Daily intelligence brief
Four research papers show why governed autonomy needs uncertainty-aware authorization, representation-aware safety review, long-horizon performance evidence, and inspectable agent upgrades.
- Report date
- Aug 03, 2026
- Status
- published
Authority Is a Chain of Evidence
An agent’s final action is only the visible end of a longer control chain. Before a tool call is executed, a system has already decided which evidence to trust, how to represent the requested action, whether the agent has demonstrated enough competence for the authority it holds, and who may change the software that defines its behaviour.
Four newly surfaced research papers examine different links in that chain. Together, they point toward a stricter operating model for autonomous systems: uncertainty should be tested before authorization, safety judgment should remain distinct from execution formatting, commercial authority should be earned through long-horizon evidence, and changes to an agent’s operating body should remain inspectable and human-controlled.
The papers were submitted to arXiv on July 30 or July 31 and surfaced during the August 3 review. They are retained under Keelbase Signal’s catch-up horizon and are not presented as August 3 publications.
Authorization must survive uncertainty
Most runtime permission checks evaluate the return a tool actually produced. CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents (opens in a new tab) asks a harder question: would the proposed action still be authorized if the return were slightly wrong?
Tool returns can combine provenance, categorical bindings and numerical values. A payment agent might receive an account identity, a transaction category and an amount. Even when the return is well formed, one field may be bound to the wrong source or a numerical value may drift within a plausible range. CAGE evaluates authorization across a declared neighbourhood of those errors rather than only at the observed point.
The authors report that checking categorical and numerical uncertainty separately is insufficient because errors that appear safe in isolation can combine into an unsafe decision. Their approach enumerates the discrete alternatives and certifies the permitted numerical range within each branch. Across the settings evaluated by the authors, CAGE removed in-budget false allows while preserving some autonomous decisions.
The important principle is broader than the specific certification method: authorization should account for uncertainty in the evidence on which an action depends. A formatted tool return is not automatically a correctly attributed or sufficiently precise fact.
The guarantee is bounded. CAGE evaluates a declared uncertainty budget and depends on the policy or learned gate it is asked to certify. It does not establish general robustness against compromised tools, malicious content, arbitrary provenance failures or errors outside that declared neighbourhood.
Source: CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents (opens in a new tab), submitted July 31, 2026.
Safety judgment and execution need different views
Tool schemas are designed to help models execute actions reliably. Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents (opens in a new tab) presents evidence that the same structured representation may weaken the signals a model uses to refuse harmful requests.
The authors identify schema-formatted tool specifications as a contributor to safety degradation in the evaluated agents. Their proposed safeguard, SafeKeep, separates the two functions: it makes the safety judgment using flattened textual descriptions while retaining the structured schema for execution. Across two benchmarks and four models, the authors report higher refusal rates for harmful requests and lower attack success under observation-level prompt injection.
This suggests a useful architectural separation. The representation optimized for calling a tool is not necessarily the representation best suited to deciding whether the tool should be called. An authorization layer should be able to examine the action, intent and consequences without being constrained by the execution interface’s formatting.
SafeKeep remains an evaluated inference-time safeguard, not a general runtime-safety guarantee. Its results are specific to the tested models, AgentHarm and InjecAgent settings, and the paper’s two-stage design. Structured schemas also remain necessary for reliable execution. The contribution is the separation of judgment from execution—not a reason to discard tool specifications.
Source: Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents (opens in a new tab), submitted July 31, 2026.
Commercial authority requires long-horizon evidence
Most agent benchmarks reward completion of bounded tasks. Autonomous commerce creates a different test: actions alter future options, feedback arrives on different schedules, cash-flow mistakes compound, and a locally plausible decision may undermine the longer strategy.
MerchantBench: Benchmarking LLM Agents for Long-Term Coherence in E-Commerce Operations (opens in a new tab) evaluates this problem through a 365-day seller-side simulation grounded in 98,843 product records. Agents use 26 tools across sourcing, listings, pricing, cash-flow management and order outcomes. The authors evaluated eight models under two agent frameworks in 48 year-long runs.
The strongest evaluated configuration reached 27.3% of the human participants’ mean final net assets. The result does not show that agents cannot operate businesses. It shows that short-task competence is weak evidence for sustained commercial coherence when decisions accumulate and feedback is delayed.
That distinction matters for delegated authority. A system that can place an order, change a price or reconcile an individual transaction has not thereby demonstrated that it should control a treasury or run a commercial operation continuously. Authority should expand only as evidence accumulates across the actual horizon and failure modes of the role.
