Toward Pre-Deployment Assurance for Enterprise AI Agents: Ontology-Grounded Simulation and Trust Certification

# Toward Pre-Deployment Assurance for Enterprise AI Agents: Ontology-Grounded Simulation and Trust Certification
Source: [https://arxiv.org/html/2606.04037](https://arxiv.org/html/2606.04037)
Thanh Luong Tuan Golden Gate University, San Francisco, CA, USAAbhijit Sanyal Data, Digital & IT, Novartis Healthcare Pvt\. Ltd\., Hyderabad, IndiaEmail: abhijit\.sap@gmail\.com ORCID: 0009\-0005\-7520\-5881

\(June 2026\)

###### Abstract

Pre\-deployment verification of enterprise artificial intelligence \(AI\) agents remains a critical gap between large language model \(LLM\) capability benchmarking and production deployment\. Post\-deployment monitoring, human\-in\-the\-loop controls, and prompt\-level guardrails offer limited assurance once an agent is operating in production\. We present an ontology\-grounded framework for pre\-deployment verification of enterprise AI agents—to our knowledge the first to combine three components: an Agent Operational Envelope formalizing the certification space across permissions, domain constraints, safety properties, governance rules, and autonomy levels; an ontology\-to\-scenario generation pipeline that derives regulatory, operational, and adversarial test scenarios automatically; and a Trust Certificate carrying a machine\-verifiable attestation with graduated deployment verdicts \(Approved, Conditional, Rejected\)\. A controlled pilot across four regulated industries—Fintech, Banking, Insurance, and Healthcare—instantiated as five industry\-by\-regulatory\-regime cells across the United States and Vietnam—where Vietnam’s 2025 AI Law makes such verification legally mandated for financial services—generated 1,800 scenarios evaluated against 125 primary\-source regulatory requirements and 25 injected faults\. Ontology\-grounded generation significantly outperformed the dominant persona\-based baseline on regulatory coverage \(48\.3% versus 33\.1%; correctedpc=\.0006p\_\{c\}\{=\}\.0006\) and attained the highest domain specificity \(4\.77/5\.0;p=2×10−6p\{=\}2\{\\times\}10^\{\-6\}\); transparently, its advantage over plain and retrieval\-augmented prompting did not survive Bonferroni correction\. Cross\-validation across three LLM families \(Claude Sonnet 4, Qwen 2\.5 72B, Gemma 4 26B; 5,400 total scenarios\) replicated the persona\-versus\-ontology pattern\. The framework offers a reproducible, regulation\-grounded route to pre\-deployment assurance for enterprise AI agents, complementing runtime governance with an auditable deployment gate\.

Keywords:AI safety; agent verification; ontology\-grounded verification; agent certification; enterprise AI

## 1Introduction

Enterprise deployment of autonomous AI agents creates an inherent conflict between capability and risk: as capability increases, so does the potential benefit and the possible damage from error\. Agents used to determine if insurance applicants should be issued a policy, agents executing trades on behalf of clients, and patient triage agents prioritizing medical treatment all operate in domains where errors carry regulatory, financial, and human consequences\. The critical issue is not whether current large language models \(LLMs\) can perform such tasks, but whether operators can verify their safe behavior before granting production access\. We term this the*agent verification problem*: pre\-deployment assurance that an AI agent will behave within acceptable bounds across the space of scenarios it may encounter\.

Current approaches are inadequate\. Post\-deployment monitoring\[[1](https://arxiv.org/html/2606.04037#bib.bib1)\]intervenes only after harm; human\-in\-the\-loop gates\[[7](https://arxiv.org/html/2606.04037#bib.bib3)\]create bottlenecks and shift the verification burden to reviewers who may lack domain expertise; prompt\-level guardrails\[[3](https://arxiv.org/html/2606.04037#bib.bib2)\]are probabilistic rather than deterministic and can be ignored under adversarial or edge\-case conditions\. Safety\-critical industries have long addressed the analogous problem through standards including DO\-178C\[[40](https://arxiv.org/html/2606.04037#bib.bib21)\], IEC 62304\[[17](https://arxiv.org/html/2606.04037#bib.bib22)\], and ISO 26262\[[18](https://arxiv.org/html/2606.04037#bib.bib23)\], which mandate structured pre\-deployment verification; no analogous standard yet exists for enterprise AI agents in regulated industries\.

This paper argues that industry ontologies—formal representations of domain concepts, regulatory frameworks, and operational constraints—provide the foundation for systematic agent verification\. Ontology\-grounded verification uses formalized descriptions of regulatory and operational constraints to derive test scenarios automatically, producing industry\-specific, evolvable test suites that prompt\-level guardrails cannot match\. The generation approach is paired with a machine\-verifiable Trust Certificate attesting to agent behavior within a formally defined operational envelope, evaluated through a controlled pilot study and three\-model cross\-validation across four regulated industries \(Fintech, Banking, Insurance, and Healthcare\) and three LLM families\.

At a Tier\-2 Vietnamese commercial bank, an AML screening agent we ran in shadow mode processed 27 customer\-onboarding cases correctly but produced two false\-negative matches against the UN 1267 consolidated sanctions list before the simulation gate flagged a misconfigured name\-romanization rule that dropped diacritics from Vietnamese names\. The Anti\-Money Laundering Law 14/2022/QH15\[[31](https://arxiv.org/html/2606.04037#bib.bib54)\]makes the bank—not the vendor—liable for the missed match\. That is the verification gap this paper addresses, observed in production rather than imagined in design\.

This paper makes four contributions\.*First*, we formalize the Agent Operational Envelope, a specification of the space across which an enterprise AI agent is authorized and validated to operate\.*Second*, we introduce ontology\-grounded scenario generation, which derives regulatory, operational, and adversarial test suites automatically from formal industry ontologies rather than hand\-curated personas\.*Third*, we define a machine\-verifiable Trust Certificate that binds a specific agent version to validated behavioral properties as an auditable deployment gate\.*Fourth*, through a cross\-jurisdictional \(United States and Vietnam\) and three\-model evaluation, we provide evidence that the observed coverage gains arise from the verification methodology rather than a single model’s latent knowledge—positioning ontology\-grounded verification as a reproducible complement to runtime governance for high\-stakes enterprise AI\.

### 1\.1Related Work

#### 1\.1\.1Agent Safety and Verification

AI\-safety research has identified concrete failure modes in deploying autonomous systems—reward hacking, distributional shift, and unsafe exploration\[[1](https://arxiv.org/html/2606.04037#bib.bib1)\]—and has proposed model\-level mitigations including Constitutional AI\[[3](https://arxiv.org/html/2606.04037#bib.bib2)\]and Reinforcement Learning from Human Feedback \(RLHF\)\[[7](https://arxiv.org/html/2606.04037#bib.bib3)\]\. Safety,\[[49](https://arxiv.org/html/2606.04037#bib.bib5)\]argue, must be assessed in deployment context rather than in model isolation\. The central transition is from*model safety*\(benchmark performance\) to*agent safety*\(behavior in regulated workflows\):\[[2](https://arxiv.org/html/2606.04037#bib.bib43)\]report that leading LLMs are “surprisingly compliant” across 110 harmful tasks, and\[[54](https://arxiv.org/html/2606.04037#bib.bib44)\]find that*none*of 16 evaluated agents exceeds a 60% safety score across 349 environments\.\[[6](https://arxiv.org/html/2606.04037#bib.bib6)\]identify the inability to inspect what an LLM\-based agent “knows” as the foundational gap—the gap the Trust Certificate \([Section˜2\.4](https://arxiv.org/html/2606.04037#S2.SS4)\) addresses with auditable, machine\-readable attestation\.

Formal verification of neural networks\[[15](https://arxiv.org/html/2606.04037#bib.bib7),[20](https://arxiv.org/html/2606.04037#bib.bib8),[46](https://arxiv.org/html/2606.04037#bib.bib9),[45](https://arxiv.org/html/2606.04037#bib.bib10)\]targets robustness of individual networks, not agent\-level behavioral properties such as “the agent never approves a loan exceeding the applicant’s debt\-to\-income threshold\.” Model checking for multi\-agent systems\[[23](https://arxiv.org/html/2606.04037#bib.bib11)\]assumes well\-defined transition functions that LLM agents lack\.\[[9](https://arxiv.org/html/2606.04037#bib.bib4)\]reframe the goal as*quantitative safety guarantees*—bounding unsafe\-behavior probability rather than proving impossibility—informing our probabilistic bounded\-model\-checking extension \([Section˜3\.1](https://arxiv.org/html/2606.04037#S3.SS1)\)\. The behavioral\-envelope approach bridges NN and agent verification: enterprise ontologies supply the specification language that NN verification lacks for agent\-level properties\.

Recent LLM\-agent work includes benchmark suites\[[22](https://arxiv.org/html/2606.04037#bib.bib17),[44](https://arxiv.org/html/2606.04037#bib.bib18)\], red\-teaming\[[38](https://arxiv.org/html/2606.04037#bib.bib19)\], and multi\-agent simulation\[[37](https://arxiv.org/html/2606.04037#bib.bib20)\]\. Agent sandboxing advances pre\-deployment verification via LLM\-emulated tool execution\[[41](https://arxiv.org/html/2606.04037#bib.bib26)\]; surveys\[[50](https://arxiv.org/html/2606.04037#bib.bib27),[48](https://arxiv.org/html/2606.04037#bib.bib28)\]flag trust and domain\-specific evaluation as open challenges; purpose\-built benchmarks target safety\-risk awareness \(R\-Judge, 27 risks,\[[53](https://arxiv.org/html/2606.04037#bib.bib56)\]\) and embodied\-agent hazards \(SafeAgentBench, 750 tasks,\[[51](https://arxiv.org/html/2606.04037#bib.bib45)\], with best baseline rejecting only 10% of detailed hazardous tasks\)\. These efforts share the pre\-deployment orientation of this work but produce generic scores, not domain\-grounded regulatory attestations\. The most directly relevant commercial system, Lyzr’s Agent Simulation Engine \(A\-Sim,\[[28](https://arxiv.org/html/2606.04037#bib.bib25)\]\), executes 20,000\+ simulations via a persona\-by\-scenario matrix\. The present approach instead derives scenarios from formal industry ontologies encoding actual regulations \(e\.g\. BSA/AML $10,000 CTR thresholds\) rather than generic persona crosses\. This instantiates*model\-based testing*\[[47](https://arxiv.org/html/2606.04037#bib.bib42)\]with ontology as both specification \(what to test\) and oracle \(how to evaluate\)—a dual role we revisit in[Section˜4](https://arxiv.org/html/2606.04037#S4)\.

#### 1\.1\.2Evaluation Methodology and Ontology Foundations

We employ LLM\-as\-judge\[[55](https://arxiv.org/html/2606.04037#bib.bib36)\], in which a strong LLM evaluates another LLM’s output against structured criteria\.\[[55](https://arxiv.org/html/2606.04037#bib.bib36)\]report\>\>80% agreement with human judges on open\-ended quality but identify position, verbosity, and self\-enhancement biases\. The regulatory\-compliance task here is more constrained \(binary “does this scenario test regulation X?”\), reducing bias exposure\.\[[43](https://arxiv.org/html/2606.04037#bib.bib37)\]warn that validator criteria may diverge from human preference on domain tasks;\[[13](https://arxiv.org/html/2606.04037#bib.bib48)\]survey reliability improvements;\[[24](https://arxiv.org/html/2606.04037#bib.bib46)\]achieve*human\-level*accuracy on agent\-safety evaluation with AgentAuditor \(NeurIPS 2025, ASSEBench: 2,293 records, 15 risk types\); and\[[52](https://arxiv.org/html/2606.04037#bib.bib47)\]chart the shift from LLM\-as\-Judge to Agent\-as\-a\-Judge \(tool\-augmented, multi\-agent evaluators\)\. We address validator reliability via anti\-circularity controls \(E1\) and flag human calibration as future work \([Section˜4\.5](https://arxiv.org/html/2606.04037#S4.SS5)\)\.

Enterprise ontologies have evolved from knowledge\-representation artifacts into operational AI components\. Foundational graph\-semantic data\-model work\[[10](https://arxiv.org/html/2606.04037#bib.bib39),[42](https://arxiv.org/html/2606.04037#bib.bib38)\]established that domain ontologies can be derived systematically rather than authored ad hoc\.\[[14](https://arxiv.org/html/2606.04037#bib.bib40)\]survey knowledge\-graph infrastructure on which our industry ontologies build\.\[[36](https://arxiv.org/html/2606.04037#bib.bib41)\]catalog LLM–KG convergence along two directions \(KG\-enhanced LLMs; LLM\-enhanced KGs\); we contribute a third:*ontology\-grounded LLM verification*—using structured knowledge to verify agent outputs rather than generate them—which is largely absent from the LLM–KG literature\.

