CASEL：面向可靠长程工具使用智能体的后果感知选择性执行

# CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents
Source: [https://arxiv.org/html/2610.36570](https://arxiv.org/html/2610.36570)
1stYanyan Zhang2ndFei ShenAffiliation:Feinity LLC Sacramento, CA 95816, USA shenfei2031@hotmail\.com3rdTing YanAffiliation:Computer Science Department Dartmouth College Hanover, NH 03755, USA ting\.yan\.gr@dartmouth\.eduAffiliation:4thHao Zhang\*Affiliation:Independent Researcher Los Angeles, CA 90095, USA \*Corresponding author: alex1995101099@gmail\.com

###### Abstract

Tool\-using language agents increasingly modify external systems, yet most runtime safeguards allocate scrutiny by generic uncertainty scores or coarse mutation heuristics\. We introduceCASEL\(Consequence\-Aware Selective Execution Layer\), a model\-agnostic runtime allocation policy that combines calibrated failure probability, state\-dependent consequence, reversibility, ambiguity, and evidence freshness to choose, for each proposed tool call, among direct execution, verification, sandboxing, clarification, approval, and abstention by minimizing a per\-mode cost\. We formalize direct execution as selective prediction and state and test the validity conditions of a finite\-sample threshold and a trajectory risk ledger\. In a controlled simulation over 20 seeds with 120,000 test actions each, in which every method has the same intervention menu and the same compute cost,CASELreduces harmful\-side\-effect trajectories from 14\.75 percent for an uncertainty\-ranked gate to 7\.02 percent and mean normalized harm from 0\.184 to 0\.123\. A gate ranked by the product of failure probability and consequence reaches similar harm \(5\.82 percent, 0\.120\) but sends 45 percent more actions to human approval, and removing reversibility\-aware routing raises the rate to 15\.53 percent\. A trajectory\-level risk budget, in contrast, increases harm at equal cost \(11\.82 percent\)\. Intervention effectiveness is assumed, not measured: the results rank allocation rules under the simulator’s assumptions and do not establish deployment effectiveness\.

###### Index Terms:

LLM agents, tool use, reliability, selective prediction, uncertainty calibration, runtime verification, risk\-aware execution\.

## IIntroduction

Language\-model agents increasingly act on external systems over long trajectories, and as models grow more capable they become autonomous domain\-specific agents, e\.g\., SP\-Mind runs complete spatial\-proteomics analyses with specialized tools\.\[[1](https://arxiv.org/html/2610.36570#bib.bib1)\]They now also generate device configurations for multi\-vendor optical transport networks,\[[2](https://arxiv.org/html/2610.36570#bib.bib2)\]where an erroneous change can affect live services\. Benchmarks such as WebArena,τ\\tau\-Bench/τ2\\tau^\{2\}\-Bench, and AgentDojo expose failures from stale state, planning errors, unsafe tool use, and adversarial observations\[[3](https://arxiv.org/html/2610.36570#bib.bib3),[4](https://arxiv.org/html/2610.36570#bib.bib4),[5](https://arxiv.org/html/2610.36570#bib.bib5),[6](https://arxiv.org/html/2610.36570#bib.bib6)\]\. Reflection and self\-critique improve reasoning\[[7](https://arxiv.org/html/2610.36570#bib.bib7),[8](https://arxiv.org/html/2610.36570#bib.bib8)\], and recent work studies clarification, abstention, mutating\-action verification, least privilege, and transactional containment\[[9](https://arxiv.org/html/2610.36570#bib.bib9),[10](https://arxiv.org/html/2610.36570#bib.bib10),[11](https://arxiv.org/html/2610.36570#bib.bib11),[12](https://arxiv.org/html/2610.36570#bib.bib12),[13](https://arxiv.org/html/2610.36570#bib.bib13)\]\. These mechanisms address different failure sources but leave a common allocation question:*how much scrutiny should be spent before a particular action is allowed to change the world?*

Uncertainty alone does not answer it\. Two actions may share a20%20\\%probability of error, yet a read\-only search is cheap to retry while an irreversible transfer is costly; an uncertainty\-only gate treats them alike, and a mutation\-only gate still conflates a reversible edit with an irreversible commitment\.

