhan. τ 2-bench: Eval-uating conversational agents in a dual-control environment. arXiv preprint arXiv:2506.07982, 2025. arXiv version inspected: v1. URL: https://arxiv.org/abs/2506.07982, arXiv: 2506.07982.
4. Ilan Beer, Shoham Ben-David, Cindy Eisner, and Yoav Rodeh. Efficient detection of vacuity in temporal model checking. Formal Methods in System Design, 18(2):141–163, 2001. doi: 10.1023/A:1008779610539.
5. Roy Betser, Amit Giloni, Shamik Bose, Sindhu Padakandla, Chiara Picardi, Lidor Erez, and Roman Vainshtein. Agentrim: Tool risk mitigation for agentic ai. arXiv preprint arXiv:2601.12449, 2026. Findings of EMNLP 2026 (per arXiv comment); arXiv version in-
spected: v2. URL: https://arxiv.org/abs/2601.12449, arXiv:2601.12449.
6. Luca Beurer-Kellner, Beat Buesser, Ana-Maria Cre¸tu, Edoardo Debenedetti, Daniel Dobos, Daniel Fabian, Marc Fischer, David Froelicher, Kathrin Grosse, Daniel Naeff, Ezinwanne Ozoani, Andrew Paverd, Florian Tramèr, and Václav Volhejn. Design patterns for securing llm agents against prompt injections. arXiv preprint arXiv:2506.08837, 2025. arXiv version inspected: v3. URL: https://arxiv.org/abs/2506.08837, arXiv:2506.08837.
7. Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Ti-wari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. Why do multi-agent llm systems fail? In Advances in Neural Information Processing Systems (NeurIPS), 2025. arXiv version inspected: v3. URL: https://arxiv.org/abs/2503.13657, arXiv:2503.13657.
8. Edward Y. Chang and Longling Geng. Mnemosyne: Agentic transaction processing for vali-dating and repairing ai-generated workflows. arXiv preprint arXiv:2607.00269, 2026. arXiv version inspected: v3. URL: https://arxiv.org/abs/2607.00269, arXiv:2607.00269.
9. Zhaorun Chen, Mintong Kang, and Bo Li. ShieldAgent: Shielding agents via verifiable safety policy reasoning, 2025. URL: https://arxiv.org/abs/2503.22738, arXiv:2503. 22738.
10. Moonwon Choi, Seokho Jeong, and Seunggeun Lee. ResidualAuth: What authorization state must language agents preserve under revocable delegation?, 2026. URL: https://arxiv. org/abs/2609.08062, arXiv:2609.08062.
11. Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-Béguelin. Securing AI agents with information-flow control, 2025. URL: https://arxiv.org/abs/2505.23643, arXiv: 2505.23643.
12. CrewAI. CrewAI, 2026. Source revision 4ed2abc7bbf5. URL: https://github.com/ crewAIInc/crewAI.
13. Alejandro Cuadron, Pengfei Yu, Yang Liu, and Arpit Gupta. Saber: Small actions, big errors – safeguarding mutating steps in llm agents. arXiv preprint arXiv:2512.07850, 2025. arXiv version inspected: v1. URL: https://arxiv.org/abs/2512.07850, arXiv:2512.07850.
14. Panduranga Sai Varma Dantuluri and Jyotirmoy Sundi. Delegation without trust: An empirical gap analysis of identity, authorization, and runtime governance in multi-agent LLM systems, 2026. URL: https://arxiv.org/abs/2609.00267, arXiv:2609.00267.
15. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design. arXiv preprint arXiv:2503.18813, 2025. arXiv version inspected: v2. URL: https://arxiv.org/abs/2503.18813, arXiv:2503.18813.
16. Edoardo Debenedetti, Jie Zhang, Mislav Balunovic´, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents. In Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024. arXiv version inspected: v3. URL: https://arxiv. org/abs/2406.13352, arXiv:2406.13352.
