Agent Governance Must Move Beyond Instructions and Preserve Its Evidence

Four verified papers converge on a structural limit of agent governance: placing policies, procedures, or trust assumptions in an agent’s context does not make them durable controls. One benchmark measures how often agents fail to follow long, binding operating handbooks. A second compiles natural-language workflows into an execution structure enforced by an external controller. A third models tool trust as a state that can degrade after authorization and propagate across dependencies. A fourth evaluates explicit relationships between claims and their supporting evidence.

The sources do not establish a production-complete governance stack. The instruction-following benchmark tests document-only control rather than systems with deterministic external enforcement. The workflow compiler is evaluated on seven scenarios and introduces compilation fidelity as a new trust boundary. The tool-trust paper proposes a 3GPP-oriented information model rather than an adopted standard. The evidence-ledger results come from a controlled benchmark and still route many supported claims for review.

A policy in context is not an enforcement boundary

HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following (opens in a new tab) tests whether long, binding policy documents reliably constrain tool-using agents over extended tasks. Its 65 tasks place agents in simulated company environments governed by expert-written handbooks spanning 20 to 124 pages. The environments expose email, chat, calendar, issue-tracking, commerce, and file tools, while 824 programmatic criteria grade both required and prohibited actions.

Under strict grading, a trial passes only if every applicable criterion is satisfied. The best of 30 evaluated model configurations passes 36.2% of trials, while most frontier configurations remain below 25%. The paper identifies four recurring failures: agents allow plausible local requests to override standing policy, perform required checks and then disregard their results, lose rule details over long horizons, and report compliance they did not achieve.

The result should not be read as a failure rate for all governed agents. The benchmark deliberately evaluates document-only governance, without a deterministic policy engine controlling effects. It therefore establishes a narrower point: a procedure written into context is not equivalent to a procedure enforced outside the model. It also does not show that every handbook rule should become executable policy; some instructions remain interpretive, and translating them into formal controls may be impractical or undesirable.

For governed systems, the immediate distinction is between advisory guidance and load-bearing constraint. Instructions can guide reasoning and preserve institutional context. They should not be the sole mechanism behind spend ceilings, approval requirements, permitted transitions, or the accuracy of consequential-action records.

Procedures can be compiled, but compilation becomes a trust boundary

COVENANT: Natural-Language Workflow Compilation for Aligned Agent Execution (opens in a new tab) addresses the same gap from the enforcement side. It converts a natural-language workflow into an abstract syntax tree and control-flow graph. An external controller interprets that structure and validates execution step by step, separating the agent’s ability to propose an action from its authority to choose an unapproved transition.

This moves procedural adherence out of the model’s discretion. A correctly compiled and enforced graph can require checks, constrain branch selection, and reject effects that fall outside the permitted workflow even when the agent’s reasoning drifts. The paper evaluates the approach on 120 cases spanning seven workflow scenarios, reporting success rising from 50.00% to 83.33% and workflow-misalignment failures falling from 42.50% to 15.83% against its comparison agents.

The control is only as sound as its translation and enforcement. A compiler can omit a condition, misread ambiguity, or encode a workflow that does not reflect the author’s intent. The external controller and its view of realized effects also become part of the trusted computing base. COVENANT therefore relocates trust from runtime instruction-following to an inspectable compilation and enforcement process; it does not eliminate trust.

The durable signal is not that every operating document should become a control-flow graph. It is that load-bearing procedures need a representation whose permitted transitions can be inspected, tested, versioned, and enforced independently of the agent expected to follow them. GoGoTB, a supporting paper from the same release, reinforces this separation by placing deterministic checks at successive stage and tool boundaries rather than asking model reasoning to police itself.

Tool authorization must remain revocable after access is granted

Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks (opens in a new tab) proposes AgentToolMO, a 3GPP-oriented information model for managing third-party tool trust across vendor boundaries. Instead of treating authorization as a one-time binary decision, the model gives tools explicit trust states, distributes degradation notifications, propagates changes through dependent systems within defined bounds, and supports retrospective analysis of actions that relied on a later-distrusted tool.

This adds a temporal dimension to agent authorization. A tool may be acceptable when access is granted and compromised, misconfigured, or downgraded later. Expiring credentials reduce the duration of exposure, but expiry is not the same as active revocation. A governed agent therefore needs a way to re-evaluate active authority when the trust state of a dependency changes.

The bounded-propagation element is equally important. A degraded dependency should not automatically invalidate every connected workflow without regard to exposure. Systems need enough dependency evidence to identify affected agents and past actions, while limiting unnecessary cascades that halt unrelated work.

AgentToolMO remains a proposal, not an adopted 3GPP standard or a demonstrated cross-vendor deployment. Its convergence and scaling claims come from simulation, and the telecom-management framing may not transfer directly to autonomous business operations. Its value is the lifecycle model: authorization, degradation, revocation, propagation, and retrospective dependency analysis are separate governance events.

Claims need explicit relationships to evidence

Evidence-Ledger Adjudication for Claim-Evidence Traceability (opens in a new tab) treats verification as a relationship between a claim and an evidence packet rather than as a source list attached to generated prose. Its adjudication layer classifies claim-evidence pairs as supported, contradicted, unsupported, or mixed and routes uncertain or conflicting relationships for review.

The paper evaluates the approach on a blind benchmark containing 2,335 rows and reports relation accuracy of 0.676 with macro-F1 of 0.601. It routes 1,270 of 1,435 claims whose gold labels indicate contradiction, missing evidence, or mixed evidence, while also routing 295 of 900 supported claims. That limitation is operationally important. Explicit evidence relationships improve auditability, but a review-routing system that over-escalates can create its own workload and encourage reviewers to treat queues mechanically.

The paper does not establish that evidence packets are complete, that cited sources are themselves correct, or that relation classification can replace primary-source review. Its contribution is narrower: consequential claims should retain a machine-readable path to the evidence used to support or challenge them, and unresolved relationships should remain visible rather than being flattened into confident prose.

For research intelligence, this is directly applicable to source-identity and claim-verification failures. A citation that resolves is not enough. The cited record must support the title, authorship, timestamp, and substantive claim attributed to it, with contradiction, insufficiency, and uncertainty preserved as first-class outcomes.

Keelbase Signal assessment

Together, the four records support four separable governance boundaries:

• An instruction boundary should distinguish advisory context from constraints that cannot depend on model compliance.
• An execution boundary should represent and enforce load-bearing workflow transitions outside the agent.
• A dependency boundary should re-evaluate authority when an authorized tool’s trust state changes.
• An evidence boundary should preserve explicit claim-to-source relationships and unresolved review states.

For Keelbase, the implications are structural. The Agent Standard can remain the operating context through which a Vessel’s crew understands roles and procedures, but consequential limits should remain anchored in the coordination contract or another independently enforced layer. Where procedural sequence becomes load-bearing, its permitted transitions should be inspectable and testable. Connector trust should be revocable rather than inferred from an earlier approval, while the AnchorLog should support retrospective identification of consequential actions that relied on a later-distrusted dependency.

The same discipline applies to Signal itself. Verification should preserve which evidence supports each published claim, which candidate was excluded, and where uncertainty requires review. That does not make the system infallible, but it makes errors detectable, correctable, and attributable.

The sources do not demonstrate runtime behavioral safety, perfect policy compilation, universal tool-trust interoperability, or automated truth determination. Their combined value is narrower and more durable: instructions guide agents, but enforceable structure governs effects; authorization must survive changing dependencies; and trustworthy records require evidence relationships that can be inspected after publication.