User objectiveand contexthth\_\{t\}Base agent\(any LLM\)Risk signals of the proposed callata\_\{t\}p^t\\hat\{p\}\_\{t\}failure prob\.c^t\\hat\{c\}\_\{t\}consequenceρt\\rho\_\{t\}reversibilitygt,dtg\_\{t\}\{,\}\\,d\_\{t\}ambiguity, ageata\_\{t\}CASEL selective controllerJ⁡\(m\)=γm​p^t​c^t\+λ​k​\(m\)\+μ​q​\(m\)J\(m\)\{=\}\\gamma\_\{m\}\\hat\{p\}\_\{t\}\\hat\{c\}\_\{t\}\{\+\}\\lambda k\(m\)\{\+\}\\mu q\(m\)m∗=arg⁡minm∈ℳt​\(ρt\)⁡J⁡\(m\)m^\{\\ast\}\{=\}\\arg\\min\_\{m\\in\\mathcal\{M\}\_\{t\}\(\\rho\_\{t\}\)\}J\(m\)optional:Ht−1\+r¯t\>BHH\_\{t\-1\}\{\+\}\\bar\{r\}\_\{t\}\{\>\}B\_\{H\}⇒\\Rightarrowescalate
highgtg\_\{t\}⇒\\Rightarrowclarify; staledtd\_\{t\}⇒\\Rightarrowre\-readdirectverifysandboxapproveclarifyabstainmtm\_\{t\}Tool executor & environmentOptional risk ledgerHt=∑i≤t,i∈Dr¯i≤BHH\_\{t\}=\\sum\_\{i\\leq t,\\,i\\in D\}\\bar\{r\}\_\{i\}\\leq B\_\{H\}outcomeHt−1H\_\{t\-1\}observations, evidence age\(a\) CASEL runtime: one routing decision per proposed tool call\(b\) Same calibratedp^t=0\.20\\hat\{p\}\_\{t\}=0\.20, different consequence⇒\\Rightarrowthree different modesread\-onlysearch
p^=0\.20\\hat\{p\}=0\.20,c^=0\.05\\hat\{c\}=0\.05⇒\\Rightarrowr^=0\.010\\hat\{r\}=0\.010
directreversibleedit
p^=0\.20\\hat\{p\}=0\.20,c^=0\.40\\hat\{c\}=0\.40⇒\\Rightarrowr^=0\.080\\hat\{r\}=0\.080
sandboxirreversibletransfer
p^=0\.20\\hat\{p\}=0\.20,c^=0\.90\\hat\{c\}=0\.90⇒\\Rightarrowr^=0\.180\\hat\{r\}=0\.180
approveParametersλ=0\.02\\lambda\{=\}0\.02,μ=0\.015\\mu\{=\}0\.015
Figure 1:CASELroutes every proposed tool call by consequence\-weighted risk, not by uncertainty alone\.\(a\) Structured risk signals feed a controller that minimizes the per\-mode costJ⁡\(m\)J\(m\)over the modes feasible for the action’s reversibility class; dashed elements are not part of the main comparison; clarify is tested inSec\.[VI\-E](https://arxiv.org/html/2610.36570#S6.SS5), abstain is not exercised\. \(b\) Worked example with the nominal parameters \(inset\): three calls with the samep^t\\hat\{p\}\_\{t\}but differentc^t\\hat\{c\}\_\{t\}go to direct execution, sandboxing, and approval \(lowestJJin bold\); an uncertainty\-only gate cannot tell them apart\.We proposeCASEL, a runtime layer between an arbitrary base agent and its tool executor \(Figure[1](https://arxiv.org/html/2610.36570#S1.F1)\)\. At each step the controller estimates failure probabilityp^t\\hat\{p\}\_\{t\}, consequencec^t\\hat\{c\}\_\{t\}, reversibilityρt\\rho\_\{t\}, ambiguitygtg\_\{t\}, and evidence stalenessdtd\_\{t\}, and selects a graded intervention\. Scrutiny should scale with consequence\-weighted risk rather than generic confidence, the intervention should match the action’s reversibility, and direct execution should be calibrated as selective prediction\[[14](https://arxiv.org/html/2610.36570#bib.bib14),[15](https://arxiv.org/html/2610.36570#bib.bib15),[16](https://arxiv.org/html/2610.36570#bib.bib16)\]\.CASELis therefore not another uncertainty gate but a runtime*allocation policy*that decides where scrutiny is worth its cost and calls existing safety mechanisms as its intervention branches\.

Our contributions are: \(i\) a consequence\-aware execution objective with six intervention modes, five of which are exercised \(abstain and the staleness signaldtd\_\{t\}are not\); \(ii\) explicit validity conditions for a finite\-sample direct\-execution threshold, shown to bind and hold over a sweep ofϵ\\epsilon, and an analysis of a trajectory risk ledger whose premise fails in practice; and \(iii\) a reproducible controlled evaluation in which all comparators share the intervention menu and cost, with ablations, paired significance tests, stress tests, and a negative result for trajectory budgeting, plus a deployment path\.

## IIRelated Work

Agents and benchmarks\.ReAct interleaves reasoning with action and Reflexion stores verbal feedback across attempts\[[7](https://arxiv.org/html/2610.36570#bib.bib7),[8](https://arxiv.org/html/2610.36570#bib.bib8)\]; WebArena and theτ\\tau\-family emphasize stateful, long\-horizon tool use\[[3](https://arxiv.org/html/2610.36570#bib.bib3),[4](https://arxiv.org/html/2610.36570#bib.bib4),[5](https://arxiv.org/html/2610.36570#bib.bib5)\]\. Focus\-Then\-Contact learns robot skills with residual RL under timed human intervention\[[17](https://arxiv.org/html/2610.36570#bib.bib17)\], and DRAFT\-RL scores multi\-agent reasoning drafts during RL\[[18](https://arxiv.org/html/2610.36570#bib.bib18)\]\. Domain\-specific agents bring domain\-specific benchmarks, such as SP\-Bench with 102 spatial\-proteomics tasks\.\[[1](https://arxiv.org/html/2610.36570#bib.bib1)\]These works strengthen base policies but do not decide when an action needs extra evidence\.