#### 1\.1\.3Governance Frameworks and Safety Standards

AI\-governance frameworks matured rapidly between 2024 and 2026\. The NIST AI Risk Management Framework\[[33](https://arxiv.org/html/2606.04037#bib.bib29)\]has four functions: Govern, Map, Measure, and Manage\. Our pipeline maps onto them\. Ontology\-to\-scenario generation does Map and Measure\. The Trust Certificate handles the Manage artifact\. The EU AI Act\[[11](https://arxiv.org/html/2606.04037#bib.bib24)\]mandates conformity assessments for high\-risk systems; the graduated verdict framework \(Approved/Conditional/Rejected\) is designed against Articles 9 \(Risk Management\) and 15 \(Accuracy, Robustness, Cybersecurity\)\. Singapore’s Model AI Governance Framework\[[16](https://arxiv.org/html/2606.04037#bib.bib30)\]has risk\-proportional oversight, which the autonomy\-level semantics \([Table˜1](https://arxiv.org/html/2606.04037#S2.T1)\) mirror\. ISO/IEC 42001:2023\[[19](https://arxiv.org/html/2606.04037#bib.bib31)\]specifies AI\-management\-system requirements that the simulation gate operationalizes\.\[[35](https://arxiv.org/html/2606.04037#bib.bib49)\]enumerate the first formal agentic\-risk taxonomy \(10 critical risks, 100\+ contributors\); NIST’s February 2026 Agent Standards Initiative\[[34](https://arxiv.org/html/2606.04037#bib.bib50)\]targets identity, security, and interoperability; the Microsoft Agent Governance Toolkit\[[29](https://arxiv.org/html/2606.04037#bib.bib51)\]addresses all ten OWASP risks at runtime with sub\-millisecond enforcement\.

At the national level, Vietnam enacted Law No\. 134/2025/QH15 on Artificial Intelligence\[[32](https://arxiv.org/html/2606.04037#bib.bib52)\]\(effective March 2026\), one of the first standalone AI laws in Southeast Asia\. The law classifies financial\-services AI \(banking, insurance\) as high\-risk with compliance due September 2027\. Decree 94/2025/NĐ\-CP\[[12](https://arxiv.org/html/2606.04037#bib.bib53)\]creates a regulatory sandbox for AI\-enabled banking\. These regulations motivate the inclusion of banking \(VN\) and insurance \(VN\) as experimental verticals in which pre\-deployment AI verification is legally mandated rather than aspirational\.

Safety\-critical software industries have long institutionalized pre\-deployment verification through DO\-178C in avionics\[[40](https://arxiv.org/html/2606.04037#bib.bib21)\]\(5 software levels, MC/DC coverage for Level A\), IEC 62304 in medical devices\[[17](https://arxiv.org/html/2606.04037#bib.bib22)\]\(safety classes A–C\), and ISO 26262 in automotive\[[18](https://arxiv.org/html/2606.04037#bib.bib23)\]\(ASIL A–D, fault injection, formal verification\)\. No analogous standard yet exists for enterprise AI agents\. The common gap across all these governance artifacts is that they specify*what*to verify but not*how*: OWASP names risks; NIST calls for standards; Microsoft enforces at runtime; Vietnam mandates conformity\. The ontology\-grounded approach proposed here supplies the missing “how”—systematic test generation from domain ontologies—converting framework requirements into executable verification scenarios complementary to runtime enforcement\.

### 1\.2Research Gaps

The literature surveyed in[Section˜1\.1](https://arxiv.org/html/2606.04037#S1.SS1)reveals six major gaps addressed in this study\.*First*, existing approaches do not comprehensively formalize the operational envelope within which an AI agent is authorized and validated to operate, leaving safety claims insufficiently scoped and difficult to enforce\.*Second*, current agent\-safety benchmarks\[[22](https://arxiv.org/html/2606.04037#bib.bib17),[53](https://arxiv.org/html/2606.04037#bib.bib56),[2](https://arxiv.org/html/2606.04037#bib.bib43),[54](https://arxiv.org/html/2606.04037#bib.bib44),[51](https://arxiv.org/html/2606.04037#bib.bib45)\]rely heavily on manually curated test cases, limiting scalability across the large number of industry verticals required for enterprise deployment and resulting in fragmented rather than systematic regulatory coverage\.*Third*, existing evaluation frameworks rarely provide machine\-verifiable and cryptographically bound attestations linking a specific agent version to validated behavioral properties under defined operational constraints\.*Fourth*, many current platforms implement safety controls primarily at the application layer, which may be circumvented under orchestration or configuration failures, while lacking infrastructure\-level deployment gates for uncertified agents\.*Fifth*, simulation\-based approaches provide statistical evidence rather than formal guarantees, whereas most neural\-network verification methods\[[15](https://arxiv.org/html/2606.04037#bib.bib7),[20](https://arxiv.org/html/2606.04037#bib.bib8),[46](https://arxiv.org/html/2606.04037#bib.bib9),[45](https://arxiv.org/html/2606.04037#bib.bib10)\]focus on bounded model\-level properties rather than behavioral invariants across multi\-step agent workflows\.*Sixth*, most empirical studies on agent safety evaluate a single LLM family, leaving unresolved whether observed outcomes arise from model\-specific latent knowledge or from structural properties of the verification methodology itself\. Collectively, the proposed framework components described in[Sections2\.1](https://arxiv.org/html/2606.04037#S2.SS1)to[2\.5](https://arxiv.org/html/2606.04037#S2.SS5)address Gaps \(1\)–\(4\), while the evaluation methodology in[Section˜3](https://arxiv.org/html/2606.04037#S3)addresses Gaps \(5\)–\(6\)\.

## 2Proposed Enterprise Agentic AI Framework

### 2\.1Framework Overview

Three components make up the framework for pre\-deployment verification of enterprise AI agents: the*Agent Operational Envelope*\([Section˜2\.2](https://arxiv.org/html/2606.04037#S2.SS2)\) formalizes the certification space;*Ontology\-to\-Scenario Generation*\([Section˜2\.3](https://arxiv.org/html/2606.04037#S2.SS3)\) derives test scenarios from industry ontologies; and the*Trust Certificate*\([Section˜2\.4](https://arxiv.org/html/2606.04037#S2.SS4)\) provides a machine\-verifiable attestation that binds an agent version to its verification evidence\.[Section˜2\.5](https://arxiv.org/html/2606.04037#S2.SS5)describes the implementation architecture;[Section˜3](https://arxiv.org/html/2606.04037#S3)presents the quantitative and empirical evaluation frameworks\.

### 2\.2Agent Operational Envelope

We define the*operational envelope*: the formally specified space within which an agent is certified to operate\.

#### 2\.2\.1Formal Definition

###### Definition 2\.1\(Agent Operational Envelope\)\.

An agent operational envelopeℰ𝒜\\mathcal\{E\}\_\{\\mathcal\{A\}\}for agent𝒜\\mathcal\{A\}operating under ontology𝒪\\mathcal\{O\}is defined as a tuple:

ℰ𝒜=⟨Π,Σ,Φ,Γ,Λ⟩\\mathcal\{E\}\_\{\\mathcal\{A\}\}=\\langle\\Pi,\\Sigma,\\Phi,\\Gamma,\\Lambda\\rangle\(1\)where:

- •Π\\Pi:Permission boundary— the set of actions the agent is authorized to perform
- •Σ\\Sigma:Domain scope— the ontological domains within which the agent may reason
- •Φ\\Phi:Safety properties— invariants that must hold across all agent executions
- •Γ\\Gamma:Governance constraints— regulatory rules that bound agent decisions
- •Λ\\Lambda:Autonomy level— the degree of independent action permitted \(L​0L0–L​3L3\)

#### 2\.2\.2Deriving Envelopes from Ontologies

Each component ofℰ𝒜\\mathcal\{E\}\_\{\\mathcal\{A\}\}derives from the enterprise ontology𝒪=⟨ℛ,𝒟,ℐ⟩\\mathcal\{O\}=\\langle\\mathcal\{R\},\\mathcal\{D\},\\mathcal\{I\}\\rangle\(as defined in the companion neurosymbolic\-architectures paper\)\. A BSA/AML Compliance Analyst agent illustrates the derivation:

Π\\displaystyle\\Pi=actions\(ℛri\.αi\)\\displaystyle=\\text\{actions\}\(\\mathcal\{R\}\_\{r\_\{i\}\}\.\\alpha\_\{i\}\)\(from role approval authority\)\(2\)Σ\\displaystyle\\Sigma=domains\(𝒟\.𝒱\)\\displaystyle=\\text\{domains\}\(\\mathcal\{D\}\.\\mathcal\{V\}\)\(from domain verticals\)\(3\)Φ\\displaystyle\\Phi=invariants\(𝒟\.G\)\\displaystyle=\\text\{invariants\}\(\\mathcal\{D\}\.G\)\(from governance constraints\)\(4\)Γ\\displaystyle\\Gamma=regulations\(𝒟\.G\)\\displaystyle=\\text\{regulations\}\(\\mathcal\{D\}\.G\)\(from regulatory frameworks\)\(5\)Λ\\displaystyle\\Lambda=level\(𝒜\.config\)\\displaystyle=\\text\{level\}\(\\mathcal\{A\}\.\\text\{config\}\)\(from agent configuration\)\(6\)
Example: Fintech Compliance Analyst EnvelopeΠ\\displaystyle\\Pi=\{flag\_suspicious,file\_CTR,file\_SAR,escalate\}\\displaystyle=\\\{\\text\{flag\\\_suspicious\},\\text\{file\\\_CTR\},\\text\{file\\\_SAR\},\\text\{escalate\}\\\}\(NOT: approve\_loan, execute\_trade\)Σ\\displaystyle\\Sigma=\{BSA/AML,KYC,sanctions\}\\displaystyle=\\\{\\text\{BSA/AML\},\\text\{KYC\},\\text\{sanctions\}\\\}Φ\\displaystyle\\Phi=\{“never disclose SAR filing to subject”,\\displaystyle=\\\{\\text\{\`\`never disclose SAR filing to subject''\},“always verify identity before account access”\}\\displaystyle\\qquad\\phantom\{\\\{\}\\text\{\`\`always verify identity before account access''\}\\\}Γ\\displaystyle\\Gamma=\{31​CFR​§​1010​–​1020,OCC 2013\-29,FinCEN guidance\}\\displaystyle=\\\{31\\text\{ CFR \}\\S 1010\\text\{\-\-\}1020,\\text\{ OCC 2013\-29\},\\text\{ FinCEN guidance\}\\\}Λ\\displaystyle\\Lambda=L​2​\(Execute: autonomous within bounds, escalate when uncertain\)\\displaystyle=L2\\text\{ \(Execute: autonomous within bounds, escalate when uncertain\)\}

This envelope is*automatically derivable*from the fintech ontology—the same ontology used to generate test scenarios in our pilot study \([Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)\)\. The permission boundaryΠ\\Picomes from the role’sapproval\_authorityfield; the governance constraintsΓ\\Gammafrom the ontology’s regulatory layer\.

#### 2\.2\.3Autonomy Level Semantics

The autonomy levelΛ\\Lambdadetermines the agent’s decision authority within its permission boundary:

Table 1:Autonomy Level Semantics###### Property 2\.1\(Autonomy Monotonicity — Design Requirement\)\.

Verification for agents at levelΛj\\Lambda\_\{j\}is strictly more demanding than atΛi\\Lambda\_\{i\}whenj\>ij\>i:

Λj\>Λi⟹\|𝒮​\(Λj\)\|\>\|𝒮​\(Λi\)\|∧θpass​\(Λj\)\>θpass​\(Λi\)\.\\Lambda\_\{j\}\>\\Lambda\_\{i\}\\implies\|\\mathcal\{S\}\(\\Lambda\_\{j\}\)\|\>\|\\mathcal\{S\}\(\\Lambda\_\{i\}\)\|\\wedge\\theta\_\{\\text\{pass\}\}\(\\Lambda\_\{j\}\)\>\\theta\_\{\\text\{pass\}\}\(\\Lambda\_\{i\}\)\.\(7\)This is a framework\-level axiom—the scenario budget and pass threshold are engineering inputs per autonomy tier—not a theorem derived from the Operational Envelope definition\.

#### 2\.2\.4Operational Envelope as Trust Attestation

The operational envelope is a*trust attestation*\. It states precisely what the agent may do, where it may reason, what invariants must hold, and which regulatory rules bound its decisions\. An execution traceτ=⟨s0,a0,…,sn⟩\\tau=\\langle s\_\{0\},a\_\{0\},\\ldots,s\_\{n\}\\rangleis*envelope\-compliant*iff every stepiisatisfiesai∈Π∧domain​\(si\)⊆Σ∧⋀φ∈Φφ​\(si\)∧⋀γ∈Γγ​\(si,ai\)a\_\{i\}\\in\\Pi\\wedge\\text\{domain\}\(s\_\{i\}\)\\subseteq\\Sigma\\wedge\\bigwedge\_\{\\varphi\\in\\Phi\}\\varphi\(s\_\{i\}\)\\wedge\\bigwedge\_\{\\gamma\\in\\Gamma\}\\gamma\(s\_\{i\},a\_\{i\}\)\.

### 2\.3Ontology\-to\-Scenario Generation

Test scenarios are derived automatically from industry ontologies, removing the manual authoring bottleneck that limits hand\-curated benchmark suites\.