17. deepset. deepset/prompt-injections. Hugging Face dataset, 2023. Revision 4f61ecb. URL: https://huggingface.co/datasets/deepset/prompt-injections.
18. Runzhi Deng, Yiming Zhong, Fang Zhao, and Pan Zhou. Do not restart: Residual completion for stateful agent handoffs. arXiv preprint arXiv:2609.13800, 2026. arXiv version inspected: v3. URL: https://arxiv.org/abs/2609.13800, arXiv:2609.13800.
19. Jack B. Dennis and Earl C. Van Horn. Programming semantics for multiprogrammed compu-tations. Communications of the ACM, 9(3):143–155, 1966. doi:10.1145/365230.365252.
20. Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, and Igor Mordatch. Improving factuality and reasoning in language models through multiagent debate. In Proceedings of the 41st International Conference on Machine Learning (ICML), volume 235 of Proceedings of Machine Learning Research, pages 11733–11763, 2024. arXiv version inspected: v1. URL: https://arxiv.org/abs/2305.14325, arXiv:2305.14325.
21. Google. Agent Development Kit (ADK) for python. https://github.com/google/adk-python, 2026. Commit 044a1ec, accessed 2026-09-28.
22. Guardrails AI. Guardrails: Adding guardrails to large language models. https://github. com/guardrails-ai/guardrails, 2026. Commit 06d0ff2, accessed 2026-09-28.
23. Norm Hardy. The confused deputy: (or why capabilities might have been invented). ACM SIGOPS Operating Systems Review, 22(4):36–38, 1988. doi:10.1145/54289.871709.
24. Sirui Hong, Mingchen Zhuge, Jiaqi Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. Metagpt: Meta programming for a multi-agent collaborative framework. In International Conference on Learning Representations (ICLR), 2024. arXiv version inspected: v7. URL: https://arxiv.org/abs/2308.00352, arXiv: 2308.00352.
25. Amjad Ibrahim and Yong Li. Overlaying governance: A compositional authorization frame-work for delegation and scope in agentic AI, 2026. URL: https://arxiv.org/abs/2606. 03518, arXiv:2606.03518.
26. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama Guard: LLM-based input-output safeguard for human-AI conversations, 2023. URL: https://arxiv.org/abs/2312.06674, arXiv:2312.06674.
27. Invariant Labs. Invariant Guardrails: Contextual guardrails for securing agent systems. https://github.com/invariantlabs-ai/invariant, 2026. Commit 2340fe2, accessed 2026-09-28; Invariant Labs acquired by Snyk, June 2025.
28. Zimo Ji, Daoyuan Wu, Wenyuan Jiang, Pingchuan Ma, Zongjie Li, Yudong Gao, Shuai Wang, and Yingjiu Li. Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework, 2026. URL: https://arxiv.org/abs/2601.11893, arXiv:2601.11893.
29. Yue Jia and Mark Harman. An analysis and survey of the development of mutation testing. IEEE Transactions on Software Engineering, 37(5):649–678, 2011. doi:10.1109/TSE.2010. 62.
30. Sayash Kapoor, Benedikt Stroebl, Zachary S. Siegel, Nitya Nadgir, and Arvind Narayanan. Ai agents that matter. arXiv preprint arXiv:2407.01502, 2024. arXiv version inspected: v1. URL: https://arxiv.org/abs/2407.01502, arXiv:2407.01502.
31. Anuj Kaul, Qianlong Lan, and Pranay Gupta. Behavioral governance for autonomous AI agents: The AgentBound framework, 2026. URL: https://arxiv.org/abs/2606.30970, arXiv:2606.30970.
32. LangChain. Deep Agents, 2026. Source revision 0c756c4f8037. URL: https://github. com/langchain-ai/deepagents.
33. LangChain. LangGraph, 2026. Source revision 7daa3ab49d67. URL: https://github.com/ langchain-ai/langgraph.
34. Guohao Li, Hasan Abed Al Kader Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. Camel: Communicative agents for "mind" exploration of large language model society. In Advances in Neural Information Processing Systems (NeurIPS), 2023. arXiv versioninspected: v2. URL: https://arxiv.org/abs/2303.17760, arXiv:2303.17760.
