From Agent Failure Paths to Quantified Residual Risk: A Compositional Framework for Resilient Agentic AI

# From Agent Failure Paths to Quantified Residual Risk: A Compositional Framework for Resilient Agentic AI
Source: [https://arxiv.org/html/2607.18243](https://arxiv.org/html/2607.18243)
###### Abstract

Agentic AI is crossing trust boundaries faster than current risk models can represent\. Existing approaches provide one of two partial views\. They either describe failure mechanisms without producing a transferable residual\-risk estimate, or they produce a risk estimate while treating the internal failure path as a black box\. We couple those two views by proposingCPSAINT, a seven\-layer integrity decomposition over Physical state, Sensors, Data, Compute, Actuators, Environment, and Time, paired withFRIESA\-K, a residual\-risk functional that maps each failure path to a quantified risk instance\.FRIESA\-Kgrounds the resistance termKKin a controlled absorbing Markov model so that control effectiveness is derived from state dynamics rather than assigned as an informal score\. The result is a concise mechanism\-to\-magnitude pipeline for resilient agentic and embodied AI\. We report governance observability through a separate additive penalty instead of inserting governance as a new variable in the resistance functional\. We formalize structural composability linking valid failure paths to well\-defined risk instances and show the framework on two contrasting scenarios: a hard real\-time warehouse robot and a governance\-instrumented financial\-services agent\. Across both cases, the same layer grammar, variable semantics, and dynamic\-resistance construction remain intact\. Thus, we obtain a compact kernel that supports cross\-domain reasoning, explicit assumptions, and quantitatively grounded formalism of composable trust\.

## IIntroduction

Agentic AI, software that autonomously pursues multi\-step goals through planning, tool use, and environmental interaction, is moving rapidly from prototype to production\. Gartner projects that by 2028, at least 15% of day\-to\-day work decisions will be made autonomously by such systems, up from essentially zero in 2024, and that 33% of enterprise applications will embed agentic capabilities over the same period\[[9](https://arxiv.org/html/2607.18243#bib.bib1)\]\.

Unlike chat\-bots that merely respond to a single prompt, an agentic system decomposes objectives, sequences actions across multiple decision cycles, and modifies external state \(records, workflows, physical actuators\) with little or no human approval per step\.

Agentic AI is already operating across trust boundaries that static risk scores do not capture\[[7](https://arxiv.org/html/2607.18243#bib.bib2)\]\. A planning agent, for example, may call tools, update records, trigger workflows, or influence actuation\. A robotic controller may fuse sensor data, invoke learned models, and issue time\-critical commands\. In both settings, the failure is path\-dependent\. Integrity does not fail once\. It fails across layers, interfaces, and deadlines\.

![Refer to caption](https://arxiv.org/html/2607.18243v1/x1.png)Figure 1:ComparativeCPSAINTseven\-layer grammar for structural decomposition across warehouse robotics and banking agentic workflows\. Initiating compromise begins near orchestration, data, or tooling logic, crosses explicit fault boundaries, and propagates toward either physical actuation or governance\-sensitive workflow degradation\. Layer numbering corresponds to the formal symbol set given in Section[IV](https://arxiv.org/html/2607.18243#S4)\.Current methods split the problem\. Structural methods such as STAMP\[[16](https://arxiv.org/html/2607.18243#bib.bib3)\]and STPA\[[8](https://arxiv.org/html/2607.18243#bib.bib4)\]and related safety\-security analyses provide causal pathways, unsafe control scenarios, and constraint violations, but they stop before a transferable residual\-risk estimate\. Quantitative approaches such as adversarial risk analysis, Conditional Value at Risk \(CVaR\) reporting\[[18](https://arxiv.org/html/2607.18243#bib.bib12)\], and rare\-event simulation provide estimators and tail summaries, but they usually treat the system between threat and loss as a black box\[[17](https://arxiv.org/html/2607.18243#bib.bib10)\]\. Recent agent\-security and runtime\-assurance methods strengthen privilege boundaries, constrain tool use, or verify local behaviors, yet they do not provide a compact, domain\-transferable mapping from failure path to residual risk\.

No existing framework simultaneously answers both questions:through what mechanism does integrity fail?andhow much residual risk results?The closest work either provides structural causality without a transferable risk estimate, or a risk estimate without structural grounding\. These ensure that neither is suitable for the cross\-domain, path\-dependent failure modes that agentic and cyber\-physical systems exhibit\.

In this paper, we address this gap by coupling mechanism and magnitude\. We useCPSAINT\(Fig\.[1](https://arxiv.org/html/2607.18243#S1.F1)\) to answer a structural question: through what mechanism does integrity fail? We useFRIESA\-Kto answer the question of how much residual risk results, quantitatively? We then derive the resistance termK​\(π,τ,u\)K\(\\pi,\\tau,u\)from controlled absorbing dynamics so that control effectiveness reflects measurable change in catastrophe probability by horizon, not an arbitrary expert score\. We use theFRIESA\-Ksemantics, herein, and report governance\-observability degradation through a separate additive term rather than redefining the base equation\.

The main contributions of this paper are as follows:

- •First, we defineCPSAINTas a seven\-layer structural decomposition with explicit path semantics\.
- •Second, we defineFRIESA\-Kwith locked variable boundaries and dynamic construction forK​\(π,τ,u\)K\(\\pi,\\tau,u\)\.
- •Third, we state a composition theorem showing that a validCPSAINTpath induces a well\-definedFRIESA\-Krisk instance without changing the functional form\.
- •Fourth, we demonstrate the framework on two materially different use cases: a real\-time warehouse robot and a banking/financial\-services agent\.

The remainder of this paper is organized as follows\. Section[II](https://arxiv.org/html/2607.18243#S2)compresses the relevant literature\. Section[III](https://arxiv.org/html/2607.18243#S3)defines the system model, notation, and threat boundary\. Section[IV](https://arxiv.org/html/2607.18243#S4)presents the proposed method:CPSAINT,FRIESA\-K, the dynamic\-resistance construction, and the composition theorem\. Section[V](https://arxiv.org/html/2607.18243#S5)evaluates the framework analytically on two scenarios and reports the resulting sensitivity behavior\. Sections[VI](https://arxiv.org/html/2607.18243#S6)and[VII](https://arxiv.org/html/2607.18243#S7)provide limitations and conclusions\.

## IIRelated Works

This work builds on three bodies of work: structural decomposition of failure causes, quantitative adversarial risk estimation, runtime assurance, security, and governance for AI and embodied AI agents\.