#### 2\.3\.1Scenario Taxonomy

We define three categories of test scenarios, each derived from different ontological layers:

1. 1\.Regulatory scenarios\(𝒮R\\mathcal\{S\}\_\{R\}\): Derived from the governance constraints in the Domain Ontology \(𝒟\.G\\mathcal\{D\}\.G\)\. Test whether the agent correctly applies regulatory requirements\. - •Banking: BSA/AML transaction thresholds, KYC identity verification, CFPB fair lending, OFAC sanctions screening - •Healthcare: HIPAA privacy rules, EMTALA emergency treatment, Stark Law referral restrictions - •Insurance: NAIC solvency requirements, state DOI rate filing, claims adjudication guidelines
2. 2\.KPI/Operational scenarios\(𝒮K\\mathcal\{S\}\_\{K\}\): Derived from the metrics definitions in the Domain Ontology \(𝒟\.M\\mathcal\{D\}\.M\)\. Test whether the agent correctly calculates and interprets business metrics\. - •“Calculate the combined ratio given these loss and expense figures” \(insurance\) - •“Assess whether this NRR trend indicates churn risk” \(SaaS\) - •“Evaluate OEE given these downtime and defect rates” \(manufacturing\)
3. 3\.Adversarial scenarios\(𝒮A\\mathcal\{S\}\_\{A\}\): Generated to test agent resilience against boundary conditions and attacks\. - •Prompt injection: attempts to override agent instructions - •Data exfiltration: requests for unauthorized data access - •Regulatory bypass: social engineering to skip compliance checks - •Role confusion: attempting to invoke actions outside the agent’s approval authority

#### 2\.3\.2Generation Algorithm

Algorithm 1Ontology\-to\-Scenario Generation0:Industry ontology

𝒪\\mathcal\{O\}, agent envelope

ℰ𝒜\\mathcal\{E\}\_\{\\mathcal\{A\}\}
0:Scenario set

𝒮\\mathcal\{S\}
1:

𝒮←∅\\mathcal\{S\}\\leftarrow\\emptyset
2:for allregulation

γ∈𝒪\.𝒟\.G\\gamma\\in\\mathcal\{O\}\.\\mathcal\{D\}\.Gdo

3:

𝒮R←GenRegulatoryScenarios\(γ,ℰ𝒜\.Π\)\\mathcal\{S\}\_\{R\}\\leftarrow\\textsc\{GenRegulatoryScenarios\}\(\\gamma,\\mathcal\{E\}\_\{\\mathcal\{A\}\}\.\\Pi\)\{Generate positive and negative test cases per regulation\}

4:

𝒮←𝒮∪𝒮R\\mathcal\{S\}\\leftarrow\\mathcal\{S\}\\cup\\mathcal\{S\}\_\{R\}
5:endfor

6:for allmetric

m∈𝒪\.𝒟\.Mm\\in\\mathcal\{O\}\.\\mathcal\{D\}\.Mdo

7:

𝒮K←GenKPIScenarios\(m,m\.healthy\_range,m\.world\_class\)\\mathcal\{S\}\_\{K\}\\leftarrow\\textsc\{GenKPIScenarios\}\(m,m\.\\text\{healthy\\\_range\},m\.\\text\{world\\\_class\}\)\{Test metric calculation and interpretation\}

8:

𝒮←𝒮∪𝒮K\\mathcal\{S\}\\leftarrow\\mathcal\{S\}\\cup\\mathcal\{S\}\_\{K\}
9:endfor

10:for allaction

a∈ℰ𝒜\.Πa\\in\\mathcal\{E\}\_\{\\mathcal\{A\}\}\.\\Pido

11:

𝒮A←GenAdversarialScenarios​\(a\)\\mathcal\{S\}\_\{A\}\\leftarrow\\textsc\{GenAdversarialScenarios\}\(a\)\{Boundary conditions, injection, bypass attempts\}

12:

𝒮←𝒮∪𝒮A\\mathcal\{S\}\\leftarrow\\mathcal\{S\}\\cup\\mathcal\{S\}\_\{A\}
13:endfor

14:

𝒮←Deduplicate​\(𝒮\)\\mathcal\{S\}\\leftarrow\\textsc\{Deduplicate\}\(\\mathcal\{S\}\)
15:return

𝒮\\mathcal\{S\}

Each regulatory constraintγ\\gammagenerates at minimum two scenarios: a*positive case*\(the agent should apply the regulation correctly\) and a*negative case*\(the agent should detect and reject a regulatory violation\)\. For regulations with numeric thresholds \(e\.g\., BSA/AML $10,000 reporting threshold\), additional*boundary cases*are generated atthreshold±ϵ\\text\{threshold\}\\pm\\epsilon\.

##### Information hierarchy\.

[Algorithm˜1](https://arxiv.org/html/2606.04037#alg1)represents the richest information condition for scenario generation \(G4 in our empirical evaluation,[Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)\)\. We can formalize the information available to alternative generation strategies as a strict hierarchy:

IG1⊂IG2⊂IG3⊂IG4\\text\{I\}\_\{\\text\{G1\}\}\\subset\\text\{I\}\_\{\\text\{G2\}\}\\subset\\text\{I\}\_\{\\text\{G3\}\}\\subset\\text\{I\}\_\{\\text\{G4\}\}\(8\)
where:

- •IG1=\{r,d\}\\text\{I\}\_\{\\text\{G1\}\}=\\\{r,d\\\}: agent rolerrand industry domain nameddonly \(baseline LLM knowledge\)
- •IG2=IG1∪\{P,C\}\\text\{I\}\_\{\\text\{G2\}\}=\\text\{I\}\_\{\\text\{G1\}\}\\cup\\\{P,C\\\}: adds persona setPPand scenario category setCC\(behavioral coverage matrix\)
- •IG3=IG1∪\{chunks​\(𝒪\)\}\\text\{I\}\_\{\\text\{G3\}\}=\\text\{I\}\_\{\\text\{G1\}\}\\cup\\\{\\text\{chunks\}\(\\mathcal\{O\}\)\\\}: adds unstructured text extracted from the ontology \(simulating RAG retrieval\)
- •IG4=IG1∪\{𝒪′⊆𝒪\}\\text\{I\}\_\{\\text\{G4\}\}=\\text\{I\}\_\{\\text\{G1\}\}\\cup\\\{\\mathcal\{O\}^\{\\prime\}\\subseteq\\mathcal\{O\}\\\}: adds the full structured ontology \(with holdout partition𝒪′=\(1−h\)⋅𝒪\\mathcal\{O\}^\{\\prime\}=\(1\-h\)\\cdot\\mathcal\{O\}for anti\-circularity, whereh=0\.30h=0\.30\)

The distinction is*structural*: G3 receives the same ontological*content*as G4 in flattened text form, whereas G4 receives the three\-layer structure \(⟨ℛ,𝒟,ℐ⟩\\langle\\mathcal\{R\},\\mathcal\{D\},\\mathcal\{I\}\\rangle\) that enables[Algorithm˜1](https://arxiv.org/html/2606.04037#alg1)’s systematic traversal of regulatory constraints, metrics, and permission boundaries\. The pilot study asks whether structure matters above and beyond content\.

#### 2\.3\.3Coverage Analysis

Ontology\-grounded generation enables formal coverage analysis:

###### Definition 2\.2\(Regulatory Coverage\)\.

The regulatory coverage of a scenario set𝒮\\mathcal\{S\}against ontology𝒪\\mathcal\{O\}is:

RC​\(𝒮,𝒪\)=\|\{γ∈𝒪\.𝒟\.G∣∃s∈𝒮:stestsγ\}\|\|𝒪\.𝒟\.G\|\\text\{RC\}\(\\mathcal\{S\},\\mathcal\{O\}\)=\\frac\{\|\\\{\\gamma\\in\\mathcal\{O\}\.\\mathcal\{D\}\.G\\mid\\exists s\\in\\mathcal\{S\}:s\\text\{ tests \}\\gamma\\\}\|\}\{\|\\mathcal\{O\}\.\\mathcal\{D\}\.G\|\}\(9\)

We validate the coverage metric empirically in[Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)against a ground\-truth checklist of 125 regulatory requirements \(25 per industry\) curated from primary sources, comparing G4 to three alternative generation strategies\.

### 2\.4Trust Certificate

A Trust Certificate is a machine\-verifiable attestation of agent safety that binds a specific agent version to its verification evidence\.

#### 2\.4\.1Certificate Structure

###### Definition 2\.3\(Trust Certificate\)\.

A Trust Certificate𝒞\\mathcal\{C\}for agent𝒜\\mathcal\{A\}is a tuple:

𝒞𝒜=⟨ℰ𝒜,𝒮,𝐑,𝒱,t,sig⟩\\mathcal\{C\}\_\{\\mathcal\{A\}\}=\\langle\\mathcal\{E\}\_\{\\mathcal\{A\}\},\\mathcal\{S\},\\mathbf\{R\},\\mathcal\{V\},t,\\text\{sig\}\\rangle\(10\)where:

- •ℰ𝒜\\mathcal\{E\}\_\{\\mathcal\{A\}\}: The operational envelope under which certification was performed
- •𝒮\\mathcal\{S\}: The scenario set executed during verification
- •𝐑\\mathbf\{R\}: The results matrix \(per\-scenario pass/fail with judge evaluations\)
- •𝒱\\mathcal\{V\}: The certification verdict
- •tt: The certification timestamp
- •sig: A cryptographic signature binding the certificate to the specific agent version

#### 2\.4\.2Verdict Framework

The certification verdict𝒱\\mathcal\{V\}is determined by aggregate simulation results:

𝒱​\(𝐑\)=\{Approvedifpass\_rate​\(𝐑\)≥θhighConditionalif​θlow≤pass\_rate​\(𝐑\)<θhighRejectedifpass\_rate​\(𝐑\)<θlow\\mathcal\{V\}\(\\mathbf\{R\}\)=\\begin\{cases\}\\textsc\{Approved\}&\\text\{if \}\\text\{pass\\\_rate\}\(\\mathbf\{R\}\)\\geq\\theta\_\{\\text\{high\}\}\\\\ \\textsc\{Conditional\}&\\text\{if \}\\theta\_\{\\text\{low\}\}\\leq\\text\{pass\\\_rate\}\(\\mathbf\{R\}\)<\\theta\_\{\\text\{high\}\}\\\\ \\textsc\{Rejected\}&\\text\{if \}\\text\{pass\\\_rate\}\(\\mathbf\{R\}\)<\\theta\_\{\\text\{low\}\}\\end\{cases\}\(11\)
In theFAOSimplementation,θhigh=0\.95\\theta\_\{\\text\{high\}\}=0\.95andθlow=0\.80\\theta\_\{\\text\{low\}\}=0\.80\. The intermediate verdictConditionalrequires manual review by an L3\-authorized human operator before production deployment\.

#### 2\.4\.3Verdict Enforcement: The Simulation Gate

The simulation gate is an*architectural enforcement point*that blocks agent deployment based on certification verdict:

deploy​\(𝒜\)=\{allowif​𝒱=Approvedrequire\_L3\_approvalif​𝒱=Conditionalblockif​𝒱=Rejected\\text\{deploy\}\(\\mathcal\{A\}\)=\\begin\{cases\}\\text\{allow\}&\\text\{if \}\\mathcal\{V\}=\\textsc\{Approved\}\\\\ \\text\{require\\\_L3\\\_approval\}&\\text\{if \}\\mathcal\{V\}=\\textsc\{Conditional\}\\\\ \\text\{block\}&\\text\{if \}\\mathcal\{V\}=\\textsc\{Rejected\}\\end\{cases\}\(12\)
The gate is designed to operate at the infrastructure level \(Rust\-native AgentOS runtime\) rather than the application layer, preventing bypass by application code, and is environment\-aware: enforced inproduction/customer\-vpc, skipped instaging/development\.

#### 2\.4\.4Certificate Properties

A well\-formed Trust Certificate must satisfy four framework\-level design requirements\. These are axiomatic preconditions for certification, not theorems derived from the definition; the pilot study does not empirically validate them \(θCompleteness=0\.95\\theta\_\{\\text\{Completeness\}\}\{=\}0\.95is proposed, not achieved by any agent in the pilot\)\.

###### Property 2\.2\(Completeness — Design Requirement\)\.

RC​\(𝒮,𝒪\)≥0\.95\\text\{RC\}\(\\mathcal\{S\},\\mathcal\{O\}\)\\geq 0\.95for all applicable regulatory frameworks\.

###### Property 2\.3\(Freshness — Design Requirement\)\.

tcurrent−t≤Δ​tmaxt\_\{\\text\{current\}\}\-t\\leq\\Delta t\_\{\\text\{max\}\}; expiry forces re\-verification on ontology or agent\-code change\.

###### Property 2\.4\(Version Binding — Design Requirement\)\.

sigbinds𝒞\\mathcal\{C\}to a specific triple—code hash, model version, and ontology version—so any change invalidates𝒞\\mathcal\{C\}\.

###### Property 2\.5\(Non\-Transferability — Design Requirement\)\.

𝒞𝒜i\\mathcal\{C\}\_\{\\mathcal\{A\}\_\{i\}\}is valid only for𝒜i\\mathcal\{A\}\_\{i\};𝒜j≠𝒜i⟹𝒞𝒜i\\mathcal\{A\}\_\{j\}\\neq\\mathcal\{A\}\_\{i\}\\implies\\mathcal\{C\}\_\{\\mathcal\{A\}\_\{i\}\}inapplicable\.

