Runtime Governance for Agentic AI: Action-Boundary Control with Trusted Provenance and Fail-Closed Execution

代理式 AI 的运行时治理：基于可信溯源与故障安全执行的行动边界控制

Abstract: Agentic AI systems request tool actions that can modify files, send messages, launch jobs, or change workflow state. This shifts the safety problem from harmful text generation to harmful operational side effects. Prompt-level governance can shape model behavior, but it does not create an execution boundary.

摘要： 代理式 AI 系统会请求执行各种工具操作，这些操作可能修改文件、发送消息、启动任务或更改工作流状态。这使得安全问题的焦点从有害文本生成转移到了有害的操作副作用上。提示词层面的治理可以引导模型行为，但无法建立真正的执行边界。

We introduce Aegis, a runtime governance system that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. The model proposes; the trusted runtime decides. Aegis evaluates proposals against active policy state, resolves provenance server-side, fails closed under uncertainty, and routes selected cases through Senate-style settlement, a quorum-based non-unilateral authorization path.

我们引入了 Aegis，这是一个运行时治理系统，它将模型输出视为“行动提案”，并在工具执行前通过一个可信的决策层进行中介处理。模型负责提出建议，而可信的运行时负责决策。Aegis 根据当前的策略状态评估提案，在服务器端解析溯源信息，在不确定情况下采取“故障安全”（Fail-Closed）策略，并将选定的案例通过“参议院式”裁决流程进行处理——这是一种基于法定人数的非单方面授权路径。

We evaluate Aegis on a repeated sandbox corpus spanning five run families, 42 tasks, three conditions, and ten repeats per family. Across 6,300 rows, prompt-policy conditioning produced 79 risky comparator-path leakage rows. Across 2,100 Aegis-governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions.

我们在一个重复的沙盒语料库上对 Aegis 进行了评估，该语料库涵盖了 5 个运行系列、42 个任务、3 种条件以及每个系列 10 次重复实验。在 6,300 条数据记录中，提示词策略调节产生了 79 条风险对比路径泄露记录。而在 2,100 条由 Aegis 治理的数据记录中，系统记录的受控模拟工具应用和受控风险副作用完成次数均为零。

All 1,832 Aegis-attempted governed rows preserved trusted Aegis-resolved provenance, and all 1,019 Senate-settled rows had quorum and final signed tally evidence. These results do not prove general autonomous-agent safety. They support the narrower systems claim that, in this evaluated sandbox corpus, runtime action-boundary governance prevented observed risky proposals from becoming governed side effects.

在所有 1,832 条尝试进行治理的数据记录中，均保留了经 Aegis 解析的可信溯源信息；所有 1,019 条经过“参议院式”裁决的记录均具备法定人数和最终签署的计票证据。这些结果并不能证明通用自主代理的安全性，但它们支持了一个更具体的系统性主张：在该评估的沙盒语料库中，运行时行动边界治理成功阻止了观察到的风险提案转化为受控的副作用。