The closest prior work falls into three families\. Structural safety\-security methods such as STAMP/STPA\[[16](https://arxiv.org/html/2607.18243#bib.bib3)\], STPA\-SafeSec\[[8](https://arxiv.org/html/2607.18243#bib.bib4)\], and attack\-defense trees\[[15](https://arxiv.org/html/2607.18243#bib.bib5)\]provide causal pathways, attacker\-defender logic, and unsafe\-control reasoning, but they do not map decomposed failure paths into a stable residual\-risk model\.

Modular agent frameworks such as DSPy\[[14](https://arxiv.org/html/2607.18243#bib.bib6)\], AutoGen\[[22](https://arxiv.org/html/2607.18243#bib.bib7)\], and MetaGPT\[[10](https://arxiv.org/html/2607.18243#bib.bib8)\]show that composition matters operationally, but they do not explicitly deal with fault boundaries, propagation semantics, and residual\-risk accounting\. Empirical taxonomies such as MAST catalog failure patterns in multi\-agent traces, but they do not supply a mechanism\-to\-magnitude calculus\[[5](https://arxiv.org/html/2607.18243#bib.bib9)\]\.

Quantitative risk and tail\-estimation methods provide the other half of the puzzle\. Adversarial Risk Analysis\[[17](https://arxiv.org/html/2607.18243#bib.bib10)\]contributes a rigorous decision\-theoretic treatment of intentional threats\. Coherent\-risk theory, CVaR,\[[1](https://arxiv.org/html/2607.18243#bib.bib11),[18](https://arxiv.org/html/2607.18243#bib.bib12)\], subset simulation\[[2](https://arxiv.org/html/2607.18243#bib.bib13)\], and related rare\-event methods provide the mathematical basis for conservative tail reporting and small\-probability estimation\. Cascading\-failure models show how small perturbations can propagate into systemic loss\[[4](https://arxiv.org/html/2607.18243#bib.bib14)\]\. However, these lines of work mostly begin after the internal structural pathway has already been abstracted away making it difficult to leverage those models for the granular risk modeling needed for real\-time agentic systems\.

Runtime\-assurance and security\-containment work narrows behavior but typically at the level of a single agent or a single tool boundary\. AgentSpec\[[21](https://arxiv.org/html/2607.18243#bib.bib17)\], Pro2Guard\[[20](https://arxiv.org/html/2607.18243#bib.bib18)\], CaMeL\[[6](https://arxiv.org/html/2607.18243#bib.bib19)\], IsolateGPT\[[23](https://arxiv.org/html/2607.18243#bib.bib20)\], and Progent\[[19](https://arxiv.org/html/2607.18243#bib.bib21)\]all illustrate some type of constraint enforcement, probabilistic model checking, capability isolation, or privilege control\. However, they do not propagate residual risk, thus losing risk fidelity across a composed agentic path with fixed semantics\. Dependable\-AI work makes the final point\. Assurance 2\.0\[[3](https://arxiv.org/html/2607.18243#bib.bib24)\], guaranteed\-safe AI, and recent topology\-resilience studies argue that architecture and explicit assumptions determine resilience\[[11](https://arxiv.org/html/2607.18243#bib.bib25)\], but they do not give a cross\-domain residual\-risk functional grounded in structural failure paths\. Prior work\[[13](https://arxiv.org/html/2607.18243#bib.bib16)\]operationalizes NIST AI RMF governance functions at the workload level for LLM\-integrated robotic systems, and in doing so, provides the empirical basis forFRIESA\-K’s treatment of governance observability as a modeled state dimension rather than an external policy overlay\. We target that intersection\. To our knowledge, no existing approach jointly fixes the failure grammar, the risk semantics, and the dynamic control interpretation in a single framework\.

## IIISystem and Threat Model

TABLE I:Core notationWe model an agentic or cyber\-physical system as a labeled directed graph

GCPS=\(ℒ,Φ,ℳ,Π\),G\_\{\\mathrm\{CPS\}\}=\(\\mathcal\{L\},\\Phi,\\mathcal\{M\},\\Pi\),\(1\)whereℒ=\{P,S,D,C,A,E,T\}\\mathcal\{L\}=\\\{P,S,D,C,A,E,T\\\}is the fixedCPSAINTlayer set,Φ⊆ℒ×ℒ\\Phi\\subseteq\\mathcal\{L\}\\times\\mathcal\{L\}is the valid propagation relation,ℳ=\{c​o​r​r​u​p​t​i​o​n,d​e​l​a​y,o​m​i​s​s​i​o​n,r​e​p​l​a​y,c​o​u​p​l​i​n​g​\_​a​b​u​s​e\}\\mathcal\{M\}=\\\{corruption,delay,omission,replay,coupling\\\_abuse\\\}is the failure\-mode alphabet, andΠ\\Piis the set of valid failure paths admitted by the instantiated architecture\. The graph is domain\-agnostic\. Domain transfer occurs through instantiation of nodes, edges, and path content, not by changing the layer grammar itself\.

We assume an adversary that seeks to induce integrity loss along one or more valid paths\. Entry may occur through sensing, data ingestion, compute logic, tool execution, timing manipulation, or environmental coupling\. Defender actions are encoded by a control policyu∈𝒞u\\in\\mathcal\{C\}\. The evaluation horizonτ\\tauis finite and domain\-dependent\. For hard real\-time systems it may be milliseconds or seconds\. For enterprise agents it may be minutes or longer\. A singleτ\\taumay also represent a narrow operational analysis window within a domain whose full governance or audit lifecycle spans much longer intervals; the banking\-agent instantiation in Section[V\-B](https://arxiv.org/html/2607.18243#S5.SS2)usesτ=0\.75\\tau=0\.75s as a short\-window operational slice, not as a model of the full assurance horizon\.

Table[I](https://arxiv.org/html/2607.18243#S3.T1)summarizes the core notation used throughout the paper\.

## IVProposed Method

### IV\-ACPSAINT: Structural Failure Decomposition

We defineCPSAINTover the ordered layer tuple in Eq\. \([2](https://arxiv.org/html/2607.18243#S4.E2)\):

Σ=⟨P,S,D,C,A,E,T⟩,\\Sigma=\\langle P,S,D,C,A,E,T\\rangle,\(2\)wherePPdenotes physical plant or mission\-relevant hardware state,SSsensing and signal acquisition,DDdata/information representation and model inputs,CCcompute and decision logic,AAactuation or side\-effectful execution,EEexternal environment or counterparty context, andTTtiming and synchronization\. Each layer may exhibit one of five integrity\-failure modes: corruption, delay, omission, replay, or coupling abuse\.