### 2\.5Implementation Architecture

An implementation architecture that executes the framework of[Section˜2\.1](https://arxiv.org/html/2606.04037#S2.SS1)addresses Gap \(4\) of[Section˜1\.2](https://arxiv.org/html/2606.04037#S1.SS2): an infrastructure\-level deployment gate that cannot be bypassed by application code\. We propose a bilingual design for theFAOSplatform—a Rust\-native simulation runner \(for execution performance and sandboxing\) paired with a Python LLM\-as\-judge evaluator \(for semantic assessment\), orchestrated via Temporal workflows for durability\. The LLM\-as\-judge component has been empirically validated in our RA\-3 pilot\[[27](https://arxiv.org/html/2606.04037#bib.bib35)\]; the simulation runner and deployment gate are proposed designs\.

#### 2\.5\.1Simulation Runner

The proposed Rust\-native runner provides four execution guarantees\.*Concurrency control:*bounded parallelism viatokio::Semaphore\(10\)limits concurrent sandbox executions and prevents resource exhaustion\.*Sandbox isolation:*each scenario executes in an isolated sandbox environment with controlled tool access\.*Timeout enforcement:*per\-scenario timeout \(default 60 s, configurable per industry\) with deterministic cleanup ensures no scenario stalls the suite\.*Crash recovery:*Temporal workflow durability ensures simulation state survives runner crashes and resumes from the last checkpoint\.

#### 2\.5\.2LLM\-as\-Judge Evaluator

Agent responses are assessed by an LLM judge against scenario\-specific evaluation criteria:

judge​\(a,s\)=⟨pass∈\{0,1\},score∈\[0,1\],rationale∈String⟩\\text\{judge\}\(a,s\)=\\langle\\text\{pass\}\\in\\\{0,1\\\},\\text\{score\}\\in\[0,1\],\\text\{rationale\}\\in\\text\{String\}\\rangle\(13\)
The judge evaluates each response along four dimensions, each phrased as a verifiable assertion\.*Regulatory compliance:*the response correctly applies all applicable regulations to the scenario\.*Domain accuracy:*domain terms and metrics are used correctly according to the industry ontology\.*Safety boundary:*the response remains within the agent’s operational envelope\.*Adversarial resilience:*the agent resists manipulation attempts and refuses unauthorized actions\.

In our pilot study \([Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)\), we implement five specialized judge variants that decompose this general evaluator into measurable dimensions \([Table˜2](https://arxiv.org/html/2606.04037#S2.T2)\):

Table 2:LLM\-as\-Judge variants used in the pilot study\.All judge variants use temperatureT=0\.0T=0\.0for deterministic evaluation\. Each receives a structured rubric constraining its assessment scope, following the recommendations of\[[55](https://arxiv.org/html/2606.04037#bib.bib36)\]for reducing LLM\-as\-judge bias\.

#### 2\.5\.3Coverage Reporting and Observability

The coverage reporter produces a per\-vertical analysis

coverage​\(𝒜,𝒪\)=⟨RCreg,RCkpi,RCadv,RCtotal⟩,\\text\{coverage\}\(\\mathcal\{A\},\\mathcal\{O\}\)=\\langle\\text\{RC\}\_\{\\text\{reg\}\},\\ \\text\{RC\}\_\{\\text\{kpi\}\},\\ \\text\{RC\}\_\{\\text\{adv\}\},\\ \\text\{RC\}\_\{\\text\{total\}\}\\rangle,where each component measures the percentage of ontological elements covered by passing test scenarios; this report is embedded in the Trust Certificate\. For operational monitoring the simulation engine exports four Prometheus metrics \(total scenarios, failed scenarios, sandbox crashes, per\-scenario duration\) labeled by verdict, industry, and failure category\.

## 3Proposed Evaluation Framework

The framework of[Section˜2\.1](https://arxiv.org/html/2606.04037#S2.SS1)specifies*what*to verify; the architecture of[Section˜2\.5](https://arxiv.org/html/2606.04037#S2.SS5)specifies*how*\. Two complementary evaluation frameworks establish trust in the resulting Trust Certificate\. The Quantitative Evaluation Framework \([Section˜3\.1](https://arxiv.org/html/2606.04037#S3.SS1)\) extends simulation toward model checking and runtime verification to obtain mathematical guarantees; the Empirical Evaluation Framework \([Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)\) provides statistical evidence through a controlled study and three\-model cross\-validation\. Together they address gaps \(5\) and \(6\) of[Section˜1\.2](https://arxiv.org/html/2606.04037#S1.SS2)\.

### 3\.1Quantitative Evaluation Framework

Simulation provides statistical confidence, not mathematical guarantees\. Three extensions move toward formal agent verification\.

#### 3\.1\.1Property Specification Language

We extend Linear Temporal Logic \(LTL\)\[[39](https://arxiv.org/html/2606.04037#bib.bib12)\]with an ontological predicateonto​\(d,c\)\\texttt\{onto\}\(d,c\)asserting conceptccin domaindd:

φ::=p∣¬φ∣φ∧φ∣○φ∣φ𝒰φ∣□φ∣◇φ∣onto\(d,c\)\\varphi::=p\\mid\\neg\\varphi\\mid\\varphi\\wedge\\varphi\\mid\\bigcirc\\varphi\\mid\\varphi\\mathcal\{U\}\\varphi\\mid\\Box\\varphi\\mid\\Diamond\\varphi\\mid\\texttt\{onto\}\(d,c\)\(14\)Given ontology𝒪=⟨ℛ,𝒟,ℐ⟩\\mathcal\{O\}=\\langle\\mathcal\{R\},\\mathcal\{D\},\\mathcal\{I\}\\rangleand agent statesswith action–observation pair\(a,o\)\(a,o\):

s⊧onto\(d,c\)⇔∃e∈extract\(s\):e∈instances\(𝒪\.𝒟d,c\)s\\models\\texttt\{onto\}\(d,c\)\\iff\\exists e\\in\\text\{extract\}\(s\):e\\in\\text\{instances\}\(\\mathcal\{O\}\.\\mathcal\{D\}\_\{d\},c\)\(15\)whereextract​\(s\)\\text\{extract\}\(s\)maps state to domain entities \(NER or structured\-output parsing\) andinstances\(𝒪\.𝒟d,c\)\\text\{instances\}\(\\mathcal\{O\}\.\\mathcal\{D\}\_\{d\},c\)returns all instances ofccindd\. Instance checking is polynomial\-time and decidable under OWL 2 EL/QL; full OWL 2 DL isExpTime\. The FAOS ontologies use a restricted vocabulary amenable to efficient checking\.

Example Safety Property \(BSA/AML\)φCTR:□​\(amount\>10000⟹◇​file\_ctr\)\\varphi\_\{\\text\{CTR\}\}:\\Box\(\\texttt\{amount\}\>10000\\implies\\Diamond\\,\\texttt\{file\\\_ctr\}\)*“Always: if the transaction amount exceeds $10K, eventually file a Currency Transaction Report\.”*Analogous HIPAA and Fair\-Lending properties follow the same pattern withonto​\(d,c\)\\texttt\{onto\}\(d,c\)predicates parameterised by domain\.

#### 3\.1\.2Bounded Model Checking

For finite\-horizon agents \(e\.g\., single\-turn analysis\), bounded model checking \(BMC\)\[[5](https://arxiv.org/html/2606.04037#bib.bib13)\]verifiesBMC​\(𝒜,φ,k\)⇔∀τ∈Tracesk​\(𝒜\):τ⊧φ\\text\{BMC\}\(\\mathcal\{A\},\\varphi,k\)\\iff\\forall\\tau\\in\\text\{Traces\}\_\{k\}\(\\mathcal\{A\}\):\\tau\\models\\varphiwhereTracesk\\text\{Traces\}\_\{k\}is all execution traces of length≤k\\leq k\. Because LLM agents are stochastic, we define*probabilistic BMC*using tools such as PRISM\[[21](https://arxiv.org/html/2606.04037#bib.bib34)\]:

PBMC​\(𝒜,φ,k,δ\)⇔P​\[τ⊧φ∣τ∈Tracesk​\(𝒜\)\]≥1−δ\\text\{PBMC\}\(\\mathcal\{A\},\\varphi,k,\\delta\)\\iff P\[\\tau\\models\\varphi\\mid\\tau\\in\\text\{Traces\}\_\{k\}\(\\mathcal\{A\}\)\]\\geq 1\-\\delta\(16\)yielding a probabilistic guarantee thatφ\\varphiholds with confidence1−δ1\-\\deltaacross all traces of bounded lengthkk\.

#### 3\.1\.3Runtime Verification

For deployed agents, a runtime monitor\[[4](https://arxiv.org/html/2606.04037#bib.bib33)\]checks safety properties against the live execution trace \([Algorithm˜2](https://arxiv.org/html/2606.04037#alg2)\):

Algorithm 2Runtime Safety Monitor0:Agent

𝒜\\mathcal\{A\}, safety properties

Φ\\Phi, operational envelope

ℰ𝒜\\mathcal\{E\}\_\{\\mathcal\{A\}\}
1:loop

2:

e←ObserveEvent​\(𝒜\)e\\leftarrow\\textsc\{ObserveEvent\}\(\\mathcal\{A\}\)
3:

τ←τ⋅e\\tau\\leftarrow\\tau\\cdot e\{Append to trace\}

4:for all

φ∈Φ\\varphi\\in\\Phido

5:

v←Evaluate​\(φ,τ\)v\\leftarrow\\textsc\{Evaluate\}\(\\varphi,\\tau\)
6:if

v=Violatedv=\\textsc\{Violated\}then

7:

Intervene​\(𝒜,φ,e\)\\textsc\{Intervene\}\(\\mathcal\{A\},\\varphi,e\)\{Pause, rollback, or escalate\}

8:

EmitEvent​\(safety\_violation,φ,e\)\\textsc\{EmitEvent\}\(\\text\{safety\\\_violation\},\\varphi,e\)
9:elseif

v=Inconclusivev=\\textsc\{Inconclusive\}then

10:

IncrementWatchdog​\(φ\)\\textsc\{IncrementWatchdog\}\(\\varphi\)
11:endif

12:endfor

13:endloop

The runtime monitor operates over the existing immutable event store inFAOS, which provides append\-only, tamper\-evident recording of all agent actions with provenance chains\. This architecture ensures that the monitor has a complete, trustworthy record of agent behavior\.

#### 3\.1\.4The Verification Spectrum

The three formal techniques above—temporal\-logic specification, bounded model checking, and runtime verification—are not substitutes but complementary points on a verification spectrum that trades increasing cost for increasing rigor\.[Table˜3](https://arxiv.org/html/2606.04037#S3.T3)organizes this spectrum into five levels, each carrying a specific guarantee and a direct analogy to established practice in safety\-critical software engineering\.

Table 3:Agent Verification Spectrum: five levels of pre\-deployment rigor for enterprise AI agents\.Target\-level selection is governed by regulatory regime, autonomy level \(via Property[2\.1](https://arxiv.org/html/2606.04037#S2.ThmProperty1)\), and cost\-of\-failure profile\. The framework supports incremental adoption\. Organisations may begin at V1 and escalate selected safety\-critical properties to V2–V3 without re\-architecting the pipeline\.

### 3\.2Empirical Evaluation Framework

A controlled pilot study tests whether ontology\-grounded scenario generation produces test suites measurably superior to alternatives\. Conditions span four generation strategies and four regulated industries \(Fintech, Banking, Insurance, Healthcare\) instantiated as five industry\-by\-regulatory\-regime cells across the United States and Vietnam; the statistical protocol follows the procedure of the companion materials\[[27](https://arxiv.org/html/2606.04037#bib.bib35)\]\. We chose this US/Vietnam cross\-jurisdictional mix deliberately\. The US verticals establish a regulatory baseline familiar to international reviewers \(BSA/AML, HIPAA, NAIC\), while the Vietnamese verticals stress\-test the framework against an underrepresented regulatory regime where \(a\) Vietnamese\-language statutes are not present in most LLM pretraining data, and \(b\) the regulations were enacted or revised recently \(post\-2025\), post\-dating most pretraining cutoffs\. This combination tests whether ontology grounding helps even when the LLM lacks prior parametric knowledge of the regulatory regime\.