35. Hao Li, Xiaogeng Liu, Hung-Chun Chiu, Dianqi Li, Ning Zhang, and Chaowei Xiao. DRIFT: Dynamic rule-based defense with injection isolation for securing LLM agents, 2025. NeurIPS 2025. URL: https://arxiv.org/abs/2506.12104, arXiv:2506.12104.
36. Junyi Li, Xiaoxue Cheng, Wayne Xin Zhao, Jian-Yun Nie, and Ji-Rong Wen. HaluEval: A large-scale hallucination evaluation benchmark for large language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023. URL: https://arxiv.org/abs/2305.11747.
37. Lifei Liu and Haoran Yu. Attesting outputs and delegation ancestry in multi-agent AI systems, 2026. URL: https://arxiv.org/abs/2608.30387, arXiv:2608.30387.
38. Ting Liu. From tool connection to execution control: Benchmarking security invariants in MCP-style agent runtimes, 2026. URL: https://arxiv.org/abs/2606.29073, arXiv: 2606.29073.
39. Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, Shudan Zhang, Xiang Deng, Aohan Zeng, Zhengxiao Du, Chenhui Zhang, Sheng Shen, Tianjun Zhang, Yu Su, Huan Sun, Minlie Huang, Yuxiao Dong, and Jie Tang. Agentbench: Evaluating llms as agents. In International Conference on Learning Representations (ICLR), 2024. arXiv version inspected: v3. URL: https://arxiv.org/ abs/2308.03688, arXiv:2308.03688.
40. Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegr-effe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Shashank Gupta, Bod-hisattwa Prasad Majumder, Katherine Hermann, Sean Welleck, Amir Yazdanbakhsh, and Peter Clark. Self-refine: Iterative refinement with self-feedback. In Advances in Neu-ral Information Processing Systems (NeurIPS), 2023. arXiv version inspected: v2. URL: https://arxiv.org/abs/2303.17651, arXiv:2303.17651.
41. William M. McKeeman. Differential testing for software. Digital Technical Journal, 10(1):100–107, 1998.
42. David Mellafe Zuvic. Capability gates are not authorization: Confused-deputy failures in LLM agent frameworks, 2026. URL: https://arxiv.org/abs/2606.28679, arXiv:2606. 28679.
43. Meta. Llama Prompt Guard 2 model card (86m and 22m). https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M, 2025. Released 2025-04-05.
44. Grégoire Mialon, Clémentine Fourrier, Craig Swift, Thomas Wolf, Yann LeCun, and Thomas Scialom. Gaia: a benchmark for general ai assistants. In International Conference on Learning Representations (ICLR), 2024. arXiv version inspected: v1. URL: https://arxiv.org/ abs/2311.12983, arXiv:2311.12983.
45. Microsoft. Agent Governance Toolkit, 2026. Source revision 6b644564d112. URL: https: //github.com/microsoft/agent-governance-toolkit.
46. Microsoft. Microsoft Agent Framework, 2026. Source revision 6f1522a50b66. URL: https://github.com/microsoft/agent-framework.
47. Mark Samuel Miller. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. PhD thesis, Johns Hopkins University, Baltimore, MD, USA, 2006. URL: http://www.erights.org/talks/thesis/.
48. Bardia Mohammadi and Laurent Bindschaedler. The irreversibility budget: Fleet-level risk accounting and admission control for agent operating systems, 2026. URL: https://arxiv. org/abs/2609.00275, arXiv:2609.00275.
49. Xabier Muruaga. Bounded agents: Delegation security for multi-agent AI systems, 2026. URL: https://arxiv.org/abs/2608.15888, arXiv:2608.15888.
50. Yi Nian, Aojie Yuan, Haiyue Zhang, Jiate Li, Li Li, Xiyang Hu, Hua Wei, Xiongye Xiao, Chaowei Xiao, and Yue Zhao. Auditable agents, 2026. URL: https://arxiv.org/abs/ 2604.05485, arXiv:2604.05485.