###### Definition 1\(Agent failure path\)\.

A valid agent failure path is an ordered sequence \(Eq\.[3](https://arxiv.org/html/2607.18243#S4.E3)\)

π=\[\(ℓ1,m1\),\(ℓ2,m2\),…,\(ℓn,mn\)\]\\pi=\[\(\\ell\_\{1\},m\_\{1\}\),\(\\ell\_\{2\},m\_\{2\}\),\\ldots,\(\\ell\_\{n\},m\_\{n\}\)\]\(3\)such that eachℓi∈ℒ\\ell\_\{i\}\\in\\mathcal\{L\}, eachmi∈ℳm\_\{i\}\\in\\mathcal\{M\}, and each successive pair respects the propagation relationΦ\\Phiof the instantiated system\.

The purpose of this construction, illustrated in Figure[1](https://arxiv.org/html/2607.18243#S1.F1), is to establish a stable grammar for integrity propagation\. In this way, a warehouse robot, a medical workflow agent, and a banking assistant can be expressed with the same layer set while preserving domain\-specific path content\.

Figure[1](https://arxiv.org/html/2607.18243#S1.F1)renders the layer set as an operational stack to show how failure propagates across architectural boundaries in each domain instantiation\. The formal layer symbols map to the figure as follows\. Layers 1–2 \(Mission and Intent; Human and Governance Oversight\) instantiateEE, the external environment and counterparty context, which encompasses operator intent, governance principals, and regulatory constraints\. Layer 3 \(Agent Orchestration and Planning\) and Layer 4 \(Application and Tooling Logic\) both instantiateCC, compute and decision logic, at different abstraction levels within the same domain\. Layer 5 \(Data and State Management\) instantiatesDD\. Layer 6 \(Communication and Platform Services\) instantiatesSS, sensing and signal acquisition, which in software\-intensive agents includes API endpoints, message buses, and data ingestion interfaces\. Layer 7 \(Physical Process and Actuation\) jointly instantiatesPP\(physical plant\) andAA\(actuation or side\-effectful execution\)\.TT\(timing and synchronization\) is a cross\-cutting property: it governs the temporal constraints at each layer rather than occupying a dedicated architectural slot, consistent with the design principle that network delay maps toTTand data routing integrity maps toDD\.

### IV\-BFRIESA\-K: Residual\-Risk

FRIESA\-Kis defined in Equation \([4](https://arxiv.org/html/2607.18243#S4.E4)\):

ℛ​\(π,τ,u\)=F​\(π\)​Ri​\(π\)​E​\(π\)​S​\(π\)​A​\(π\)K​\(π,τ,u\),\\mathcal\{R\}\(\\pi,\\tau,u\)=\\frac\{F\(\\pi\)\\,R\_\{i\}\(\\pi\)\\,E\(\\pi\)\\,S\(\\pi\)\\,A\(\\pi\)\}\{K\(\\pi,\\tau,u\)\},\(4\)
where,FFdenotes the frequency of the threat\. Reachability is given byRiR\_\{i\}and exploitability is expressed inEE\. The severity of the threat is captured withSS\. We captured the potential a threat being amplified withAA\. Many models fail to capture control effectiveness\. We use controlKKto capture the resistance effectiveness of a control\. If a factor makes attacks more likely or consequences more severe, it belongs in the numerator\. If a factor makes attacks harder or recovery faster, it belongs inKK\. This separation prevents semantic drift and double counting\.

We use a terminal\-consequence interpretation for severity\. That is,S​\(π\)S\(\\pi\)reflects the terminal consequence of the path rather than the sum of intermediate disturbances\. Intermediate broadening of impact is captured throughA​\(π\)A\(\\pi\), not by repeatedly re\-counting severity at each step\. This rule gives the most stable path semantics\.

### IV\-CDynamic Resistance and Governance Observability

We deriveKKfrom path\-conditioned controlled stochastic dynamics rather than from an informal scalar assessment as might be the tendency of risk management practitioners\. For a fixed valid failure pathπ\\piand chosen analysis horizonτ\\tau, letXπ​\(t\)X\_\{\\pi\}\(t\)be a finite\-state controlled continuous\-time Markov chain \(CTMC\) on𝒮\\mathcal\{S\}with generatorQπ​\(u\)Q\_\{\\pi\}\(u\)under policyu∈𝒞u\\in\\mathcal\{C\}\. The path determines the relevant hazard states, interfaces, and control touch points\. The horizonτ\\tauremains an external finite evaluation window rather than a function ofπ\\pi\. The state space is𝒮=Σop×Σobs\\mathcal\{S\}=\\Sigma\_\{\\mathrm\{op\}\}\\times\\Sigma\_\{\\mathrm\{obs\}\}, whereΣop=\{σs,σc,σd,σn,σr,σf\}\\Sigma\_\{\\mathrm\{op\}\}=\\\{\\sigma\_\{s\},\\sigma\_\{c\},\\sigma\_\{d\},\\sigma\_\{n\},\\sigma\_\{r\},\\sigma\_\{f\}\\\}\(safe, compromised, detected, contained, recovered, catastrophic\) andΣobs=\{ω,ω¯\}\\Sigma\_\{\\mathrm\{obs\}\}=\\\{\\omega,\\bar\{\\omega\}\\\}\(observable, unobservable\), giving ten states total\. Letℱ⊂𝒮\\mathcal\{F\}\\subset\\mathcal\{S\}denote the catastrophic absorbing states and𝒲⊂𝒮\\mathcal\{W\}\\subset\\mathcal\{S\}the materially degraded but non\-catastrophic warning states\. Transition ratesqi​j​\(u\)q\_\{ij\}\(u\)within the generator matrixQπ​\(u\)Q\_\{\\pi\}\(u\)encode empirical propagation, detection, and recovery hazards\. The generator structure and all rate parameters are provided in the open\-source implementation\.111[https://github\.com/coderhard/friesa\-k\-DSN\-crai2026](https://github.com/coderhard/friesa-k-DSN-crai2026)We define catastrophe probability by horizonτ\\tauas

πF​\(π,τ,u\)=ℙu​\(Xπ​\(τ\)∈ℱ∣Xπ​\(0\)=s0,π\)\.\\pi\_\{F\}\(\\pi,\\tau,u\)=\\mathbb\{P\}\_\{u\}\\big\(X\_\{\\pi\}\(\\tau\)\\in\\mathcal\{F\}\\mid X\_\{\\pi\}\(0\)=s\_\{0,\\pi\}\\big\)\.\(5\)We then define dynamic control effectiveness as the baseline\-to\-controlled benefit factor

K​\(π,τ,u\)=πF​\(π,τ,u0\)πF​\(π,τ,u\)\.K\(\\pi,\\tau,u\)=\\frac\{\\pi\_\{F\}\(\\pi,\\tau,u\_\{0\}\)\}\{\\pi\_\{F\}\(\\pi,\\tau,u\)\}\.\(6\)If a control policy lowers catastrophic absorption by horizon for the instantiated path,K​\(π,τ,u\)K\(\\pi,\\tau,u\)must be\>1\>1\. If it does not, the model makes that visible\.