#### 3\.2\.1Enterprise AI Assurance Framework

Does ontology\-grounded scenario generation produce test suites with higher regulatory coverage, fault detection, and industry specificity than baseline, persona\-based, or RAG\-augmented alternatives? This study tests that question\. The independent variable is a within\-subjects scenario\-generation*condition*with four levels\.G1 \(Baseline\): the LLM receives only the agent role and industry name\.G2 \(Persona\-Scenario Matrix\): the LLM crosses five personas with six scenario categories \(cf\.A\-Sim\[[28](https://arxiv.org/html/2606.04037#bib.bib25)\]\)\.G3 \(RAG\-Augmented\): the LLM receives eight unstructured text chunks retrieved from the industry ontology, simulating a RAG pipeline\.G4 \(Ontology\-Grounded\): the LLM receives the full three\-layer structured ontology following[Algorithm˜1](https://arxiv.org/html/2606.04037#alg1), with 30% of regulatory constraints held out from the prompt to control circularity \(E1\)\. The blocking factor is the industry\-by\-regulatory\-regime cell \(k=5k=5\): US fintech \(BSA/AML, KYC\), US insurance \(NAIC, state DOI\), US healthcare \(HIPAA, EMTALA\), Vietnamese banking \(SBV circulars, Decree 116\), and Vietnamese insurance \(Insurance Business Law 2022, Circular 132\)\. These cells map four regulated industries \(Fintech, Banking, Insurance, Healthcare\) across two regulatory regimes, yielding cross\-regulatory\-regime validation\. Each condition×\\timesindustry cell is replicated three times at generator temperatureT=0\.3T=0\.3\(E2 protocol fix\), producing4×5×3=604\\times 5\\times 3=60independently generated test suites of 30 scenarios each \(1,800 total scenarios\)\.

#### 3\.2\.2Dependent Variables

Four dependent variables map to the quality dimensions of[Section˜2\.3](https://arxiv.org/html/2606.04037#S2.SS3)\(regulatory source details for RC are consolidated in[Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)’s Ground Truth subsection\):

1. 1\.Regulatory Coverage \(RC\): proportion of a 125\-item checklist \(25 per industry\) curated from primary regulatory sources covered by at least one scenario; per\-requirement binary,n=125n\{=\}125per condition\.
2. 2\.Fault Detection Rate \(FDR\): two\-stage assessment \(E4\)—*FDR\-design*asks whether the suite contains a scenario that*should*detect each injected fault;*FDR\-execution*asks whether that scenario*does*detect the fault when run against a fault\-injected agent\. 25 faults across five categories \(threshold errors, missing regulations, role\-boundary violations, adversarial vulnerabilities, metric\-calculation errors\); per\-fault binary,n=25n\{=\}25\.
3. 3\.Industry Specificity Score \(ISS\): LLM\-as\-judge rating on a 1–5 Likert scale per scenario \(1 generic, 5 deeply specialized\); per\-scenario,n=150n\{=\}150\.
4. 4\.Adversarial Coverage \(AC\): proportion of a six\-category adversarial taxonomy covered \(prompt injection, data exfiltration, regulatory bypass, role confusion, boundary manipulation, social engineering\); per\-category,n=6n\{=\}6\.

#### 3\.2\.3Evaluation Method

All assessments use an LLM\-as\-judge approach \(Claude Sonnet 4 atT=0\.0T=0\.0for deterministic evaluation\)\. Each judge call receives a structured rubric specific to the DV:

- •*RC judge*: Receives one regulation \+ one scenario; returns binarycovered/not\-coveredwith rationale\.
- •*ISS judge*: Receives one scenario \+ industry; returns 1–5 score with rationale\.
- •*AC judge*: Receives one scenario; classifies into adversarial category ornull\.
- •*FDR\-design judge*: Receives one fault spec \+ one scenario; returns binarywould\_detect\.
- •*FDR\-execution judge*: Receives a faulty\-agent response \+ expected behavior; returns binaryfault\_detected\.

#### 3\.2\.4Ground Truth and Anti\-Circularity Controls

Regulatory checklists \(125 items, 25 per industry\) are curated from primary statutory sources—not the FAOS ontology—to avoid circularity: 31 CFR §1010–1020 plus OCC 2013\-29 and Dodd\-Frank §1071 \(fintech\); NAIC Models \#785/\#668/\#900, RBC instructions, state DOI filings \(insurance\); 45 CFR §164, 42 USC §1395dd, 42 CFR §411 \(healthcare\); SBV Circulars 11/2021, 22/2023, 39/2016 and Decree 116/2013 \(Vietnamese banking\); Insurance Business Law 2022, Circular 132/2023, Decree 67/2023, AML Law 2022 \(Vietnamese insurance\)\. The fault\-injection corpus comprises 25 faults \(5 per industry\) across five categories: threshold errors, missing regulations, role\-boundary violations, adversarial vulnerabilities, and metric\-calculation errors\. Each fault has an injected deviation, ground truth, and expected detection mechanism\. Faults are injected into the agent’s system prompt, not the scenarios\. Vietnamese faults include NPL thresholds \(SBV Group 1≤\\leq30 vs\. correct≤\\leq10 days\) and solvency\-margin confusion \(80% vs\. 100%\)\. For E1 anti\-circularity, 30% of G4’s regulatory constraints are held out from the generation prompt; the disaggregated seen\-vs\-unseen RC split will be released with the v0\.2 artifact at paper acceptance\[[25](https://arxiv.org/html/2606.04037#bib.bib57)\]\.

#### 3\.2\.5Statistical Analysis and Hypotheses

The primary test is Friedman’s rank\-sum test \(nonparametric repeated\-measures ANOVA\) for each DV, with conditions as treatments and industry\-replication combinations as blocks \(α=0\.05\\alpha=0\.05\)\. Post\-hoc comparisons use Wilcoxon signed\-rank tests with Bonferroni correction for G4 versus each alternative \(m=3m=3comparisons\); effect size is Kendall’sWW\.*A priori*practical\-significance thresholds \(E5\) are RC≥15\\geq 15pp, FDR≥2\\geq 2additional faults \(of 15\), ISS≥1\.0\\geq 1\.0on the 5\-point scale, with AC tested via TOST equivalence at±15\\pm 15pp\. Four hypotheses are pre\-registered:H1—G4 achieves significantly higher RC than G1/G2/G3;H2—G4 achieves significantly higher FDR;H3—G4 achieves significantly higher ISS;H4—AC is equivalent across conditions \(ontology does not uniquely improve adversarial coverage\)\.

#### 3\.2\.6Results

Table 4:Regulatory Coverage \(RC\) by condition and industry\. Values are proportion of 25\-item checklist covered \(±\\pmSD across 3 replications\)\. Bold = highest per industry\.Table 5:Fault Detection Rate by condition \(25 faults across 5 industries\)\. FDR\-design = suite contains a relevant scenario; FDR\-execution = fault actually detected at runtime\. Mean±\\pmSD across 15 suites per condition\.![Refer to caption](https://arxiv.org/html/2606.04037v2/x1.png)Figure 1:Fault Detection Rate: design\-time coverage vs\. runtime execution\. On the Claude pilot, G4 \(Ontology\) exhibits the largest gap \(\+15pp\), suggesting an apparent*coverage\-precision tradeoff*on this model;[Section˜3\.2\.7](https://arxiv.org/html/2606.04037#S3.SS2.SSS7)shows the gap does not replicate on Qwen \(−\-16pp\) or Gemma \(\+3pp\), so the tradeoff is reported as a model\-dependent observation rather than an established finding\.Table 6:Industry Specificity Score \(ISS\) by condition and industry\. Mean score on 1–5 Likert scale \(±\\pmSD across 30 scenarios×\\times3 replications\)\. Bold = highest per industry\.Table 7:Statistical significance tests \(Friedman rank\-sum,k=4k=4conditions\)\. Post\-hoc: Wilcoxon signed\-rank with Bonferroni correction for G4 vs\. each alternative\. Correction is per\-DV \(m=3m\{=\}3\); a family\-wise correction over all primary tests would usem≈12m\{\\approx\}12\(4 DVs×\\times3 post\-hocs\), which leaves G4\>\>G2 on RC \(pc=\.0006p\_\{c\}\{=\}\.0006, significant atα/12\\alpha/12\) and G4\>\>all on ISS \(pc<\.001p\_\{c\}\{<\}\.001, significant atα/12\\alpha/12\) but does not change the non\-significance of the other G4 comparisons\. Kendall’sWWeffect sizes remain small \(W<0\.07W<0\.07\) across all DVs\.The results \([Table˜7](https://arxiv.org/html/2606.04037#S3.T7)\) support the industry\-specificity hypothesis \(H3\) and the adversarial\-equivalence hypothesis \(H4\), partially support the regulatory\-coverage hypothesis \(H1, robust only against the persona baseline G2\), do not support the fault\-detection hypothesis \(H2\), and surface an unexpected fault\-detection pattern\.

*H1 \(RC\): Supported against G2\.*Ontology\-grounded generation \(G4\) leads with mean regulatory coverage of 48\.3%, well above persona\-based generation \(G2, 33\.1%; post\-hocpc=0\.0006p\_\{c\}=0\.0006\)\. The largest per\-industry point\-estimate gains over G1 occur in healthcare \(\+28pp\) and Vietnamese insurance \(\+16pp\), suggesting that ontology value scales with regulatory complexity; these are descriptive contrasts only, as the G4 vs\. G1 omnibus comparison is not Bonferroni\-significant \(pc=0\.243p\_\{c\}=0\.243\)\. The G4 vs\. G3 difference \(\+3\.7pp\) is likewise not statistically significant after correction \(pc=1\.0p\_\{c\}=1\.0\), indicating that*structured*ontology and*unstructured*RAG chunks produce similar coverage when the underlying content is equivalent\. We discuss this finding further in[Section˜4](https://arxiv.org/html/2606.04037#S4)\. A surprising operational finding emerged in the Vietnamese banking cell, where G3 \(RAG\) achieved a higher mean regulatory coverage than G4 \(0\.57 vs\. 0\.49\)\. The published coverage summaries show that, across the three Vietnamese\-banking replications, G3 covered 15 unique checklist requirements while G4 covered 14; G3 uniquely covered requirements on customer identity verification, related\-party credit exposure, medium\- and long\-term lending limits, and credit assessment, while G4 uniquely covered cash\-transaction reporting, structuring detection, and SBV reporting\. This exposes a more cautious trade\-off: structured ontology context can improve domain specificity while still narrowing coverage breadth in regulatory regimes whose obligations are distributed across many circulars\.

*H2 \(FDR\): Not supported\.*Fault detection rates \([Table˜5](https://arxiv.org/html/2606.04037#S3.T5)\) show no significant differences across conditions \(p=\.891p=\.891\)\. All conditions generate scenarios capable of detecting approximately 55–64% of injected faults at the design level\. However, on the Claude pilot G4 shows the lowest*execution*FDR \(40%\) and largest design\-execution gap \(\+15pp;[Figure˜1](https://arxiv.org/html/2606.04037#S3.F1)\), suggesting that ontology\-generated scenarios, while regulatory\-comprehensive, may be less effective at*triggering*specific fault behaviors at runtime\. On Claude this pattern resembles acoverage\-precision tradeoff: breadth \(regulatory coverage\) purchased at the expense of depth \(fault\-triggering precision\)\. However,[Section˜3\.2\.7](https://arxiv.org/html/2606.04037#S3.SS2.SSS7)shows the gap does not replicate on Qwen \(−\-16pp\) or Gemma \(\+3pp\), so we report the tradeoff as a model\-dependent, exploratory observation rather than an established finding\.

*H3 \(ISS\): Strongly supported\.*G4 produces the most industry\-specific scenarios \(4\.77/5\.0\), well above all alternatives: G1 \(pc=3\.2×10−5p\_\{c\}=3\.2\\times 10^\{\-5\}\), G2 \(pc<10−5p\_\{c\}<10^\{\-5\}\), and G3 \(pc=0\.0008p\_\{c\}=0\.0008\)\. The G4\-over\-G3 ISS gap is significant despite similar RC scores, indicating that structured ontology injection produces scenarios that are regulatory\-relevant and domain\-specific in formulation\.

*H4 \(AC\): Supported\.*Adversarial coverage is equivalent across conditions \(p=\.995p=\.995,W=\.004W=\.004\), confirming that adversarial scenario generation depends on explicit prompting rather than domain knowledge source\. All conditions achieve 88–91% coverage of the six\-category adversarial taxonomy\.

A specific instance of these two patterns surfaced in the Vietnamese insurance cell\. A risk\-classification and capital\-adequacy agent operating under Circular 06/2024/TT\-BTC\[[30](https://arxiv.org/html/2606.04037#bib.bib55)\]showed the strongest ontology advantage in the Vietnam\-regime subset: G4 reached the highest RC among the four conditions \(0\.56\), ahead of G3 RAG \(0\.51\), G1 \(0\.40\), and G2 \(0\.28\)\. This expansion drove the \+16 pp RC gain over G1 \(G4 RC=0\.56=0\.56vs\. G1 RC=0\.40=0\.40\) reported in[Table˜4](https://arxiv.org/html/2606.04037#S3.T4)\. Yet on industry specificity, G4 \(4\.74\) and G3 RAG \(4\.73\) finished essentially tied in this cell—well above persona\-based G2, but with the ontology’s marginal advantage over chunked\-RAG largely collapsed \([Table˜6](https://arxiv.org/html/2606.04037#S3.T6)\)\. The combined pattern suggests an interpretation we did not anticipate at pre\-registration: ontology grounding earns its keep on regulatory coverage when the relevant statutes are diffuse or cross\-referenced, but its industry\-specificity advantage saturates once the underlying regulatory text is itself sufficiently dense—as Circular 06/2024 is\. Future work should map this saturation curve explicitly: ontology grounding likely has the highest marginal value in jurisdictions or verticals where the regulatory text density is low and cross\-reference complexity is high\.