Clarification, abstention, and tool safety\.SAGE\-Agent selects clarification questions by value of information\[[9](https://arxiv.org/html/2610.36570#bib.bib9)\]; AgentAbstain tests whether agents recognize when acting is unjustified\[[10](https://arxiv.org/html/2610.36570#bib.bib10)\]\. AgentDojo targets untrusted tool outputs,\[[6](https://arxiv.org/html/2610.36570#bib.bib6)\]which multi\-agent evidence checking can screen;\[[19](https://arxiv.org/html/2610.36570#bib.bib19)\]AgenTRIM enforces adaptive least privilege\[[12](https://arxiv.org/html/2610.36570#bib.bib12)\], SABER safeguards mutating steps\[[11](https://arxiv.org/html/2610.36570#bib.bib11)\], and Cordon stages multi\-step effects as semantic transactions\[[13](https://arxiv.org/html/2610.36570#bib.bib13)\]\.

Selective prediction and calibration\.Reject\-option prediction formalizes an accuracy–coverage trade\-off\[[14](https://arxiv.org/html/2610.36570#bib.bib14),[15](https://arxiv.org/html/2610.36570#bib.bib15)\]; temperature scaling calibrates scores\[[20](https://arxiv.org/html/2610.36570#bib.bib20)\], and conformal risk control bounds monotone risks in expectation\[[16](https://arxiv.org/html/2610.36570#bib.bib16)\], weaker than the high\-probability bound used here\. RAGScope routes retrieval\-augmented answers to acceptance, review, or an expensive verifier with a cheap, cost\-aware evidence gate,\[[21](https://arxiv.org/html/2610.36570#bib.bib21)\]a pass/escalate decision thatCASELgeneralizes to several interventions\.

Table[1](https://arxiv.org/html/2610.36570#S2.T1)summarizes the comparison, including orthogonal layers: REFLEX calls a strong LLM when its fast decision layer is unsure\[[22](https://arxiv.org/html/2610.36570#bib.bib22)\], and CA2I scores whole action sequences before execution\[[23](https://arxiv.org/html/2610.36570#bib.bib23)\]\.CASEL’s product risk signal makes uncertainty\-, consequence\-, and mutation\-only gates \(evaluated in Sec\.[VI](https://arxiv.org/html/2610.36570#S6)\) special cases, and its heterogeneous interventions make the specialized mechanisms candidate branches rather than competitors\.

Table 1:Qualitative comparison with alternative approaches\.*Step*: one decision per proposed tool call\.
## IIIProblem Formulation

At steptt, historyhth\_\{t\}holds the user objective, observations, and prior actions, and a base policy proposes a tool callat=\(zt,θt\)a\_\{t\}=\(z\_\{t\},\\theta\_\{t\}\)\. LetFt∈\{0,1\}F\_\{t\}\\in\\\{0,1\\\}indicate thatata\_\{t\}is invalid relative to the task, policy, tool contract, or environment state\. Its failure probability is

pt=ℙ⁡\(Ft=1∣ht,at,st\),p\_\{t\}=\\mathbb\{P\}\(F\_\{t\}=1\\mid h\_\{t\},a\_\{t\},s\_\{t\}\),\(1\)wherests\_\{t\}is the environment state whenata\_\{t\}would be committed, observed only partially throughhth\_\{t\}\. Withct∈\[0,1\]c\_\{t\}\\in\[0,1\]the normalized consequence if the action is wrong, the one\-step expected harmful loss isrt=pt​ctr\_\{t\}=p\_\{t\}c\_\{t\}\.Notation\.Unhattedpt,ct,rtp\_\{t\},c\_\{t\},r\_\{t\}are true, unobserved quantities used in the analysis; hattedp^t,c^t,r^t=p^t​c^t\\hat\{p\}\_\{t\},\\hat\{c\}\_\{t\},\\hat\{r\}\_\{t\}=\\hat\{p\}\_\{t\}\\hat\{c\}\_\{t\}are run\-time estimates, and Algorithm[1](https://arxiv.org/html/2610.36570#alg1)and all routing rules use only these\.r¯t\\bar\{r\}\_\{t\}is the score charged to the optional ledger\. Throughout, includingFigure[1](https://arxiv.org/html/2610.36570#S1.F1)andTable[1](https://arxiv.org/html/2610.36570#S2.T1),λ\\lambdaandμ\\muweight compute and interaction cost,ρt\\rho\_\{t\}is the reversibility class, andγm\\gamma\_\{m\}the residual multiplier of modemm\.