51. OpenAI. OpenAI Agents SDK (openai-agents-python). https://github.com/openai/ openai-agents-python, 2026. Commit 08e5c43, accessed 2026-09-28.
52. Yuxiang Peng and Xiaodi Wu. Stateful governance for concurrent agentic systems, 2026. URL:https://arxiv.org/abs/2608.02764, arXiv:2608.02764.
53. Pydantic. Pydantic AI, 2026. Source revision 69eb81bde23c. URL: https://github.com/ pydantic/pydantic-ai.
54. Traian Rebedea, Razvan Dinu, Makesh Sreedhar, Christopher Parisien, and Jonathan Cohen. NeMo Guardrails: A toolkit for controllable and safe LLM applications with programmable rails, 2023. EMNLP 2023 System Demonstrations. URL: https://arxiv.org/abs/2310. 10501, arXiv:2310.10501.
55. Jerome H. Saltzer and Michael D. Schroeder. The protection of information in computer sys-tems. Proceedings of the IEEE, 63(9):1278–1308, 1975. doi:10.1109/PROC.1975.9939.
56. Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. Progent: Securing AI agents with privilege control, 2025. URL: https://arxiv.org/abs/ 2504.11703, arXiv:2504.11703.
57. Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning. In Advances in Neural Information Processing Systems (NeurIPS), 2023. arXiv version inspected: v4. URL: https://arxiv.org/abs/2303.11366, arXiv:2303.11366.
58. Oleg Solozobov. DEMM-Bench: A cross-regime benchmark for agent-runtime governance-evidence sufficiency, 2026. URL: https://arxiv.org/abs/2606.20634, arXiv:2606. 20634.
59. Tobin South, Samuele Marro, Thomas Hardjono, Robert Mahari, Cedric Deslandes Whitney, Dazza Greenwood, Alan Chan, and Alex Pentland. Authenticated delegation and authorized AI agents, 2025. URL: https://arxiv.org/abs/2501.09674, arXiv:2501.09674.
60. Olly Styles, Sam Miller, Patricio Cerda-Mardini, Tanaya Guha, Victor Sanchez, and Bertie Vidgen. Workbench: a benchmark dataset for agents in a realistic workplace setting. arXiv preprint arXiv:2405.00823, 2024. arXiv version inspected: v2. URL: https://arxiv.org/ abs/2405.00823, arXiv:2405.00823.
61. Theodore R. Sumers, Shunyu Yao, Karthik Narasimhan, and Thomas L. Griffiths. Cognitive architectures for language agents. Transactions on Machine Learning Research, 2024. arXiv version inspected: v3. URL: https://arxiv.org/abs/2309.02427, arXiv:2309.02427.
62. Krti Tallam. A five-plane reference architecture for runtime governance of production AI agents, 2026. URL: https://arxiv.org/abs/2606.12320, arXiv:2606.12320.
63. Lillian Tsai and Eugene Bagdasarian. Contextual agent security: A policy for every purpose, 2025. HotOS 2025. URL: https://arxiv.org/abs/2501.17070, arXiv:2501.17070.
64. Rasmus Moorits Veski, Rachid Guerraoui, and David Froelicher. CAPMAS: Capability-based delegation of privileges in multi-agent systems, 2026. URL: https://arxiv.org/abs/ 2609.06500, arXiv:2609.06500.
65. Haoyu Wang, Christopher M. Poskitt, and Jun Sun. Agentspec: Customizable runtime enforce-ment for safe and reliable llm agents. In Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE), pages 2938–2950. ACM, 2026. arXiv version inspected: v3. URL: https://arxiv.org/abs/2503.18666, arXiv:2503.18666.