#### 3\.2\.7Cross\-Model Validation

A central threat to the preceding results is that the ontology advantage may reflect model\-specific parametric knowledge rather than the structural contribution of ontological context\. The full 60\-suite experiment was replicated with two additional generator models—Qwen 2\.5 72B Instruct \(OpenRouter\) and Gemma 4 26B \(Google AI Studio\)—while holding the Claude Sonnet 4 judge fixed atT=0\.0T\{=\}0\.0to preserve measurement consistency\. The identical experimental design \(4 conditions×\\times5 industries×\\times3 replications×\\times30 scenarios\) yields 1,800 scenarios per model and 5,400 total across all three\.

[Table˜8](https://arxiv.org/html/2606.04037#S3.T8)summarizes the G4 \(ontology\) performance across generator models\.

Table 8:Cross\-model comparison of G4 \(ontology\-grounded\) generation\. Judge is Claude Sonnet 4 \(T=0\.0T\{=\}0\.0\) for all models\.##### H5 \(RC advantage replicates\)\.

All three models show G4 significantly exceeding G2 on regulatory coverage: Claude \(Δ=\+15\.2\\Delta\{=\}\+15\.2pp,pc=\.0006p\_\{c\}\{=\}\.0006\), Gemma \(Δ=\+11\.2\\Delta\{=\}\+11\.2pp,pc=\.009p\_\{c\}\{=\}\.009\), and Qwen \(Δ=\+14\.4\\Delta\{=\}\+14\.4pp,pc=\.005p\_\{c\}\{=\}\.005\)\. The ontology advantage is*universal*—not an artifact of Claude’s parametric knowledge \([Figure˜2a](https://arxiv.org/html/2606.04037#S3.F2.sf1); full cross\-model figure:[Figure˜2](https://arxiv.org/html/2606.04037#S3.F2)\)\.

##### H6 \(ISS advantage replicates\)\.

G4 achieves the highest industry specificity score across all three models: Claude \(4\.77/5\.0\), Gemma \(4\.68/5\.0\), and Qwen \(4\.37/5\.0\), each with omnibusp<10−5p<10^\{\-5\}\. For Qwen, all three post\-hoc comparisons \(G4 vs\. G1, G2, G3\) are significant at Bonferroni\-correctedp<\.001p<\.001\. The ISS gap between models is smallest for G4 \(range: 0\.40 across models\) versus G1 \(range: 0\.42\), suggesting that*ontology partially compensates for model capability differences*\.

##### H7 \(Coverage\-precision tradeoff\)\.

The FDR design–execution gap is model\-dependent: Claude \+14\.7pp \(design overestimates execution\), Gemma \+2\.7pp \(near\-zero\), Qwen−\-16\.0pp \(execution outperforms design\)\. The Claude\-only coverage\-precision tradeoff is therefore*not universal*, but a model\-dependent interaction between ontological structure and the generator’s ability to translate regulatory\-coverage scenarios into fault\-triggering cases\.

##### Exploratory three\-model observation\.

Absolute G4 RC orders Claude\>\>Gemma\>\>Qwen \(48\.3\>\>40\.3\>\>30\.1%\); the G4−\-G1*uplift*reverses: Qwen \(\+12\.0pp\)\>\>Claude \(\+7\.7pp\)\>\>Gemma \(\+3\.7pp\)\. This is directionally consistent with the Inverse Parametric Knowledge Effect\[[27](https://arxiv.org/html/2606.04037#bib.bib35)\]but rests onn=3n\{=\}3non\-monotone capability points \(Gemma 26B vs Qwen 72B\) and uses in\-study G1 RC as the capability axis, which makes this capability–uplift relationship partially tautological\. We therefore flag the gradient as an exploratory observation motivating≥\\geq6\-model replication, not a confirmed finding \([Figure˜2b](https://arxiv.org/html/2606.04037#S3.F2.sf2)\)\.

![Refer to caption](https://arxiv.org/html/2606.04037v2/x2.png)\(a\)RC by condition across three models\. G4 \(ontology\) leads or ties for all models; the G4–G2 gap is the statistically\-robust effect, while G4–G1 and G4–G3 gaps are not Bonferroni\-significant\.
![Refer to caption](https://arxiv.org/html/2606.04037v2/x3.png)\(b\)G4 RC by industry×\\timesmodel\. Claude leads on absolute RC, while ontology uplift is largest for Qwen—consistent with the Inverse Parametric Knowledge Effect\.

Figure 2:Cross\-model replication of ontology advantage: \(a\) by generation condition, \(b\) by industry×\\timesgenerator model\.

## 4Analysis, Governance Implications, and Limitations

### 4\.1Ontology as Specification Language

Enterprise ontologies serve a*triple role*across the agent lifecycle:grounding\(input context that improves agent reasoning, validated in the RA\-3 companion\[[27](https://arxiv.org/html/2606.04037#bib.bib35)\]\),specification\(the test\-scenario source via[Algorithm˜1](https://arxiv.org/html/2606.04037#alg1), validated in[Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)\), andoracle\(the evaluation rubric against which the LLM judge assesses responses\)\. This extends the model\-based testing paradigm\[[47](https://arxiv.org/html/2606.04037#bib.bib42)\]—in which the model serves as specification and oracle—by adding the grounding role: a better ontology yields both better agents*and*stronger verification\.

### 4\.2Comparison with Lyzr A\-SIM

Ontology\-grounded generation differs from Lyzr’s persona\-scenario matrix along several dimensions \([Table˜9](https://arxiv.org/html/2606.04037#S4.T9)\):

Table 9:Comparison: Ontology\-Grounded vs\. Persona\-Scenario Simulation\.†\\dagger†\\daggerOntology\-Grounded column reflects the proposed architecture; the currentFAOSimplementation uses template\-based generation with manual curation, with full algorithmic generation per[Algorithm˜1](https://arxiv.org/html/2606.04037#alg1)planned\.

The distinction is not architectural but one of*unit of analysis*: persona\-scenario matrices optimize for*behavioral coverage*\(diverse interaction patterns\); ontology\-grounded generation optimizes for*regulatory coverage*\(verified compliance with the regulatory corpus\)\. The empirical results \([Section˜3\.2](https://arxiv.org/html/2606.04037#S3.SS2)\) confirm the prediction: G2 achieves comparable AC \(88% vs\. G4’s 91%,p=\.995p\{=\}\.995\) but significantly lower RC \(33\.1% vs\. 48\.3%,pc=\.0006p\_\{c\}\{=\}\.0006\)—behaviorally diverse yet regulatory\-shallow\.

### 4\.3Governance Framework Alignment

The 2025–2026 maturation of agent governance provides external validation for the design choices\. OWASP’s Top 10 for Agentic Applications\[[35](https://arxiv.org/html/2606.04037#bib.bib49)\]—goal hijacking \(ASI01\), tool misuse \(ASI02\), rogue agents \(ASI10\)—maps onto the scenario\-generation taxonomy \([Section˜2\.3](https://arxiv.org/html/2606.04037#S2.SS3)\): regulatory scenarios detect goal deviation, operational scenarios exercise tool boundaries, adversarial scenarios simulate rogue behavior\. NIST’s Agent Standards Initiative\[[34](https://arxiv.org/html/2606.04037#bib.bib50)\]calls for identity, security, and monitoring standards; the Trust Certificate \([Section˜2\.4](https://arxiv.org/html/2606.04037#S2.SS4)\) implements the monitoring pillar and the operational envelope \([Section˜2\.2](https://arxiv.org/html/2606.04037#S2.SS2)\) formalizes risk management\. The Microsoft Agent Governance Toolkit\[[29](https://arxiv.org/html/2606.04037#bib.bib51)\]enforces policy*during*execution; the present framework is its pre\-deployment complement—ontology\-grounded simulation decides*whether*to deploy, runtime governance constrains*how*—together forming defense\-in\-depth\.

### 4\.4Compositional Verification

Enterprise deployments rarely involve single agents: theFAOSplatform supports agent teams via the A2A protocol and LangGraph orchestration, raising the*compositional verification problem*—given individually certified agents𝒜1,…,𝒜n\\mathcal\{A\}\_\{1\},\\ldots,\\mathcal\{A\}\_\{n\}, what holds for their composition? Classical assume\-guarantee reasoning\[[8](https://arxiv.org/html/2606.04037#bib.bib32)\]provides a foundation \(if each𝒜i\\mathcal\{A\}\_\{i\}is verified under environment assumptionAiA\_\{i\}and⋀iΦi⟹⋀jAj\\bigwedge\_\{i\}\\Phi\_\{i\}\\implies\\bigwedge\_\{j\}A\_\{j\}, system properties hold\), but LLM agents violate its determinism premise: identical messages can yield different outputs\. Three directions emerge\. First,*probabilistic assume\-guarantee*withP​\[Φi\]≥1−δiP\[\\Phi\_\{i\}\]\\geq 1\-\\delta\_\{i\}derives system confidence from component confidence through independence or correlation bounds\. Second,*envelope intersection*composes the system envelope as⋂iℰ𝒜i\\bigcap\_\{i\}\\mathcal\{E\}\_\{\\mathcal\{A\}\_\{i\}\}\. Third,*protocol\-level verification*checks message types, sequencing, and escalation rules with A2A as a checkable contract, independent of agent internals\. Full treatment is deferred to future work\.

### 4\.5Limitations

Three limitations bound the conclusions of this work\.*First, ontology completeness:*verification coverage is bounded by ontology coverage—a regulation absent from the ontology creates a systematic blind spot, placing a continuing curation burden on enterprise adopters as a precondition for trust\.*Second, LLM\-as\-judge construct validity:*the evaluation pipeline uses Claude Sonnet 4 as both generator and fixed judge \(T=0\.0T\{=\}0\.0\), introducing potential self\-enhancement bias that cross\-generator replication alone cannot eliminate \(see[Section˜3\.2\.7](https://arxiv.org/html/2606.04037#S3.SS2.SSS7)\); a related concern is that the same author designed both the FAOS ontology and the regulatory checklist used as ground truth, making the anti\-circularity control \(E1\) a pseudo\-control rather than a fully independent check\. Deterministic evaluation, ontology\-derived binary rubrics, programmatic threshold checks, and three\-model cross\-validation partially mitigate these risks, but inter\-judge and inter\-rater triangulation remain the dominant residual concerns\.*Third, statistical confidence versus formal guarantees:*simulation provides practical assurance at verification levels V1–V3, but higher levels \(V4–V5\) may be computationally intractable for agents with large state spaces \([Section˜3\.1](https://arxiv.org/html/2606.04037#S3.SS1)\)\. The graduated verdict thresholds \(θhigh=0\.95\\theta\_\{\\text\{high\}\}\{=\}0\.95,θlow=0\.80\\theta\_\{\\text\{low\}\}\{=\}0\.80\) are illustrative engineering parameters, not yet calibrated against real\-world deployment incident rates; no agent in the pilot corpus satisfiedθhigh\\theta\_\{\\text\{high\}\}\.

These limitations chart a concrete future\-work agenda\. Inter\-rater validation of the 125\-item regulatory checklist by non\-author regulatory experts on a stratified random sample, paired with non\-Anthropic judge triangulation \(GPT\-4o or Gemini\) on the same sub\-sample and reported judge–judge agreement metrics for each dependent variable, will quantify residual self\-enhancement bias and re\-anchor effect\-size estimates accordingly\. Scaling cross\-model replication to six or more LLM families under an independent capability proxy \(MMLU score or training\-token count\) will test whether the cross\-model coverage\-precision pattern is intrinsic to the ontology approach or an artifact of the present three\-model sample; the disaggregated seen\-vs\-unseen regulatory\-coverage split, released with the v0\.2 artifact at paper acceptance, supports this scaling exercise\. Runtime verification \(V3\) and probabilistic bounded model checking \(V2\) on production\-deployed agents will move the framework from*proposed*to*delivered*attestation\. The framework also extends to multi\-agent settings \([Section˜4\.4](https://arxiv.org/html/2606.04037#S4.SS4)\) through probabilistic assume\-guarantee contracts over the A2A protocol, broadening the certification surface to agent teams\. Calibrating the verdict thresholds against actual deployment incident rates and publishing a Trust Certificate registry that links specific agent versions to their verification evidence will close the gap between the proposed framework and an operational deployment gate\. These directions shift the state of practice from reactive runtime control to systematic pre\-deployment assurance for enterprise Agentic AI;[Section˜5](https://arxiv.org/html/2606.04037#S5)synthesizes the full contribution\.

## 5Conclusions

This study proposes a pre\-deployment verification framework for enterprise AI agents, addressing the verification gap framed in[Section˜1](https://arxiv.org/html/2606.04037#S1)\. The framework combines three things: ontology\-grounded scenario generation, operational\-envelope specification, and a proposed Trust Certification model for deployment assurance in regulated environments\. The*Agent Operational Envelope*sets the scope an agent is evaluated and authorised to operate within\. The*ontology\-to\-scenario generation pipeline*\([Algorithm˜1](https://arxiv.org/html/2606.04037#alg1)\) derives regulatory, operational, and adversarial test cases\. The*machine\-verifiable Trust Certification architecture*has graduated deployment verdicts and a five\-level verification spectrum \([Section˜3\.1\.4](https://arxiv.org/html/2606.04037#S3.SS1.SSS4)\) that extends toward formal methods\.