Before commitment, a controller choosesmtm\_\{t\}fromℳ=\{direct,verify,sandbox,clarify,approve,abstain\}\\mathcal\{M\}=\\\{\\textsf\{direct\},\\textsf\{verify\},\\textsf\{sandbox\},\\textsf\{clarify\},\\textsf\{approve\},\\textsf\{abstain\}\\\}\. Modemmhas residual failure probabilitypt\(m\)p\_\{t\}^\{\(m\)\}, compute costk⁡\(m\)k\(m\), and interaction costq⁡\(m\)q\(m\), and the ideal myopic decision is

mt∗=arg⁡minm∈ℳt⁡\[pt\(m\)​ct\+λ​k​\(m\)\+μ​q​\(m\)\],m\_\{t\}^\{\*\}=\\arg\\min\_\{m\\in\\mathcal\{M\}\_\{t\}\}\\left\[p\_\{t\}^\{\(m\)\}c\_\{t\}\+\\lambda k\(m\)\+\\mu q\(m\)\\right\],\(2\)whereℳt\\mathcal\{M\}\_\{t\}removes infeasible modes\. For committed actions, linearity of expectation gives, without independence,

𝔼⁡\[∑t=1Tct​Ft\]=∑t=1Tpt​ct,\\mathbb\{E\}\\\!\\left\[\\textstyle\\sum\_\{t=1\}^\{T\}c\_\{t\}F\_\{t\}\\right\]=\\textstyle\\sum\_\{t=1\}^\{T\}p\_\{t\}c\_\{t\},\(3\)so cumulative risk can be tracked by a ledger; Sec\.[VI](https://arxiv.org/html/2610.36570#S6)tests whether budgeting it helps\.

## IVCASEL Runtime

### IV\-AStructured Risk Signals

Failure probability\.A raw scoreutu\_\{t\}is calibrated on a held\-out split,p^t=fcal​\(ut\)\\hat\{p\}\_\{t\}=f\_\{\\mathrm\{cal\}\}\(u\_\{t\}\), by isotonic regression or, given logits, temperature scaling\[[20](https://arxiv.org/html/2610.36570#bib.bib20)\]; thresholds and budgets are then read as probabilities\.utu\_\{t\}can also draw on model internal states, as MISO does for ranking models\[[24](https://arxiv.org/html/2610.36570#bib.bib24)\]\.

Consequence\.The controller computes

c^t=clip⁡\(cbase​\(zt\)​Mscope​\(θt,ht\),0,1\),\\hat\{c\}\_\{t\}=\\mathrm\{clip\}\\big\(c\_\{\\rm base\}\(z\_\{t\}\)\\,M\_\{\\rm scope\}\(\\theta\_\{t\},h\_\{t\}\),\\,0,\\,1\\big\),\(4\)wherecbasec\_\{\\rm base\}is a frozen per\-tool severity from auditable metadata \(write access, privilege, data sensitivity, value transfer\) andMscope≥0M\_\{\\rm scope\}\\geq 0a bounded magnitude factor \(records, amount, rollback cost\)\.

Reversibility\.The classρt\\rho\_\{t\}\(read, reversible, compensable, or irreversible\) changes the feasible setℳt​\(ρt\)\\mathcal\{M\}\_\{t\}\(\\rho\_\{t\}\)rather than scalingc^t\\hat\{c\}\_\{t\}\.Direct,verify,clarify, andabstainare always feasible;sandboxrequires a reversible mutation or a dry\-run interface such as the forkable environments of Counterfactual Rollout Replay\[[25](https://arxiv.org/html/2610.36570#bib.bib25)\], never for irreversible commitments;approveapplies to compensable and irreversible actions\.

Ambiguity and freshness\.gtg\_\{t\}captures missing intent that more sampling cannot recover and routes to clarification;dtd\_\{t\}captures stale evidence and triggers a re\-read\. For GUI agents, perception errors \(object detection\[[26](https://arxiv.org/html/2610.36570#bib.bib26)\], graphic understanding\[[27](https://arxiv.org/html/2610.36570#bib.bib27)\]\) propagate intoutu\_\{t\}anddtd\_\{t\}\.

### IV\-BAdaptive Intervention

For feasible modemm, letγm​\(ξt\)∈\[0,1\]\\gamma\_\{m\}\(\\xi\_\{t\}\)\\in\[0,1\]be the empirically estimated residual\-error ratio, sop^t\(m\)=γm​\(ξt\)​p^t\\hat\{p\}\_\{t\}^\{\(m\)\}=\\gamma\_\{m\}\(\\xi\_\{t\}\)\\hat\{p\}\_\{t\}, whereξt\\xi\_\{t\}collects the step features that determine how effectivemmis \(toolztz\_\{t\}, reversibilityρt\\rho\_\{t\}, available checker\); the simulator uses one constantγm\\gamma\_\{m\}per mode\. Substituting into Eq\. \([2](https://arxiv.org/html/2610.36570#S3.E2)\) givesJ⁡\(m\)=γm​r^t\+λ​k​\(m\)\+μ​q​\(m\)J\(m\)=\\gamma\_\{m\}\\hat\{r\}\_\{t\}\+\\lambda k\(m\)\+\\mu q\(m\)\. The expected harm reduction ofmmisVm=\(1−γm\)​r^tV\_\{m\}=\(1\-\\gamma\_\{m\}\)\\hat\{r\}\_\{t\}, so, ignoring interaction cost,mmbeats direct execution whenVm\>λ​k​\(m\)V\_\{m\}\>\\lambda k\(m\)\.