This notation resolves the semantics of Eq\. \([4](https://arxiv.org/html/2607.18243#S4.E4)\):KKis path\-conditioned because the controlled process is instantiated on the failure path under study, not because the horizon is itself path\-valued\. Controls deployed on layers or interfaces not traversed byπ\\pido not alter this instantiated process for that path\. When control effects are approximately separable across distinct path transitions, a useful approximation is

K​\(π,τ,u\)≈∏j:cj∈𝒞​\(π\)kj​\(τ,u\),K\(\\pi,\\tau,u\)\\approx\\prod\_\{j\\,:\\,c\_\{j\}\\in\\mathcal\{C\}\(\\pi\)\}k\_\{j\}\(\\tau,u\),\(7\)where𝒞​\(π\)⊆𝒞\\mathcal\{C\}\(\\pi\)\\subseteq\\mathcal\{C\}denotes the path\-relevant control set andkj​\(τ,u\)k\_\{j\}\(\\tau,u\)is the benefit factor contributed by controlcjc\_\{j\}\. We do not assume exact factorization as a general law; overlapping or coupled controls must be modeled jointly to avoid double counting\.

To accommodate governance\-sensitive settings that require auditability and assurance accounting, we report a separate governance\-observability penalty in Eq\.[8](https://arxiv.org/html/2607.18243#S4.E8)instead of creating anotherFRIESA\-Kvariable\.

Rgov​\(π,τ,u\)=∫0τ∑s∈𝒲p\(s,NoObs\)π​\(t\)​d​t,R\_\{\\mathrm\{gov\}\}\(\\pi,\\tau,u\)=\\int\_\{0\}^\{\\tau\}\\sum\_\{s\\in\\mathcal\{W\}\}p^\{\\pi\}\_\{\(s,\\textsf\{NoObs\}\)\}\(t\)\\,dt,\(8\)where𝒲⊂𝒮\\mathcal\{W\}\\subset\\mathcal\{S\}contains materially degraded but non\-catastrophic warning states,NoObsmarks weak observability, andp\(s,NoObs\)π​\(t\)p^\{\\pi\}\_\{\(s,\\textsf\{NoObs\}\)\}\(t\)denotes occupancy probability on the same path\-instantiated process\. We then report the residual score

Rres​\(π,τ,u\)=ℛ​\(π,τ,u\)\+wgov​Rgov​\(π,τ,u\),R\_\{\\mathrm\{res\}\}\(\\pi,\\tau,u\)=\\mathcal\{R\}\(\\pi,\\tau,u\)\+w\_\{\\mathrm\{gov\}\}R\_\{\\mathrm\{gov\}\}\(\\pi,\\tau,u\),\(9\)withwgov≥0w\_\{\\mathrm\{gov\}\}\\geq 0chosen by governance priority\. This preserves a clear separation between operational residual risk and governance\-observability degradation\.

![Refer to caption](https://arxiv.org/html/2607.18243v1/x2.png)

Figure 2:Mechanism\-to\-magnitude pipeline\. A validCPSAINTpath induces aFRIESA\-Ktuple, while path\-conditioned controlled dynamics instantiateK​\(π,τ,u\)K\(\\pi,\\tau,u\)and the auxiliary governance\-observability penalty\.
### IV\-DComposability

###### Definition 2\(Structural composability\)\.

We call the framework structurally composable if the same fixed layer grammar and failure\-mode alphabet can express valid failure paths across domains without redefining the decomposition\.

###### Definition 3\(Quantitative composability\)\.

We call the framework quantitatively composable if a valid structural path induces a well\-definedFRIESA\-Kinstance using defined variable semantics, while preserving the functional form of \([4](https://arxiv.org/html/2607.18243#S4.E4)\) across domains\.

###### Theorem 1\(Composition theorem\)\.

LetGCPS=\(ℒ,Φ,ℳ,Π\)G\_\{\\mathrm\{CPS\}\}=\(\\mathcal\{L\},\\Phi,\\mathcal\{M\},\\Pi\)be an instantiated system and letπ∈Π\\pi\\in\\Pibe a valid failure path\. Suppose each step in the attack propagation pathπ\\piadmits domain\-specific instantiations ofFF,RiR\_\{i\},EE,SS, andAAunder the semantics ofFRIESA\-K, and suppose a defender policyuuinduces a finite\-state absorbing process with well\-definedK​\(π,τ,u\)K\(\\pi,\\tau,u\)from \([6](https://arxiv.org/html/2607.18243#S4.E6)\)\. Thenπ\\piinduces a well\-defined risk instanceℛ​\(π,τ,u\)\\mathcal\{R\}\(\\pi,\\tau,u\)under \([4](https://arxiv.org/html/2607.18243#S4.E4)\)\. If governance observability is modeled, the same path also induces a well\-defined reported scoreRres​\(π,τ,u\)R\_\{\\mathrm\{res\}\}\(\\pi,\\tau,u\)under \([9](https://arxiv.org/html/2607.18243#S4.E9)\)\. The mapping preserves functional form across domains\. Only path content and parameter values change\.