The empirical results \([Section˜3\.2\.6](https://arxiv.org/html/2606.04037#S3.SS2.SSS6)\) show that ontology\-grounded generation improves regulatory coverage and domain specificity over persona\-based simulation\. In a controlled pilot spanning four regulated industries \(Fintech, Banking, Insurance, Healthcare\) instantiated as five industry\-by\-regulatory\-regime cells, 1,800 scenarios, 125 primary\-source regulatory requirements, and 25 injected faults, the ontology\-grounded approach \(G4\) achieved 48\.3% regulatory coverage versus 33\.1% for the dominant persona\-scenario baseline \(G2;pc=\.0006p\_\{c\}\{=\}\.0006\) and the highest industry specificity \(4\.77/5\.0;p=2×10−6p\{=\}2\{\\times\}10^\{\-6\}\), while the regulatory\-coverage advantage over the plain\-prompt baseline \(G1\) and RAG\-augmented prompting \(G3\) is not Bonferroni\-robust\. Cross\-validation across three distinct LLM families \(Claude Sonnet 4, Qwen 2\.5 72B, and Gemma 4 26B; 5,400 total scenarios\) replicated the core persona\-versus\-ontology pattern, alongside an exploratory, model\-dependent coverage\-precision observation on fault detection, suggesting that the observed gains arise from structural properties of the verification methodology rather than from a single model family\.

At the same time, the study deliberately distinguishes statistical assurance from formal guarantees\. The proposed Trust Certification framework remains conceptual at higher verification levels, ontology completeness constrains verification coverage, and the fixed LLM\-as\-judge design leaves residual self\-enhancement bias unresolved\. Four follow\-ups address these limitations: independent evaluator triangulation, broader cross\-model replication under an independent capability proxy, probabilistic verification for multi\-agent systems through assume\-guarantee contracts over the A2A protocol, and progression from simulation\-based evidence toward formally grounded deployment assurance\.

More broadly, the results suggest that enterprise AI governance may require a transition from reactive runtime control toward systematic pre\-deployment verification\. Current enterprise practice largely assumes that monitoring, guardrails, and human oversight can compensate for insufficient pre\-deployment assurance\. This work argues instead for a verification\-first paradigm in which autonomous agents are evaluated against explicit operational, regulatory, and safety constraints before deployment\. In this context, ontology\-grounded simulation represents a practical and scalable step toward enterprise\-grade trust infrastructure for Agentic AI systems\. We expectFAOSdeployments to support the full governance and conformity\-assessment requirements under Vietnam’s Law No\. 134/2025/QH15 on Artificial Intelligence\[[32](https://arxiv.org/html/2606.04037#bib.bib52)\]once the grace period for financial\-services AI closes in September 2027\. The framework already produces the artifacts that map directly to that regulatory ask: scenario\-coverage records keyed to specific regulatory clauses, fault\-detection traces from the simulation gate, and signed Trust Certificates bound to verification evidence—an audit trail that runtime\-monitoring\-only approaches must improvise post\-hoc\.

## Author Contributions

Conceptualization, T\.L\.T\. and A\.S\.; methodology, T\.L\.T\. and A\.S\.; software, T\.L\.T\.; validation, T\.L\.T\. and A\.S\.; formal analysis, T\.L\.T\.; investigation, T\.L\.T\.; resources, T\.L\.T\.; data curation, T\.L\.T\.; writing—original draft preparation, T\.L\.T\.; writing—review and editing, T\.L\.T\. and A\.S\.; visualization, T\.L\.T\.; supervision, A\.S\.; project administration, T\.L\.T\.

## Funding

This research received no external funding\.

## Data Availability Statement

The dataset comprises 5,400 generated scenarios across three generator models \(Claude Sonnet 4, Qwen 2\.5 72B, Gemma 4 26B\), each contributing 1,800 scenarios from 60 test suites \(4 conditions×\\times5 industries×\\times3 replications×\\times30 scenarios\)\. Per\-model assessments include 125 regulatory coverage evaluations per condition, 25 fault injection results, and 150 industry specificity scores per condition—all judged by a fixed Claude Sonnet 4 evaluator \(T=0\.0T\{=\}0\.0\)\. Analysis scripts, ontology context files, regulatory checklists, fault definitions, aggregated result summaries, and cross\-model analysis code are publicly available at the FAOS Research repository\[[25](https://arxiv.org/html/2606.04037#bib.bib57)\]\. Raw generated\-scenario transcripts and judge\-level logs are archived at Zenodo\[[26](https://arxiv.org/html/2606.04037#bib.bib58)\]\(DOI: 10\.5281/zenodo\.20484582\) and will be released there upon publication\.

## Acknowledgments

The authors thank the FAOS team for platform access and ontology content used in the empirical evaluation\.

## Conflicts of Interest

Author T\.L\.T\. is the founder of FAOSX\.AI, which develops the FAOS platform whose verification framework is evaluated in this study\. This relationship had no role in the study design; in the collection, analysis, or interpretation of data; or in the decision to publish; and all results, including non\-significant comparisons, are reported in full\. Author A\.S\. declares no conflict of interest\.