Algorithm 1Consequence\-aware selective execution1:offline:

fcalf\_\{\\rm cal\}, threshold

τ^\\hat\{\\tau\}\(Eq\. \([5](https://arxiv.org/html/2610.36570#S5.E5)\)\); at step

tt:

hth\_\{t\},

ata\_\{t\}, ledger

Ht−1H\_\{t\-1\}
2:

p^t←fcal​\(ut\)\\hat\{p\}\_\{t\}\\leftarrow f\_\{\\rm cal\}\(u\_\{t\}\); estimate

c^t,ρt,gt,dt\\hat\{c\}\_\{t\},\\rho\_\{t\},g\_\{t\},d\_\{t\};

r^t←p^t​c^t\\hat\{r\}\_\{t\}\\leftarrow\\hat\{p\}\_\{t\}\\hat\{c\}\_\{t\}
3:if

gt\>τgg\_\{t\}\>\\tau\_\{g\}return\(clarify,

Ht−1H\_\{t\-1\}\)

4:if

dt\>τdd\_\{t\}\>\\tau\_\{d\}and refresh existsreturn\(verify,

Ht−1H\_\{t\-1\}\)

5:

ℳt←FeasibleModes​\(ρt,at\)\\mathcal\{M\}\_\{t\}\\leftarrow\\textsc\{FeasibleModes\}\(\\rho\_\{t\},a\_\{t\}\);if

r^t\>τ^\\hat\{r\}\_\{t\}\>\\hat\{\\tau\}: removedirect

6:

m∗←arg⁡minm∈ℳt​γm​r^t\+λ​k​\(m\)\+μ​q​\(m\)m^\{\*\}\\leftarrow\\arg\\min\_\{m\\in\\mathcal\{M\}\_\{t\}\}\\gamma\_\{m\}\\hat\{r\}\_\{t\}\+\\lambda k\(m\)\+\\mu q\(m\)
7:*optional ledger:*if

m∗=directm^\{\*\}=\\textsf\{direct\}and

Ht−1\+r¯t\>BHH\_\{t\-1\}\+\\bar\{r\}\_\{t\}\>B\_\{H\}:

m∗←Escalate​\(ρt,ℳt\)m^\{\*\}\\leftarrow\\textsc\{Escalate\}\(\\rho\_\{t\},\\mathcal\{M\}\_\{t\}\)
8:return

\(m∗,Ht−1\+r¯t1\[m∗=direct\]\)\\big\(m^\{\*\},\\;H\_\{t\-1\}\+\\bar\{r\}\_\{t\}\\,\\mathbf\{1\}\[m^\{\*\}=\\textsf\{direct\}\]\\big\)

## VSelective\-Risk Control

### V\-ADirect\-Execution Set and Finite\-Sample Threshold

LetXXbe an action record,S⁡\(X\)S\(X\)a scalar score, andL⁡\(X\)∈\[0,1\]L\(X\)\\in\[0,1\]a harmful\-loss label such asc​FcF\. For thresholdτ\\tau, the direct\-execution set isAτ=\{X:S⁡\(X\)≤τ\}A\_\{\\tau\}=\\\{X:S\(X\)\\leq\\tau\\\}, with selective riskR⁡\(τ\)=𝔼⁡\[L∣X∈Aτ\]R\(\\tau\)=\\mathbb\{E\}\[L\\mid X\\in A\_\{\\tau\}\]and coverageC⁡\(τ\)=ℙ⁡\(X∈Aτ\)C\(\\tau\)=\\mathbb\{P\}\(X\\in A\_\{\\tau\}\)\. The objective is to maximize coverage subject toR⁡\(τ\)≤ϵR\(\\tau\)\\leq\\epsilon\. Withnτn\_\{\\tau\}calibration examples inAτA\_\{\\tau\}and empirical riskR^​\(τ\)\\hat\{R\}\(\\tau\), Hoeffding’s inequality givesR⁡\(τ\)≤R^​\(τ\)\+ln⁡\(1/δ\)/\(2​nτ\)R\(\\tau\)\\leq\\hat\{R\}\(\\tau\)\+\\sqrt\{\\ln\(1/\\delta\)/\(2n\_\{\\tau\}\)\}with probability at least1−δ1\-\\deltafor a fixed threshold\. For a fixed grid ofKKthresholds, a union bound yields the selection rule

R^​\(τ\)\+ln⁡\(K/δ\)/\(2​nτ\)≤ϵ\.\\hat\{R\}\(\\tau\)\+\\sqrt\{\\ln\(K/\\delta\)/\(2n\_\{\\tau\}\)\}\\leq\\epsilon\.\(5\)
###### Proposition 1\(Selective\-risk validity\)\.