###### Proof\.

The proof is constructive\. A valid path specifies the ordered layer transitions and failure modes that carry the attack or disturbance forward\. We attachFFto initiating pressure over the horizon,RiR\_\{i\}to reachable exposure along the path,EEto conditional technical feasibility,SSto the terminal consequence, andAAto cross\-layer broadening of impact\. By assumption, the path\-conditioned controlled CTMC is finite\-state with well\-defined absorption probability by horizon\. Thus,K​\(π,τ,u\)K\(\\pi,\\tau,u\)exists and is non\-negative\. Substituting the instantiated quantities into \([4](https://arxiv.org/html/2607.18243#S4.E4)\) yields a non\-negative risk value\. If observability is modeled, \([8](https://arxiv.org/html/2607.18243#S4.E8)\) is also well\-defined on the same state process, which yields the reported score in \([9](https://arxiv.org/html/2607.18243#S4.E9)\)\. Because neither the layer grammar nor the variable semantics change, the mapping composes across domains without redefining the risk functional\. ∎

Figure[2](https://arxiv.org/html/2607.18243#S4.F2)illustrates the five\-stage mechanism\-to\-magnitude pipeline, from agent failure\-path decomposition through dynamic control modeling to residual risk computation and decision output\.

## VPerformance Evaluation

We evaluate the framework through Gillespie SSA fault\-injection simulation and deterministic sensitivity analysis across two contrasting scenarios\. The simulation injects failure conditions at the entry layer of each instantiated path and tracks catastrophic absorption probability over the evaluation horizon, producing both a deterministic residual\-risk estimate and a Monte Carlo distribution \(N=5,000N=5\{,\}000trajectories\) over uncertain parameter values\. Can one structural decomposition and one risk function support materially different agentic settings without changing their semantics?

We answer that question through two scenarios and one shared sensitivity view\.

Risk scores throughout reflect the product of instantiated parameter values at bundle\-default magnitudes; they are not calibrated to monetary or physical loss units and should be interpreted comparatively, not as absolute loss estimates\.

### V\-ACase A: Hard Real\-Time Warehouse Robot

We consider an autonomous warehouse robot,wr\\mathrm\{wr\}, that fuses sensor input and model\-based planning to avoid collisions under a hard stopping deadline\[[12](https://arxiv.org/html/2607.18243#bib.bib26)\]\. The representative path is given by Eq\.[10](https://arxiv.org/html/2607.18243#S5.E10):

πwr=\[\(S,corruption\),\(D,corruption\),\(C,delay\),\(T,delay\),\(A,coupling\_abuse\)\]\.\\begin\{split\}\\pi\_\{\\mathrm\{wr\}\}=\{\}&\[\(S,\\textsf\{corruption\}\),\(D,\\textsf\{corruption\}\),\\\\ &\(C,\\textsf\{delay\}\),\(T,\\textsf\{delay\}\),\(A,\\textsf\{coupling\\\_abuse\}\)\]\.\\end\{split\}\(10\)
The path begins in sensing, propagates through data and compute, violates timing constraints, and culminates in unsafe actuation\. Here, the terminal consequence is physical collision or unsafe motion\. Thus,S​\(πwr\)S\(\\pi\_\{\\mathrm\{wr\}\}\)is high\. Amplification is also high because delay inTTenlarges the consequence of upstream errors\. A fast safety interlock, bounded\-latency fallback, or PLC\-mediated containment logic reduces catastrophic absorption by horizon and therefore increasesK​\(πwr,τ,u\)K\(\\pi\_\{\\mathrm\{wr\}\},\\tau,u\)sharply\. The governance penalty is secondary\. The main question is whether containment outruns escalation\. Hereτ=0\.75\\tau=0\.75s,wgov=0\.35w\_\{\\mathrm\{gov\}\}=0\.35,normalize\_gov=true:K=1\.527K=1\.527,πF=0\.506\\pi\_\{F\}=0\.506,Rres=2,563,283R\_\{\\mathrm\{res\}\}=2\{,\}563\{,\}283\. Fault\-injection simulation \(N=5,000N=5\{,\}000SSA trajectories, seed 42\): mean2,553,0382\{,\}553\{,\}038, p956,766,2796\{,\}766\{,\}279\.

### V\-BCase B: Financial\-Services Agent with Governance\-Observability Instrumentation

Next, we consider a banking\-services agent, that processes customer loan documents\. The agent,fa\\mathrm\{fa\}, orchestrates document intake, tool calls, policy checks, and customer communication\. The representative path is

πfa=\[\(D,corruption\),\(C,corruption\),\(T,delay\),\(E,coupling\_abuse\)\]\.\\begin\{split\}\\pi\_\{\\mathrm\{fa\}\}=\{\}&\[\(D,\\textsf\{corruption\}\),\(C,\\textsf\{corruption\}\),\\\\ &\(T,\\textsf\{delay\}\),\(E,\\textsf\{coupling\\\_abuse\}\)\]\.\\end\{split\}\(11\)A corrupted record or prompt payload enters the data layer, influences compute logic, interacts with delayed review timing, and propagates into the external workflow state\. Here, immediate catastrophic operational loss may remain moderate\. However, weak logging, broken explanation chains, or incomplete reviewer traceability can keep occupancy in degraded but weakly observable states non\-trivial\. Thus,K​\(πfa,τ,u\)K\(\\pi\_\{\\mathrm\{fa\}\},\\tau,u\)may improve the operational term, whileRgov​\(πfa,τ,u\)R\_\{\\mathrm\{gov\}\}\(\\pi\_\{\\mathrm\{fa\}\},\\tau,u\)remains positive\. The scenario shows why composable trust cannot be reduced to catastrophe avoidance alone\. Hereτ=0\.75\\tau=0\.75s,wgov=0\.90w\_\{\\mathrm\{gov\}\}=0\.90,normalize\_gov=true:K=1\.339K=1\.339,πF=0\.223\\pi\_\{F\}=0\.223,Rres=966,412R\_\{\\mathrm\{res\}\}=966\{,\}412\. Fault\-injection simulation \(N=5,000N=5\{,\}000SSA trajectories, seed 42\): mean954,231954\{,\}231, p952,348,0662\{,\}348\{,\}066\. At this sub\-second horizonRgovR\_\{\\mathrm\{gov\}\}is numerically small\. The scenario demonstrates the structural governance mechanism rather than a quantitativeRgovR\_\{\\mathrm\{gov\}\}magnitude \(see short\-horizon disclosure in Section[V\-C](https://arxiv.org/html/2607.18243#S5.SS3)\)\.

Both scenarios are summarized in Table[II](https://arxiv.org/html/2607.18243#S5.T2)\.

TABLE II:Illustrative mapping from failure path to quantified residual risk
### V\-CSensitivity and Discussion

The framework exposes direct comparative sensitivities\. For fixedRi,E,S,AR\_\{i\},E,S,A, theFRIESA\-Kfunctional is linear inFFand inverse inKK:

ℛ∝F,ℛ∝1K\.\\mathcal\{R\}\\propto F,\\qquad\\mathcal\{R\}\\propto\\frac\{1\}\{K\}\.Thus, larger attack frequency increases residual risk, while stronger control effectiveness reduces it\.