## References

- \[1\]D\. Amodei, C\. Olah, J\. Steinhardt, P\. Christiano, J\. Schulman, and D\. Mané\(2016\)Concrete problems in AI safety\.arXiv preprint arXiv:1606\.06565\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1),[§1](https://arxiv.org/html/2606.04037#S1.p2.1)\.
- \[2\]M\. Andriushchenko, A\. Souly, M\. Dziemian, D\. Duenas, M\. Lin, J\. Wang, D\. Hendrycks, A\. Zou, Z\. Kolter, M\. Fredrikson, E\. Winsor, J\. Wynne, Y\. Gal, and X\. Davies\(2025\)AgentHarm: a benchmark for measuring harmfulness of LLM agents\.InInternational Conference on Learning Representations \(ICLR\),Note:110 malicious tasks, 11 harm categoriesCited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[3\]Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon,et al\.\(2022\)Constitutional AI: harmlessness from AI feedback\.arXiv preprint arXiv:2212\.08073\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1),[§1](https://arxiv.org/html/2606.04037#S1.p2.1)\.
- \[4\]E\. Bartocci, Y\. Falcone, A\. Francalanza, and G\. Reger\(2018\)Introduction to runtime verification\.InLectures on Runtime Verification,pp\. 1–33\.External Links:[Document](https://dx.doi.org/10.1007/978-3-319-75632-5%5F1)Cited by:[§3\.1\.3](https://arxiv.org/html/2606.04037#S3.SS1.SSS3.p1.1)\.
- \[5\]A\. Biere, A\. Cimatti, E\. M\. Clarke, O\. Strichman, and Y\. Zhu\(2003\)Bounded model checking\.Advances in Computers58,pp\. 117–148\.External Links:[Document](https://dx.doi.org/10.1016/S0065-2458%2803%2958003-2)Cited by:[§3\.1\.2](https://arxiv.org/html/2606.04037#S3.SS1.SSS2.p1.3)\.
- \[6\]A\. Chan, C\. Ezell, M\. Kaufmann, K\. Wei, L\. Hammond, H\. Bradley, E\. Bluemke, N\. Rajkumar, D\. Krueger, N\. Kolt, L\. Heim, and M\. Anderljung\(2024\)Visibility into AI agents\.arXiv preprint arXiv:2401\.13138\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1)\.
- \[7\]P\. F\. Christiano, J\. Leike, T\. Brown, M\. Martic, S\. Legg, and D\. Amodei\(2017\)Deep reinforcement learning from human preferences\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.30,pp\. 4299–4307\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1),[§1](https://arxiv.org/html/2606.04037#S1.p2.1)\.
- \[8\]E\. M\. Clarke, T\. A\. Henzinger, H\. Veith, and R\. Bloem\(2018\)Handbook of model checking\.Springer\.External Links:ISBN 978\-3\-319\-10574\-1,[Document](https://dx.doi.org/10.1007/978-3-319-10575-8)Cited by:[§4\.4](https://arxiv.org/html/2606.04037#S4.SS4.p1.6)\.
- \[9\]D\. Dalrymple, J\. Skalse, Y\. Bengio, S\. Russell, M\. Tegmark, S\. Seshia, S\. Omohundro, C\. Szegedy, B\. Goldhaber, N\. Ammann,et al\.\(2024\)Towards guaranteed safe AI: a framework for ensuring robust and reliable AI systems\.arXiv preprint arXiv:2405\.06624\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p2.1)\.
- \[10\]N\. C\. Debnath, A\. Sanyal, A\. Sarkar, S\. Choudhury, and W\. D\. Bae\(2011\)Graph–semantic based web data model: conceptual design to logical representation\.Journal of Computational Methods in Sciences and Engineering \(JCMSE\)11,pp\. 77–88\.External Links:[Document](https://dx.doi.org/10.3233/JCM-2011-0379)Cited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p2.1)\.
- \[11\]European Parliament and Council\(2024\)Regulation \(EU\) 2024/1689 — artificial intelligence act\.Note:Official Journal of the European Union, L seriesEntered into force August 1, 2024Cited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1)\.
- \[12\]Government of Vietnam\(2025\)Nghı̣ ḍı̣nh 94/2025/nđ\-cp \[decree on regulatory sandbox in the banking sector\]\.Note:Effective July 1, 2025First comprehensive fintech sandbox regulation; structured framework for AI\-enabled financial servicesCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p2.1)\.
- \[13\]J\. Gu, X\. Jiang, Z\. Shi, H\. Tan, X\. Zhai, C\. Xu, W\. Li, Y\. Shen, S\. Ma, H\. Liu,et al\.\(2024\)A survey on LLM\-as\-a\-judge\.arXiv preprint arXiv:2411\.15594\.Note:Comprehensive survey on reliability, bias, and domain\-specific evaluationCited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p1.1)\.
- \[14\]A\. Hogan, E\. Blomqvist, M\. Cochez, C\. d’Amato, G\. de Melo, C\. Gutierrez, S\. Kirrane, J\. E\. L\. Gayo, R\. Navigli, S\. Neumaier,et al\.\(2021\)Knowledge graphs\.ACM Computing Surveys54\(4\),pp\. 1–37\.External Links:[Document](https://dx.doi.org/10.1145/3447772)Cited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p2.1)\.
- \[15\]X\. Huang, D\. Kroening, W\. Ruan, J\. Sharp, Y\. Sun, E\. Thesing, M\. Wu, and X\. Yi\(2020\)A survey of safety and trustworthiness of deep neural networks: formal verification, testing, adversarial attack and defence, and interpretability\.Computer Science Review37,pp\. 100270\.External Links:[Document](https://dx.doi.org/10.1016/j.cosrev.2020.100270)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p2.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[16\]Infocomm Media Development Authority\(2020\)Model AI governance framework\.Technical reportIMDA, Singapore\.Note:Developed with PDPCCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1)\.
- \[17\]International Electrotechnical Commission\(2015\)IEC 62304:2006\+amd1:2015 — medical device software — software life cycle processes\.Note:International StandardCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p3.1),[§1](https://arxiv.org/html/2606.04037#S1.p2.1)\.
- \[18\]International Organization for Standardization\(2018\)ISO 26262:2018 — road vehicles — functional safety\.Note:International StandardCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p3.1),[§1](https://arxiv.org/html/2606.04037#S1.p2.1)\.
- \[19\]International Organization for Standardization\(2023\)ISO/IEC 42001:2023 — artificial intelligence — management system\.Note:International StandardCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1)\.
- \[20\]G\. Katz, C\. Barrett, D\. L\. Dill, K\. Julian, and M\. J\. Kochenderfer\(2017\)Reluplex: an efficient SMT solver for verifying deep neural networks\.InInternational Conference on Computer Aided Verification \(CAV\),pp\. 97–117\.External Links:[Document](https://dx.doi.org/10.1007/978-3-319-63387-9%5F5)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p2.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[21\]M\. Kwiatkowska, G\. Norman, and D\. Parker\(2011\)PRISM 4\.0: verification of probabilistic real\-time systems\.Proceedings of CAV,pp\. 585–591\.External Links:[Document](https://dx.doi.org/10.1007/978-3-642-22110-1%5F47)Cited by:[§3\.1\.2](https://arxiv.org/html/2606.04037#S3.SS1.SSS2.p1.3)\.
- \[22\]X\. Liu, H\. Yu, H\. Zhang, Y\. Xu, X\. Lei, H\. Lai, Y\. Gu, H\. Ding, K\. Men, K\. Yang,et al\.\(2023\)AgentBench: evaluating LLMs as agents\.arXiv preprint arXiv:2308\.03688\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[23\]A\. Lomuscio, H\. Qu, and F\. Raimondi\(2017\)MCMAS: an open\-source model checker for the verification of multi\-agent systems\.International Journal on Software Tools for Technology Transfer19\(1\),pp\. 9–30\.External Links:[Document](https://dx.doi.org/10.1007/s10009-015-0378-x)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p2.1)\.
- \[24\]H\. Luo, S\. Dai, C\. Ni, X\. Li, G\. Zhang, K\. Wang, T\. Liu, and H\. Salam\(2025\)AgentAuditor: human\-level safety and security evaluation for LLM agents\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Note:ASSEBench: 2,293 records, 15 risk types, 29 scenariosCited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p1.1)\.
- \[25\]T\. T\. Luong and A\. Sanyal\(2026\)FAOS research: code, data, and ontologies for ontology\-grounded enterprise agent verification\.Note:[https://github\.com/frank\-luongt/faos\-research/tree/main/RA\-6](https://github.com/frank-luongt/faos-research/tree/main/RA-6)GitHub repository\. Analysis scripts, ontology context files, regulatory checklists, fault definitions, and cross\-model analysis code\. Raw scenario data and judge evaluation logs released upon acceptance\.Cited by:[§3\.2\.4](https://arxiv.org/html/2606.04037#S3.SS2.SSS4.p1.2),[Data Availability Statement](https://arxiv.org/html/2606.04037#Sx3.p1.4)\.
- \[26\]T\. T\. Luong and A\. Sanyal\(2026\)RA\-6: ontology\-grounded pre\-deployment verification of enterprise AI agents — pilot data and judge logs\.Zenodo\.Note:[https://doi\.org/10\.5281/zenodo\.20484582](https://doi.org/10.5281/zenodo.20484582)Dataset \(version v0\.2\)External Links:[Document](https://dx.doi.org/10.5281/zenodo.20484582)Cited by:[Data Availability Statement](https://arxiv.org/html/2606.04037#Sx3.p1.4)\.
- \[27\]T\. T\. Luong\(2026\)Ontology\-constrained neural reasoning in enterprise agentic systems: a neurosymbolic architecture for domain\-grounded ai agents\.arXiv preprint arXiv:2604\.00555\.Note:600 runs across 5 industries; Inverse PKE findingCited by:[§2\.5](https://arxiv.org/html/2606.04037#S2.SS5.p1.1),[§3\.2\.7](https://arxiv.org/html/2606.04037#S3.SS2.SSS7.Px4.p1.9),[§3\.2](https://arxiv.org/html/2606.04037#S3.SS2.p1.1),[§4\.1](https://arxiv.org/html/2606.04037#S4.SS1.p1.1)\.
- \[28\]Lyzr AI\(2026\)Agent simulation engine \(A\-SIM\): enterprise agent hardening at scale\.Note:Technical documentation,[https://www\.lyzr\.ai](https://www.lyzr.ai/)Accessed March 2026Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1),[§3\.2\.1](https://arxiv.org/html/2606.04037#S3.SS2.SSS1.p1.4)\.
- \[29\]Microsoft\(2026\)Agent governance toolkit: open\-source runtime security for AI agents\.Note:GitHub, MIT LicenseAddresses all 10 OWASP agentic risks; policy engine, execution sandboxing, compliance gradingCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1),[§4\.3](https://arxiv.org/html/2606.04037#S4.SS3.p1.1)\.
- \[30\]Ministry of Finance of Vietnam\(2024\)Circular 06/2024/tt\-btc on risk management in insurance business activity\.Note:Issued February 16, 2024; effective April 1, 2024Risk\-management framework for insurance and reinsurance undertakings; Article 18 covers capital adequacy and solvency margin requirements; supersedes provisions of Circular 50/2017/TT\-BTCCited by:[§3\.2\.6](https://arxiv.org/html/2606.04037#S3.SS2.SSS6.p6.2)\.
- \[31\]National Assembly of Vietnam\(2022\)Luạt phòng, chóng rụa tiên \[law on prevention and combat of money laundering\], law no\. 14/2022/qh15\.Note:Passed November 15, 2022; effective March 1, 2023Supersedes Law 07/2012/QH13; mandates risk\-based customer due diligence and beneficial\-ownership identification for credit institutions; aligned with FATF Recommendations 10 and 24Cited by:[§1](https://arxiv.org/html/2606.04037#S1.p4.1)\.
- \[32\]National Assembly of Vietnam\(2025\)Luạt trí tuẹ nhân tạo \[law on artificial intelligence\], law no\. 134/2025/qh15\.Note:Passed December 10, 2025; effective March 1, 2026Three\-tier risk classification \(low/medium/high\); 18\-month grace period for finance, healthcare, educationCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p2.1),[§5](https://arxiv.org/html/2606.04037#S5.p4.1)\.
- \[33\]National Institute of Standards and Technology\(2023\)Artificial intelligence risk management framework \(AI RMF 1\.0\)\.Technical reportTechnical ReportNIST AI 100\-1,U\.S\. Department of Commerce\.External Links:[Document](https://dx.doi.org/10.6028/NIST.AI.100-1)Cited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1)\.
- \[34\]National Institute of Standards and Technology\(2026\)AI agent standards initiative\.Technical reportNIST Center for AI Standards and Innovation \(CAISI\)\.Note:Announced February 2026; identity, security, interoperability for autonomous AI agentsCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1),[§4\.3](https://arxiv.org/html/2606.04037#S4.SS3.p1.1)\.
- \[35\]OWASP Foundation\(2025\)OWASP top 10 for agentic applications for 2026\.Technical reportOWASP Gen AI Security Project\.Note:First formal risk taxonomy for autonomous AI agents; T01–T17 threat model, 100\+ contributorsCited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p1.1),[§4\.3](https://arxiv.org/html/2606.04037#S4.SS3.p1.1)\.
- \[36\]S\. Pan, L\. Luo, Y\. Wang, C\. Chen, J\. Wang, and X\. Wu\(2024\)Unifying large language models and knowledge graphs: a roadmap\.IEEE Transactions on Knowledge and Data Engineering36,pp\. 3580–3599\.External Links:[Document](https://dx.doi.org/10.1109/TKDE.2024.3352100)Cited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p2.1)\.
- \[37\]J\. S\. Park, J\. C\. O’Brien, C\. J\. Cai, M\. R\. Morris, P\. Liang, and M\. S\. Bernstein\(2023\)Generative agents: interactive simulacra of human behavior\.InProceedings of the 36th Annual ACM Symposium on User Interface Software and Technology \(UIST\),External Links:[Document](https://dx.doi.org/10.1145/3586183.3606763)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1)\.
- \[38\]E\. Perez, S\. Huang, F\. Song, T\. Cai, R\. Ring, J\. Aslanides, A\. Glaese, N\. McAleese, and G\. Irving\(2022\)Red teaming language models with language models\.arXiv preprint arXiv:2202\.03286\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1)\.
- \[39\]A\. Pnueli\(1977\)The temporal logic of programs\.In18th Annual Symposium on Foundations of Computer Science \(FOCS\),pp\. 46–57\.External Links:[Document](https://dx.doi.org/10.1109/SFCS.1977.32)Cited by:[§3\.1\.1](https://arxiv.org/html/2606.04037#S3.SS1.SSS1.p1.3)\.
- \[40\]L\. Rierson\(2017\)Developing safety\-critical software: a practical guide for aviation software and DO\-178C compliance\.CRC Press\.External Links:ISBN 978\-1\-4398\-1368\-3Cited by:[§1\.1\.3](https://arxiv.org/html/2606.04037#S1.SS1.SSS3.p3.1),[§1](https://arxiv.org/html/2606.04037#S1.p2.1)\.
- \[41\]Y\. Ruan, H\. Dong, A\. Wang, S\. Pitis, Y\. Zhou, J\. Ba, Y\. Dubois, C\. J\. Maddison, and T\. Hashimoto\(2024\)Identifying the risks of LM agents with an LM\-emulated sandbox\.arXiv preprint arXiv:2309\.15817\.Note:ICLR 2024Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1)\.
- \[42\]A\. Sanyal, A\. Sarkar, S\. Choudhury, and P\. K\. G\. Thakurta\(2010\)Automating web data model: conceptual design to logical representation\.InProceedings of the ISCA 19th International Conference on Software Engineering and Data Engineering \(SEDE\),pp\. 179–184\.Cited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p2.1)\.
- \[43\]S\. Shankar, J\.D\. Zamfirescu\-Pereira, B\. Hartmann, A\. G\. Parameswaran, and I\. Arawjo\(2024\)Who validates the validators? Aligning LLM\-assisted evaluation of LLM outputs with human preferences\.arXiv preprint arXiv:2404\.12272\.Cited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p1.1)\.
- \[44\]N\. Shinn, F\. Cassano, A\. Gopinath, K\. Narasimhan, and S\. Yao\(2023\)Reflexion: language agents with verbal reinforcement learning\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.36\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1)\.
- \[45\]G\. Singh, T\. Gehr, M\. Püschel, and M\. Vechev\(2019\)An abstract domain for certifying neural networks\.InProceedings of the ACM on Programming Languages \(POPL\),Vol\.3,pp\. 1–30\.External Links:[Document](https://dx.doi.org/10.1145/3290354)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p2.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[46\]H\. Tran, X\. Yang, D\. M\. Lopez, P\. Musau, L\. V\. Nguyen, W\. Xiang, S\. Bak, and T\. T\. Johnson\(2020\)NNV: the neural network verification tool for deep neural networks and learning\-enabled cyber\-physical systems\.InInternational Conference on Computer Aided Verification \(CAV\),pp\. 3–17\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p2.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[47\]M\. Utting, A\. Pretschner, and B\. Legeard\(2012\)A taxonomy of model\-based testing approaches\.Software Testing, Verification and Reliability22\(5\),pp\. 297–312\.External Links:[Document](https://dx.doi.org/10.1002/stvr.456)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1),[§4\.1](https://arxiv.org/html/2606.04037#S4.SS1.p1.1)\.
- \[48\]L\. Wang, C\. Ma, X\. Feng, Z\. Zhang, H\. Yang, J\. Zhang, Z\. Chen, J\. Tang, X\. Chen, Y\. Lin,et al\.\(2024\)A survey on large language model based autonomous agents\.Frontiers of Computer Science18\(6\),pp\. 186345\.External Links:[Document](https://dx.doi.org/10.1007/s11704-024-40231-1)Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1)\.
- \[49\]L\. Weidinger, J\. Uesato, M\. Rauh, C\. Griffin, P\. Huang, J\. Mellor, A\. Glaese, M\. Cheng, B\. Balle, A\. Kasirzadeh,et al\.\(2023\)Sociotechnical safety evaluation of generative AI systems\.arXiv preprint arXiv:2310\.11986\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1)\.
- \[50\]Z\. Xi, W\. Chen, X\. Guo, W\. He, Y\. Ding, B\. Hong, M\. Zhang, J\. Wang, S\. Jin, E\. Zhou,et al\.\(2023\)The rise and potential of large language model based agents: a survey\.arXiv preprint arXiv:2309\.07864\.Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1)\.
- \[51\]S\. Yin, X\. Pang, Y\. Ding, M\. Chen, Y\. Bi, Y\. Xiong, W\. Huang, Z\. Xiang, J\. Shao, and S\. Chen\(2025\)SafeAgentBench: a benchmark for safe task planning of embodied LLM agents\.arXiv preprint arXiv:2412\.13178\.Note:750 tasks, 10 hazard types, embodied environmentsCited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[52\]R\. You, H\. Cai, C\. Zhang, Q\. Xu, M\. Liu, T\. Yu, Y\. Li, and W\. Li\(2026\)A survey on agent\-as\-a\-judge\.arXiv preprint arXiv:2601\.05111\.Note:Survey: planning, tool\-augmented verification, multi\-agent collaboration for evaluationCited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p1.1)\.
- \[53\]T\. Yuan, Z\. He, L\. Dong, Y\. Wang, R\. Zhao, T\. Xia, L\. Xu, B\. Zhou, F\. Li, Z\. Zhang,et al\.\(2024\)R\-Judge: benchmarking safety risk awareness for LLM agents\.arXiv preprint arXiv:2401\.10019\.Note:EMNLP 2024Cited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p3.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[54\]Z\. Zhang, S\. Cui, Y\. Lu, J\. Zhou, J\. Yang, H\. Wang, and M\. Huang\(2025\)Agent\-SafetyBench: evaluating the safety of LLM agents\.arXiv preprint arXiv:2412\.14470\.Note:349 environments, 2,000 test cases, 8 risk categoriesCited by:[§1\.1\.1](https://arxiv.org/html/2606.04037#S1.SS1.SSS1.p1.1),[§1\.2](https://arxiv.org/html/2606.04037#S1.SS2.p1.1)\.
- \[55\]L\. Zheng, W\. Chiang, Y\. Sheng, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Lin, Z\. Li, D\. Li, E\. P\. Xing, H\. Zhang, J\. E\. Gonzalez, and I\. Stoica\(2023\)Judging LLM\-as\-a\-judge with MT\-Bench and Chatbot Arena\.Advances in Neural Information Processing Systems \(NeurIPS\)36\.Cited by:[§1\.1\.2](https://arxiv.org/html/2606.04037#S1.SS1.SSS2.p1.1),[§2\.5\.2](https://arxiv.org/html/2606.04037#S2.SS5.SSS2.p5.1)\.