MerchantBench is still a simulation. Its conclusions depend on the environment, agent scaffolds, human comparison, financial assumptions and the models tested. Its value is in exposing a missing evaluation layer: consequential autonomy needs longitudinal evidence, not only successful episodes.
Source: MerchantBench: Benchmarking LLM Agents for Long-Term Coherence in E-Commerce Operations (opens in a new tab), submitted July 31, 2026.
The agent’s operating body must remain governable
Authorization controls individual actions, but an autonomous system can also change the code, prompts, tools, skills, policies and tests that shape its future behaviour. Code Is the Body: Agent-Owned Software Bodies for Recursive Evolution and Descent (opens in a new tab) proposes treating that behaviour-defining software as a versioned, inspectable artifact under human custody.
The paper’s OurArk architecture places proposed self-modifications into isolated candidates. Changes are tested and reviewed before they are merged into the active body. Descendants receive distinct identities, histories and missions, while private state remains bounded rather than silently inherited. This creates an explicit lineage for evolution instead of allowing the operating system of the agent to change invisibly inside an ongoing session.
For governed autonomy, this is the upgrade problem made concrete. An agent’s authority cannot remain meaningful if the behaviour-defining artifact can rewrite itself without an inspectable proposal, validation evidence, an approval boundary and a recoverable version history. Identity also needs to survive change without pretending that every descendant or modified instance is the same accountable actor.
OurArk is an architectural proposal supported by a small demonstration, not evidence of production readiness or safe recursive self-improvement. Its importance is the control pattern: isolate candidate changes, preserve lineage, validate before activation, assign distinct identities where appropriate, and keep a human custodian capable of accepting, rejecting or recovering from an update.
Source: Code Is the Body: Agent-Owned Software Bodies for Recursive Evolution and Descent (opens in a new tab), submitted July 30, 2026.
From tool permission to operating authority
These papers describe different failure surfaces, but their controls are complementary.
- CAGE asks whether permission survives plausible errors in the evidence.
- SafeKeep separates the representation used for safety judgment from the one used for execution.
- MerchantBench asks whether performance remains coherent over the real duration of delegated authority.
- OurArk keeps changes to the agent’s behaviour-defining artifact isolated, inspectable and subject to human review.
Supporting work reinforces the same systems view. ECLoop treats evidence requirements as executable preconditions before a coding agent may commit a change. Model or Harness? separates failures attributable to the model from those caused by tools, memory, environments or orchestration. Beyond Component Testing argues that agent validation must extend beyond isolated components to temporal and runtime evidence. Persistent-memory research likewise warns that low-authority information must not acquire greater authority merely through consolidation.
The emerging design requirement is not one perfect safety layer. It is a chain of independently inspectable controls: evidence quality, authorization under uncertainty, representation-aware judgment, bounded execution, long-horizon evaluation, governed upgrades and accountable identity.
An autonomous system should not receive operating authority merely because it can complete a task. Authority should be granted—and retained—only when the evidence behind its actions, performance and evolution remains visible enough to challenge.
Keelbase Signal assessment
Together, the four records support four boundaries that should remain independently inspectable:
- An evidence boundary should test whether authorization survives plausible errors in the provenance, binding, or value of tool-return data.
- A judgment boundary should preserve a safety view suited to evaluating intent and consequence rather than relying only on the representation optimized for execution.
- A performance boundary should evaluate commercial coherence across the duration and compounding effects of delegated authority.
- An upgrade boundary should keep changes to behaviour-defining software isolated, versioned, reviewable, and recoverable under human control.
For Keelbase, the findings reinforce the distinction between an agent crew’s ability to act and the operating authority granted through structural controls. A coordination contract can define consequential permissions, but the evidence feeding authorization also needs a declared trust and uncertainty model. Tool schemas can support reliable execution without becoming the sole context for deciding whether an action is acceptable. Treasury or commercial authority should expand only after evidence accumulates across realistic operational horizons.
The upgrade problem is equally important. If a Vessel’s behaviour-defining software changes, its version, approval basis, validation evidence, and identity implications should remain inspectable. That is an auditability requirement, not a promise that the modified agent will behave safely at runtime.
None of the papers establishes a complete governance architecture or general runtime behavioral safety. Together, they support a structural conclusion: operating authority is a chain of evidence. It remains credible only when the evidence behind action, performance, and change stays visible enough to verify, constrain, and challenge.
Sources and limitations
All four primary records are preprints and should be treated as author-reported research rather than settled findings. Their submission dates precede this brief’s report date; they were included through the standing catch-up review horizon. Supporting papers inform the synthesis but are not separate records in this edition.