One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI

Remediation-induced control coupling, non-commuting operators, and the limits of composed detection coverage

Gaston Besanson· 2026· DOI 10.48550/arXiv.2608.18360

The core problem

Agentic AI systems increasingly take consequential actions that are governed by multiple pre-action controls simultaneously. The paper identifies three classes of gates: authority gates, resource gates, and evidence gates. Each gate can admit, degrade, or remediate an action before it executes. The central problem is that these controls are not independent. A remediation applied by one control can change the action, the evidence, or the context that another control evaluates, thereby invalidating that control's earlier judgment. The paper names this phenomenon **remediation-induced control coupling**. The work is motivated by the observation that composing stateful pre-action controls is not merely an engineering detail but a semantic challenge: the order and interaction of remediations affect whether the composed system remains sound. The paper formalizes this coupling and proposes a remediate-and-regate protocol to restore per-action soundness in a bounded, idempotent setting. It also investigates the commutativity of remediation operators and the trustworthiness of governed evidence buffers, showing that current admissibility does not imply future reference trustworthiness. The

Innovation

The finite-model checker found concrete counterexample instances showing that the two implemented remediation operators—evidence substitution and resource-budget downroute—do not commute. This means that the order of remediation matters: applying r_{1} then r_{2} can yield a different final state than applying r_{2} then r_{1} . Consequently, remediation order is part of the control-plane semantics rather than an implementation detail. The paper also establishes the exact condition under which positive-weight linear aggregation of gate outcomes can compensate a member veto. Specifically, for a set of gate outcomes o_{i} \in {0, 1} with weights w_{i} > 0, a veto by gate k (i.e., o_{k} = 0) can be compensated if and only if i \neq = k \sum w_{i} o_{i} \geq θ, where θ is the aggregation threshold. The unified cross-control Evidence Set is shown to be necessary for consistent evaluation across controls. A key negative result is that composition manufactures no new detection coverage: the union of detections from composed controls is no greater than the union of detections from the individual controls. This is reported honestly as a limitation. The governed evidence buffer,

Agentic AI systems increasingly take consequential actions that are governed by multiple pre-action controls simultaneously. The paper identifies three classes of gates: authority gates, resource gates, and evidence gates. Each gate can admit, degrade, or remediate an action before it executes. The central problem is that these controls are not independent. A remediation applied by one control can change the action, the evidence, or the context that another control evaluates, thereby invalidating that control's earlier judgment. The paper names this phenomenon **remediation-induced control coupling**. The work is motivated by the observation that composing stateful pre-action controls is not merely an engineering detail but a semantic challenge: the order and interaction of remediations affect whether the composed system remains sound. The paper formalizes this coupling and proposes a remediate-and-regate protocol to restore per-action soundness in a bounded, idempotent setting. It also investigates the commutativity of remediation operators and the trustworthiness of governed evidence buffers, showing that current admissibility does not imply future reference trustworthiness. The contribution is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.

The paper formalizes remediation-induced control coupling by defining a set of controls C = {c_{1}, c_{2}, \dots, c_{n}}, each of which evaluates an action a and produces an outcome in {admit, degrade, remediate} . A remediation operator r_{i} transforms the action, evidence, or context. The key property is that for two controls c_{i} and c_{j}, applying r_{i} may change the input to c_{j}, so that c_{j}'s earlier judgment is no longer valid. The paper introduces a **remediate-and-regate protocol**: after any remediation, all affected controls must re-evaluate the action. The protocol is proven to restore per-action soundness under assumptions of boundedness and idempotence. The authors implement two remediation operators: **evidence substitution** and **resource-budget downroute**. They use a finite-model checker to search for counterexamples to commutativity. They also analyze a governed evidence buffer that trusts its own most recent admitted write, showing it is vulnerable to poisoning from declared-uncovered defect classes. Two mitigations are proposed and evaluated. Empirically, the study uses a deterministic open-data artifact composing three published engines unmodified. Six hypotheses (CH1-CH5 and CH6) are tested across 30 pre-registered seeds. CH1-CH5 meet their registered decision rules across all seeds; CH6 meets its rule under workflow W1 but not under the smaller W2 workflow. The methodology includes a unified cross-control Evidence Set and an analysis of positive-weight linear aggregation of gate outcomes.

Why it matters

The paper's central insight is that stateful pre-action controls cannot be composed naively. Remediation-induced control coupling means that a remediation by one control can invalidate the judgment of another, leading to unsound actions. The remediate-and-regate protocol addresses this by re-evaluating all affected controls after any remediation, but it relies on boundedness and idempotence assumptions. The non-commutativity of remediation operators implies that the control plane must define a deterministic order of remediation, or otherwise ensure that the final state is independent of order. The governed evidence buffer problem highlights that current admissibility does not imply future reference trustworthiness: an evidence buffer that trusts its most recent admitted write can be poisoned by defect classes that are declared uncovered. The two mitigations reduce exposure but do not eliminate it, suggesting that trust in evidence buffers must be bounded in time or scope. The result that composition manufactures no new detection coverage is a caution against assuming that adding more controls automatically improves security. The empirical demonstration on open payload data with a synthetic metadata layer is a mechanism demonstration, not a prevalence claim. The paper's contributions include a formalization of control coupling, a protocol for sound composition, a proof of non-commutativity, a condition for veto compensation, and a unified Evidence Set. The work has implications for the design of agentic AI systems that must balance authority, resource, and evidence constraints. Future work could extend the protocol to unbounded or non-idempotent settings, explore other remediation operators, and test the approach on production data.

Who should read this

CS practitioners and researchers

Opening member content…