![Refer to caption](https://arxiv.org/html/2607.18243v1/x3.png)Figure 3:Sensitivity sweep: residual riskRresR\_\{\\mathrm\{res\}\}versus uniform control level for the warehouse\-robot \(response\-dominant,wgov=0\.35w\_\{\\mathrm\{gov\}\}=0\.35\) and banking\-agent \(governance\-instrumented,wgov=0\.90w\_\{\\mathrm\{gov\}\}=0\.90\) scenarios\. Both curves useτ=0\.75\\tau=0\.75s andnormalize\_gov=true\. Deterministic path; bundle\-default parameter values\.Figure[3](https://arxiv.org/html/2607.18243#S5.F3)shows the deterministic sensitivity ofRresR\_\{\\mathrm\{res\}\}to uniform control level for both cases\. The warehouse\-robot residual risk drops sharply with improving controls because high containment and recovery elasticities \(βc=2\.1\\beta\_\{c\}=2\.1,βr=1\.8\\beta\_\{r\}=1\.8\) translate small control improvements into large reductions in catastrophic absorption probability\. The banking\-agent curve is flatter because lower hazard rates and a smallerS×AS\\times Aproduct \(0\.9×106×1\.250\.9\\times 10^\{6\}\\times 1\.25vs\.1\.8×106×1\.651\.8\\times 10^\{6\}\\times 1\.65\) reduce the baseline operational term and limit the K\-induced reduction\. The governance\-observability weight is set towgov=0\.90w\_\{\\mathrm\{gov\}\}=0\.90to reflect governance priority, but atτ=0\.75\\tau=0\.75s the additiveRgovR\_\{\\mathrm\{gov\}\}term is numerically small relative to the operational term; see the short\-horizon disclosure below\. The warehouse robot carries higher absoluteRresR\_\{\\mathrm\{res\}\}despite the lower governance weight\. Steeper hazard rates and a largerS×AS\\times Aproduct dominate\.KKgain alone cannot close that gap\.

![Refer to caption](https://arxiv.org/html/2607.18243v1/x4.png)Figure 4:Residual riskRresR\_\{\\mathrm\{res\}\}as a function of integrity\-failure frequencyFF, all other parameters held at bundle nominals\. Both cases scale linearly withFF, consistent with the analytical form of \([4](https://arxiv.org/html/2607.18243#S4.E4)\)\. The warehouse robot shows a higher slope becauseS​\(πwr\)×A​\(πwr\)S\(\\pi\_\{\\mathrm\{wr\}\}\)\\times A\(\\pi\_\{\\mathrm\{wr\}\}\)is larger\. The banking agent shows a shallower slope because lower amplification \(μA=1\.25\\mu\_\{A\}=1\.25vs\.1\.651\.65\) and lower severity keep the numerator product modest even at high event rates\.Figure[4](https://arxiv.org/html/2607.18243#S5.F4)sweepsFFwhile holding all other parameters at bundle defaults\. Both curves are linear inFFas the risk formula requires\. The warehouse robot slope exceeds the banking agent slope becauseS×AS\\times Ais larger in the physical case \(1\.8×106×1\.651\.8\\times 10^\{6\}\\times 1\.65vs\.0\.9×106×1\.250\.9\\times 10^\{6\}\\times 1\.25\)\.

One practical note merits disclosure\. Atτ=0\.75\\tau=0\.75s, the governance\-observability penaltyRgovR\_\{\\mathrm\{gov\}\}is numerically negligible relative to theFRIESA\-Koperational term for both scenarios\. This is expected: a sub\-second horizon provides insufficient dwell time for unobservable compromised states to accumulate a material integral\. The banking\-agent scenario demonstrates the governance*structural mechanism*\. The framework represents that a governance\-priority system requires separate observability accounting\. But the magnitude ofRgovR\_\{\\mathrm\{gov\}\}becomes material only at longer evaluation horizons\. Clinical workflow scenarios \(e\.g\., a 12\-hour post\-surgical shift,τ=43,200\\tau=43\{,\}200s\) exhibit substantialRgovR\_\{\\mathrm\{gov\}\}contributions\. Fault\-injection runs on the oncology delegation bundles at this horizon confirm thatRgovR\_\{\\mathrm\{gov\}\}becomes the dominant term when governance weightwgov=0\.85w\_\{\\mathrm\{gov\}\}=0\.85and unobservable dwell time accumulates over hours rather than milliseconds\.

Therefore, these comparative cases are best read as a demonstration of the operational mechanics ofFRIESA\-K\. The governance dimension is demonstrated at scale via longer\-horizon bundles\.

The evaluation supports three conclusions\. First, the sameCPSAINTgrammar expresses materially different paths without changing the layer set\. Second, the sameFRIESA\-Ksemantics remain intact across both cases\. Third, dynamic resistance and governance observability separate two conditions that static scoring often conflates: operational safety improvement and residual assurance degradation\. That distinction matters\. It is the reason the framework establishes a composable trust and avoids monolithic brittleness\.

Existing baselines offer partial views\. Structural frameworks \(e\.g\., STPA\) identify hazards without quantifying residual risk, while probabilistic estimators \(e\.g\., CVaR\) quantify risk but black\-box the failure path\. Neither supports targeted control optimization across end\-to\-end workflows\. Runtime\-assurance methods such as AgentSpec enforce per\-agent constraints with binary guarantees but do not propagate quantitative residual risk across composed paths\. By couplingCPSAINTwithFRIESA\-K, we provide a concise mechanism to evaluate competing interventions\. That is, we mathematically distinguish the risk\-reduction value of data\-layer detection \(DD\) versus actuation\-layer containment \(AA\)\. Thus, qualitative hazard paths become measurable risk instances\.

### V\-DUncertainty and One\-at\-a\-Time Weak\-Control Comparison

Figure[5](https://arxiv.org/html/2607.18243#S5.F5)extends the deterministic sensitivity view in Figure[3](https://arxiv.org/html/2607.18243#S5.F3)with Monte Carlo mean curves and p50–p90 bands\. The uncertainty envelope widens the absolute risk range but does not reverse the qualitative ordering between the two scenarios\. The warehouse\-robot band is broader in absolute terms because uncertainty in severity and amplification multiplies through a larger nominal loss scale\. The banking\-agent curve remains flatter across the control grid, which is consistent with lower operational hazard rates and a comparatively smaller shift in the operational term as uniform controls improve\.