Fix the scorerSSand aKK\-element grid before the calibration records are drawn, and let the records\(Xi,Li\)\(X\_\{i\},L\_\{i\}\),Li∈\[0,1\]L\_\{i\}\\in\[0,1\], be i\.i\.d\. from the deployment distribution of proposed actions and disjoint from the data used to fitfcalf\_\{\\rm cal\}\. Then, with probability at least1−δ1\-\\delta, every grid threshold withnτ\>0n\_\{\\tau\}\>0that satisfies Eq\. \([5](https://arxiv.org/html/2610.36570#S5.E5)\) hasR⁡\(τ\)≤ϵR\(\\tau\)\\leq\\epsilon, the risk of executing all ofAτA\_\{\\tau\}directly\.

###### Proof\.

Given the membership indicators, thenτn\_\{\\tau\}losses inAτA\_\{\\tau\}are i\.i\.d\. with meanR⁡\(τ\)R\(\\tau\), so Hoeffding’s bound holds for eachτ\\tauat levelδ/K\\delta/K; a union bound covers the grid\. ∎

Scope\.\(i\) Actions in a trajectory are dependent \(exchangeability is not enough\), so calibration uses one record per trajectory\. \(ii\) The bound coversAτA\_\{\\tau\}as a whole, not a further\-selected subset, which can concentrate high\-loss actions\. To cover the deployed policy, Eq\. \([5](https://arxiv.org/html/2610.36570#S5.E5)\) is applied to the set that the complete policyπτ\\pi\_\{\\tau\}executes directly, whose indicator is a fixed function of the trajectory prefix\.

### V\-BTrajectory Ledger

An optional ledger tracksHt=∑i≤tDi​r¯iH\_\{t\}=\\sum\_\{i\\leq t\}D\_\{i\}\\bar\{r\}\_\{i\}, whereDi∈\{0,1\}D\_\{i\}\\in\\\{0,1\\\}indicates direct execution, and blocks direct execution that would exceed a budgetBHB\_\{H\}\.

###### Proposition 2\(Budgeted expected harm\)\.

Let𝒢t\\mathcal\{G\}\_\{t\}be the information available when stepttis routed, withDtD\_\{t\}andr¯t\\bar\{r\}\_\{t\}𝒢t\\mathcal\{G\}\_\{t\}\-measurable\. If𝔼⁡\[ct​Ft∣𝒢t\]≤r¯t\\mathbb\{E\}\[c\_\{t\}F\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\]\\leq\\bar\{r\}\_\{t\}wheneverDt=1D\_\{t\}=1and∑tDt​r¯t≤BH\\sum\_\{t\}D\_\{t\}\\bar\{r\}\_\{t\}\\leq B\_\{H\}almost surely, then𝔼⁡\[∑tDt​ct​Ft\]≤BH\\mathbb\{E\}\[\\sum\_\{t\}D\_\{t\}c\_\{t\}F\_\{t\}\]\\leq B\_\{H\}\.

###### Proof\.

By the tower property,𝔼⁡\[∑tDt​ct​Ft\]=𝔼⁡\[∑tDt​𝔼​\[ct​Ft∣𝒢t\]\]≤𝔼⁡\[∑tDt​r¯t\]≤BH\\mathbb\{E\}\[\\sum\_\{t\}D\_\{t\}c\_\{t\}F\_\{t\}\]=\\mathbb\{E\}\[\\sum\_\{t\}D\_\{t\}\\mathbb\{E\}\[c\_\{t\}F\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\]\]\\leq\\mathbb\{E\}\[\\sum\_\{t\}D\_\{t\}\\bar\{r\}\_\{t\}\]\\leq B\_\{H\}\. ∎

This is conditional accounting, not a reliability guarantee:r¯t\\bar\{r\}\_\{t\}must upper\-bound the true conditional harm at every step, which a calibrated point estimate does not, and the residual harm of intervened actions is outside the ledger\.

Runtime use\.Offline, the operator selects the largest gridτ^\\hat\{\\tau\}whose complete\-policy direct set satisfies Eq\. \([5](https://arxiv.org/html/2610.36570#S5.E5)\) \(S=r^S=\\hat\{r\},L=c​FL=cF\); online, a call runs directly only ifr^t≤τ^\\hat\{r\}\_\{t\}\\leq\\hat\{\\tau\}anddirectminimizesJ⁡\(m\)J\(m\)\. The main comparison usesτ^=∞\\hat\{\\tau\}=\\infty; Sec\.[VI\-E](https://arxiv.org/html/2610.36570#S6.SS5)tests the threshold rule and the ledger\.