66. Haoyu Wang, Christopher M. Poskitt, Jiali Wei, and Jun Sun. Probguard: Proactive runtime monitoring for llm agent safety via probabilistic
prediction. arXiv preprint arXiv:2508.00500, 2025. v1 titled “Pro2Guard: Proactive Runtime Enforcement of LLM Agent Safety via
Probabilistic Model Checking”; retitled ProbGuard by v4; accepted at ASE 2026 per arXiv comment; arXiv version inspected: v4. URL:
https://arxiv.org/abs/2508.00500, arXiv:2508.00500.
67. Youting Wang, Xiao Han, Dingyan Shang, Yuan Tang, and Bowen Liu. Safety, or just capa-bility? A validity audit of agent-safety
benchmarks, 2026. URL: https://arxiv.org/abs/ 2607.28685, arXiv:2607.28685.
68. Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed
Hassan Awadallah, Ryen W White, Doug Burger, and Chi Wang. Autogen: Enabling next-gen llm applications via multi-agent
conversation. In Conference on Language Modeling (COLM), 2024. arXiv version inspected: v2. URL:
https://arxiv.org/abs/2308.08155, arXiv:2308.08155.
69. Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, Dawn Song,
and Bo Li. GuardAgent: Safeguard LLM agents by a guard agent via knowledge-enabled reasoning, 2025. ICML 2025. URL:
https://arxiv.org/abs/2406.09187, arXiv:2406.09187.
70. Jinghan Xu, Longze Fan, Zeyuan Wang, Xinjin Li, and Hankai Liu. Beyond single-use tokens: Durable authorization state for replayresistant
LLM agent actions, 2026. URL: https:// arxiv.org/abs/2608.01710, arXiv:2608.01710.
71. Zhuoning Xu, Xiucheng Zhang, Hanjun Luo, Yingbin Jin, Yinpeng Dong, and Hanan Salam. MasDrift: Benchmarking authorization
preservation across multi-agent architectures, 2026. URL: https://arxiv.org/abs/2608.07556, arXiv:2608.07556.
72. Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan. τ -bench: A benchmark for tool-agent-user interaction in real-world
domains. In International Conference on Learning Representations (ICLR), 2025. arXiv version inspected: v1. URL: https://arxiv.org/
abs/2406.12045, arXiv:2406.12045.
73. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in
language models. In International Conference on Learning Representations (ICLR), 2023. arXiv version inspected: v3. URL: https://
arxiv.org/abs/2210.03629, arXiv:2210.03629.
74. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large
language model agents. In Findings of the Associ-ation for Computational Linguistics: ACL 2024, 2024. arXiv version inspected: v3.
URL: https://arxiv.org/abs/2403.02691, arXiv:2403.02691.
75. Kaiyuan Zhang, Yuke Peng, Ke Jiang, and Yinqian Zhang. Actgov: Governing llm agent ac-tions via policy-constrained validation. arXiv
preprint arXiv:2609.24446, 2026. arXiv version inspected: v2. URL: https://arxiv.org/abs/2609.24446, arXiv:2609.24446.
76. Jinhao Zhu, Kevin Tseng, Gil Vernik, Xiao Huang, Shishir G. Patil, Vivian Fang, and Raluca Ada Popa. MiniScope: A least privilege
framework for authorizing tool calling agents, 2025. URL: https://arxiv.org/abs/2512.11147, arXiv:2512.11147.
77. Yuxuan Zhu, Tengjun Jin, Yada Pruksachatkun, Andy Zhang, Shu Liu, Sasha Cui, Sayash Kapoor, Shayne Longpre, Kevin Meng,
Rebecca Weiss, Fazl Barez, Rahul Gupta, Jwala Dhamala, Jacob Merizian, Mario Giulianelli, Harry Coppock, Cozmin Ududec, Jasjeet
Sekhon, Jacob Steinhardt, Antony Kellermann, Sarah Schwettmann, Matei Zaharia, Ion Stoica, Percy Liang, and Daniel Kang. Establishing
best practices for building rigorous agentic benchmarks, 2025. URL: https://arxiv.org/abs/2507.02825, arXiv:2507.02825.