![Refer to caption](https://arxiv.org/html/2607.18243v1/x5.png)Figure 5:Residual riskRresR\_\{\\mathrm\{res\}\}versus uniform control level with Monte Carlo mean curves and p50–p90 bands for both scenarios\. Uncertainty widens the envelope but preserves the qualitative ordering observed in the deterministic sweep\.Figure[6](https://arxiv.org/html/2607.18243#S5.F6)reports the absolute reported Residual RiskRresR\_\{\\mathrm\{res\}\}under baseline and one\-at\-a\-time weakened\-control conditions\. The grouped bars should be read as a weak\-control comparison, not as a fractional\-removal analysis\. For the warehouse robot, the largest visible increase occurs under weak response and weak detection\. This is consistent with a path in which containment and time\-critical intervention dominate operational risk\. For the banking agent, weak detect produces the largest visible increase in totalRresR\_\{\\mathrm\{res\}\}, while weak response and weak recovery move the score only modestly\.

![Refer to caption](https://arxiv.org/html/2607.18243v1/x6.png)Figure 6:One\-at\-a\-time weak\-control comparison for the warehouse\-robot and banking\-agent scenarios\. Each bar shows the absolute reported scoreRresR\_\{\\mathrm\{res\}\}under the baseline bundle and under isolated weakened\-control conditions\.The governance result requires a narrower reading\. Weak governance detection produces little visible movement in totalRresR\_\{\\mathrm\{res\}\}atτ=0\.75\\tau=0\.75s for either case, even though governance observability remains structurally modeled\. That behavior is consistent with the short\-horizon disclosure above: over a sub\-second window, the additiveRgov​\(π,τ,u\)R\_\{\\mathrm\{gov\}\}\(\\pi,\\tau,u\)term remains numerically small relative to the operationalFRIESA\-Kterm\. Thus, the present ablation supports a bounded claim\. The current short\-horizon bundles are most sensitive to response and operational detection on the warehouse path, and to operational detection on the banking path, while governance\-heavy effects become materially visible only under longer\-horizon instantiations\.

## VILimitations

The controlled CTMC assumes a finite\-state abstraction rich enough to capture the materially relevant modes for the hazard class, however calibration remains domain\-specific\. We demonstrate instantiation, not a universally calibrated estimator\. Correlation among numerator terms and overlap among controls can bias naive factorizations if left unjustified\. We therefore use this paper to lock semantics and prove the mechanism\-to\-magnitude mapping, not to claim complete dependence modeling\. We also keep the seven\-layer decomposition intentionally compact\. Some domains may require finer internal structure inside a layer\. That refinement can be added without changing the core grammar\.

## VIIConclusion

Agentic AI requires a framework that links the structural mechanism of failure to the magnitude of residual risk with fixed semantics that transfer across domains\.CPSAINTprovides the structural half: a seven\-layer grammar with an explicit propagation relation and a five\-mode failure alphabet\.FRIESA\-Kprovides the quantitative half: locked variable boundaries, a dynamic resistance term grounded in absorbing Markov state behavior, and an additive governance\-observability penalty that extends the framework without redefining the canonical risk equation\. The composition theorem makes the linkage formal, and the two contrasting case studies confirm it in practice\. The result is a compact, cross\-domain kernel for mechanism\-to\-magnitude reasoning with explicit assumptions and composable trust semantics\.

## VIIIFuture Work

Several open problems remain\. First, empirical calibration ofFRIESA\-Kparameters in operational deployments would replace expert\-assigned values with measured priors\. Second, the current model treats the numerator terms as independent, and in so doing, modeling correlation betweenFF,RiR\_\{i\},EE,SS, andAAis a natural extension\. Third, multi\-agent settings introduce overlapping control surfaces that the single\-path composition theorem does not yet cover\. Finally, automated path extraction from system architecture artifacts would reduce the manual effort currently required to instantiate aCPSAINTdecomposition\.