## VIControlled Evaluation

### VI\-AProtocol

Each seed has an independent 40,000\-action calibration split and 6,000 test trajectories of 20 actions \(120,000 test actions\)\. Actions are read\-only \(58%58\\%\), reversible \(28%28\\%\), or irreversible \(14%14\\%\)\. True failure probabilities come from class\-dependent Beta distributions with a trajectory\-level difficulty perturbation, creating within\-task dependence; consequences lie mainly in\[0\.02,0\.20\]\[0\.02,0\.20\],\[0\.15,0\.70\]\[0\.15,0\.70\], and\[0\.55,1\]\[0\.55,1\]for the three classes\. The controller sees a noisy raw failure score, isotonic\-calibrated on the calibration split, and a noisy consequence estimate\.

The simulator instantiates direct, verify, sandbox, and approve with residual multipliersγm\\gamma\_\{m\}of1\.001\.00,0\.420\.42,0\.150\.15, and0\.040\.04, compute costsk⁡\(m\)k\(m\)of00,1\.01\.0,1\.61\.6, and2\.22\.2, and interaction costsq⁡\(m\)q\(m\)of00,00,0\.040\.04, and0\.650\.65\. These are assumed constants\. Direct and verify are always feasible, sandbox only for reversible mutations, and approve only for irreversible ones withc^t≥0\.55\\hat\{c\}\_\{t\}\\geq 0\.55\. Clarify is exercised only in the ambiguity stress family \(Sec\.[VI\-E](https://arxiv.org/html/2610.36570#S6.SS5)\); abstain and the staleness branch \(dtd\_\{t\},τd\\tau\_\{d\}\) are not exercised\. The cost weights keepλ:μ=0\.02:0\.015\\lambda:\\mu=0\.02:0\.015; a common factor sets the operating point\.

Comparators\.*Verify\-only gates*\(the usual scalar gates\) verify the actions ranked highest byp^\\hat\{p\}orc^\\hat\{c\}\.*Menu gates*rank byp^\\hat\{p\},c^\\hat\{c\}, orp^​c^\\hat\{p\}\\hat\{c\}and give the top\-ranked actions their strongest feasible intervention \(sandbox if reversible, approve if irreversible, otherwise verify\), so they haveCASEL’s menu\.CASELminimizesJ⁡\(m\)J\(m\)\. Ablations:CASEL\-NoRev \(verify only\),CASEL\+Budget \(λ=0\.02\\lambda=0\.02with the ledger,BH=0\.08B\_\{H\}=0\.08,r¯t=p^t​c^t\\bar\{r\}\_\{t\}=\\hat\{p\}\_\{t\}\\hat\{c\}\_\{t\}\), andCASEL\-Uncal \(raw score\)\. All of these are matched to one compute cost,0\.4860\.486\(forCASEL, cost\-weight factor0\.58±0\.020\.58\\pm 0\.02\), using scores but no outcome labels; Base, Always\-Verify, and Mutation\-Gated are fixed policies\.

Metrics\.An action routed tommfails with probabilityγm​pt\\gamma\_\{m\}p\_\{t\}, using one uniform draw per action shared by all methods \(paired outcomes\)\.*Task success*is the fraction of trajectories with no failed action; the*harmful side\-effect rate*\(HSR\) is the fraction with at least one failed action of true consequencect≥0\.45c\_\{t\}\\geq 0\.45;*mean normalized harm*\(MNH\) is the mean over trajectories of∑t=120ct​Ft\\sum\_\{t=1\}^\{20\}c\_\{t\}F\_\{t\}\. Direct coverage is the share of directly executed actions, cost the meank⁡\(m\)k\(m\)per action, and approvals the share of actions sent to human approval\. Results average 20 seeds\.

Figure 2:Isotonic calibration turns the raw failure score into a usable probability\.\(a\) ECE and \(b\) Brier score of the raw score and of the calibratedp^\\hat\{p\}on test actions\. Bars: means over 20 seeds with 95% CIs; lines: paired per\-seed values\.
### VI\-BMain Results

Isotonic calibration lowers mean ECE by94\.5%94\.5\\%and Brier score by9\.3%9\.3\\%\(Figure[2](https://arxiv.org/html/2610.36570#S6.F2)\)\.