## References

- \[1\]P\. Artzner, F\. Delbaen, J\. Eber, and D\. Heath\(1999\)Coherent measures of risk\.Mathematical Finance9\(3\),pp\. 203–228\.External Links:[Document](https://dx.doi.org/10.1111/1467-9965.00068)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p4.1)\.
- \[2\]S\. Au and J\. L\. Beck\(2001\)Estimation of small failure probabilities in high dimensions by subset simulation\.Probabilistic Engineering Mechanics16\(4\),pp\. 263–277\.External Links:[Document](https://dx.doi.org/10.1016/S0266-8920%2801%2900019-4)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p4.1)\.
- \[3\]R\. Bloomfield and J\. Rushby\(2024\)Assurance of AI systems from a dependability perspective\.Technical reportTechnical ReportSRI\-CSL\-2024\-02,SRI International\.Note:arXiv:2407\.13948\. Companion at ASSURE 2024 \(ISSRE 2024\)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[4\]S\. V\. Buldyrev, R\. Parshani, G\. Paul, H\. E\. Stanley, and S\. Havlin\(2010\)Catastrophic cascade of failures in interdependent networks\.Nature464\(7291\),pp\. 1025–1028\.External Links:[Document](https://dx.doi.org/10.1038/nature08932)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p4.1)\.
- \[5\]M\. Cemri, M\. Z\. Pan, S\. Yang, L\. A\. Agrawal, B\. Chopra, A\. Albarghouthi, S\. Jha, and H\. Lakkaraju\(2025\)Why do multi\-agent LLM systems fail?\.InAdvances in Neural Information Processing Systems \(NeurIPS\), Datasets and Benchmarks Track,Note:Spotlight\. arXiv:2503\.13657Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p3.1)\.
- \[6\]E\. Debenedetti, I\. Shumailov, T\. Fan, J\. Hayes, N\. Carlini, D\. Fabian, C\. Kern, C\. Shi, A\. Terzis, and F\. Tramèr\(2025\)Defeating prompt injections by design\.External Links:2503\.18813,[Link](https://arxiv.org/abs/2503.18813)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[7\]A\. Dehghantanha and S\. Homayoun\(2026\)SoK: the attack surface of agentic ai – tools, and autonomy\.External Links:2603\.22928,[Link](https://arxiv.org/abs/2603.22928)Cited by:[§I](https://arxiv.org/html/2607.18243#S1.p3.1)\.
- \[8\]I\. Friedberg, K\. McLaughlin, P\. Smith, D\. Laverty, and S\. Sezer\(2017\)STPA\-SafeSec: safety and security analysis for cyber\-physical systems\.Journal of Information Security and Applications34,pp\. 183–196\.External Links:[Document](https://dx.doi.org/10.1016/j.jisa.2016.05.008)Cited by:[§I](https://arxiv.org/html/2607.18243#S1.p4.1),[§II](https://arxiv.org/html/2607.18243#S2.p2.1)\.
- \[9\]Gartner\(2025\-06\)Gartner predicts over 40% of agentic AI projects will be canceled by end of 2027\.Note:[https://www\.gartner\.com/en/newsroom/press\-releases/2025\-06\-25\-gartner\-predicts\-over\-40\-percent\-of\-agentic\-ai\-projects\-will\-be\-canceled\-by\-end\-of\-2027](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027)Accessed: 2026\-04\-09Cited by:[§I](https://arxiv.org/html/2607.18243#S1.p1.1)\.
- \[10\]S\. Hong, M\. Zhuge, J\. Chen, X\. Zheng, Y\. Cheng, C\. Zhang, J\. Wang, Z\. Wang, S\. K\. S\. Yau, Z\. Lin,et al\.\(2024\)MetaGPT: meta programming for a multi\-agent collaborative framework\.InProc\. Int\. Conf\. Learning Representations \(ICLR\),Note:arXiv:2308\.00352Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p3.1)\.
- \[11\]J\. Huang, J\. Zhou, T\. Jin, X\. Zhou, Z\. Chen, W\. Wang, Y\. Yuan, M\. Lyu, and M\. Sap\(2025\-13–19 Jul\)On the resilience of LLM\-based multi\-agent collaboration with faulty agents\.InProc\. 42nd Int\. Conf\. Machine Learning \(ICML\),A\. Singh, M\. Fazel, D\. Hsu, S\. Lacoste\-Julien, F\. Berkenkamp, T\. Maharaj, K\. Wagstaff, and J\. Zhu \(Eds\.\),PMLR, Vol\.267,pp\. 26202–26226\.Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[12\]H\. Karim, D\. Gupta, A\. K\. Nair, D\. Boyd, and L\. Elluri\(2026\)FORGE\-bench: a threat\-labeled dataset and digital twin framework for security evaluation of LLM\-driven warehouse robots\.Note:Manuscript under reviewExternal Links:[Link](https://orcid.org/0000-0002-5441-049X)Cited by:[§V\-A](https://arxiv.org/html/2607.18243#S5.SS1.p1.1)\.
- \[13\]H\. Karim, D\. Gupta, and S\. Sitharaman\(2025\)Securing LLM workloads with NIST AI RMF in the internet of robotic things\.IEEE Access13,pp\. 69631–69649\.External Links:[Document](https://dx.doi.org/10.1109/ACCESS.2025.3561235)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[14\]O\. Khattab, A\. Singhvi, P\. Maheshwari, Z\. Zhang, K\. Santhanam, S\. Vardhamanan, S\. Haq, A\. Sharma, T\. T\. Joshi, H\. Moazam,et al\.\(2023\)DSPy: compiling declarative language model calls into self\-improving pipelines\.InProc\. Int\. Conf\. Learning Representations \(ICLR\),Note:arXiv:2310\.03714Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p3.1)\.
- \[15\]B\. Kordy, S\. Mauw, S\. Radomirović, and P\. Schweitzer\(2014\)Attack–defense trees\.Journal of Logic and Computation24\(1\),pp\. 55–87\.External Links:[Document](https://dx.doi.org/10.1093/logcom/exs029)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p2.1)\.
- \[16\]N\. G\. Leveson\(2004\)A new accident model for engineering safer systems\.Safety Science42\(4\),pp\. 237–270\.External Links:[Document](https://dx.doi.org/10.1016/S0925-7535%2803%2900047-X)Cited by:[§I](https://arxiv.org/html/2607.18243#S1.p4.1),[§II](https://arxiv.org/html/2607.18243#S2.p2.1)\.
- \[17\]D\. Rios Insua, A\. Couce\-Vieira, J\. A\. Rubio, W\. Pieters, K\. Labunets, and D\. G\. Rasines\(2021\)An adversarial risk analysis framework for cybersecurity\.Risk Analysis41\(1\),pp\. 16–36\.External Links:[Document](https://dx.doi.org/10.1111/risa.13331)Cited by:[§I](https://arxiv.org/html/2607.18243#S1.p4.1),[§II](https://arxiv.org/html/2607.18243#S2.p4.1)\.
- \[18\]R\. T\. Rockafellar and S\. Uryasev\(2000\)Optimization of conditional value\-at\-risk\.Journal of Risk2\(3\),pp\. 21–41\.External Links:[Link](https://doi.org/10.21314/JOR.2000.038)Cited by:[§I](https://arxiv.org/html/2607.18243#S1.p4.1),[§II](https://arxiv.org/html/2607.18243#S2.p4.1)\.
- \[19\]T\. Shi, J\. He, Z\. Wang, H\. Li, L\. Wu, W\. Guo, and D\. Song\(2025\)Progent: programmable privilege control for llm agents\.External Links:2504\.11703,[Link](https://arxiv.org/abs/2504.11703)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[20\]H\. Wang, C\. M\. Poskitt, J\. Sun, and J\. Wei\(2026\)Pro2Guard: proactive runtime enforcement of LLM agent safety via probabilistic model checking\.External Links:2508\.00500,[Link](https://arxiv.org/abs/2508.00500)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[21\]H\. Wang, C\. M\. Poskitt, and J\. Sun\(2025\)AgentSpec: customizable runtime enforcement for safe and reliable llm agents\.External Links:2503\.18666,[Link](https://arxiv.org/abs/2503.18666)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.
- \[22\]Q\. Wu, G\. Bansal, J\. Zhang, Y\. Wu, B\. Li, E\. Zhu, L\. Jiang, X\. Zhang, S\. Zhang, J\. Liu,et al\.\(2024\)AutoGen: enabling next\-gen LLM applications via multi\-agent conversation\.InProc\. Conf\. Language Modeling \(COLM\),Note:arXiv:2308\.08155Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p3.1)\.
- \[23\]Y\. Wu, F\. Roesner, T\. Kohno, N\. Zhang, and U\. Iqbal\(2025\)IsolateGPT: an execution isolation architecture for llm\-based agentic systems\.External Links:2403\.04960,[Link](https://arxiv.org/abs/2403.04960)Cited by:[§II](https://arxiv.org/html/2607.18243#S2.p5.1)\.