Table 2:Controlled evaluation over 20 seeds \(task success and HSR: mean±\\pmone standard deviation\)\. All methods below Mutation\-Gated have compute cost0\.4860\.486\. Menu: interventions a method may use \(full = verify, sandbox, approve\)\.Method \(ranking\)MenuTask Success↑\\uparrowHSR↓\\downarrowMNH↓\\downarrowDirect Cov\.CostApprovals↓\\downarrowBase—±0\.4929\.48\\\!\\pm\\\!0\.49±0\.7032\.76\\\!\\pm\\\!0\.700\.428100\.0%0\.0000\.0%Always\-Verifyverify±0\.7158\.81\\\!\\pm\\\!0\.71±0\.5315\.47\\\!\\pm\\\!0\.530\.1800\.0%1\.0000\.0%Mutation\-Gatedverify±0\.6243\.78\\\!\\pm\\\!0\.62±0\.5315\.47\\\!\\pm\\\!0\.530\.19658\.0%0\.4200\.0%Uncertainty gate \(p^\\hat\{p\}\)verify±0\.5647\.78\\\!\\pm\\\!0\.56±0\.5719\.25\\\!\\pm\\\!0\.570\.23351\.4%0\.4860\.0%Consequence gate \(c^\\hat\{c\}\)verify±0\.6345\.10\\\!\\pm\\\!0\.63±0\.5315\.47\\\!\\pm\\\!0\.530\.19551\.4%0\.4860\.0%Uncertainty\-Menu \(p^\\hat\{p\}\)full±0\.6348\.79\\\!\\pm\\\!0\.63±0\.4114\.75\\\!\\pm\\\!0\.410\.18466\.9%0\.4866\.9%Consequence\-Menu \(c^\\hat\{c\}\)full±0\.5043\.54\\\!\\pm\\\!0\.50±0\.294\.38\\\!\\pm\\\!0\.290\.13674\.7%0\.48613\.8%Risk\-Menu \(p^​c^\\hat\{p\}\\hat\{c\}\)full±0\.5046\.26\\\!\\pm\\\!0\.50±0\.355\.82\\\!\\pm\\\!0\.350\.12074\.2%0\.48612\.6%CASEL\(J⁡\(m\)J\(m\)\)full±0\.5647\.01\\\!\\pm\\\!0\.56±0\.307\.02\\\!\\pm\\\!0\.300\.12369\.1%0\.4868\.7%CASEL\-NoRevverify±0\.5446\.56\\\!\\pm\\\!0\.54±0\.5215\.53\\\!\\pm\\\!0\.520\.19451\.4%0\.4860\.0%CASEL\+Budgetfull±0\.6445\.82\\\!\\pm\\\!0\.64±0\.5411\.82\\\!\\pm\\\!0\.540\.16763\.9%0\.4864\.3%CASEL\-Uncalfull±0\.5047\.83\\\!\\pm\\\!0\.50±0\.368\.22\\\!\\pm\\\!0\.360\.12969\.3%0\.4868\.4%Main result\.With the same menu and the same cost,CASELlowers HSR from14\.75%14\.75\\%for Uncertainty\-Menu to7\.02%7\.02\\%\(paired difference−7\.73\-7\.73points, 95% CI\[−7\.87,−7\.60\]\[\-7\.87,\-7\.60\]\) and MNH from0\.1840\.184to0\.1230\.123; task success is1\.791\.79points lower, because generic success weights every error equally \(Table[2](https://arxiv.org/html/2610.36570#S6.T2)\)\.

Simple consequence\-aware gates are strong\.Risk\-Menu has slightly lower HSR \(5\.82%5\.82\\%\) and MNH \(0\.1200\.120\) thanCASEL, and Consequence\-Menu the lowest HSR \(4\.38%4\.38\\%\) with higher MNH \(0\.1360\.136\) and the lowest task success\. Both send more actions to human approval:12\.6%12\.6\\%and13\.8%13\.8\\%versus8\.7%8\.7\\%\. Matched on total costλ​k\+μ​q\\lambda k\+\\mu qinstead, Risk\-Menu has HSR6\.22%6\.22\\%, MNH0\.1260\.126, and task success45\.60%45\.60\\%\(CASEL:7\.02%7\.02\\%,0\.1230\.123,47\.01%47\.01\\%\)\. The per\-mode costJ⁡\(m\)J\(m\)therefore does not reduce harm beyond a product\-score gate; it reaches similar harm with about30%30\\%fewer approvals and slightly higher task success, across the cost range \(Figure[4](https://arxiv.org/html/2610.36570#S6.F4)\(a,b\)\)\.

Figure 3:Ranking actions byp^​c^\\hat\{p\}\\hat\{c\}halves the selective\-risk AUC of uncertainty\-only ranking\.\(a\) Selective risk \(mean consequence\-weighted loss of directly executed actions\) versus coverage when actions are admitted in increasing order ofp^\\hat\{p\},c^\\hat\{c\}, orp^​c^\\hat\{p\}\\hat\{c\}; the arrow marks the largest gap\. \(b\) Per\-seed paired difference from thep^\\hat\{p\}ranking\. \(c\) Area under each curve \(average selective risk over coverage0\.10\.1–1\.01\.0\); dots are seeds\. Bands and whiskers are 95% CIs over 20 seeds\.
### VI\-CRisk–Coverage Quality

Figure[3](https://arxiv.org/html/2610.36570#S6.F3)isolates score quality from the intervention model by ranking candidate direct actions byp^\\hat\{p\},c^\\hat\{c\}, orp^​c^\\hat\{p\}\\hat\{c\}\. Averaged over coverage0\.10\.1–1\.01\.0, selective\-risk AUC is0\.010500\.01050,0\.005930\.00593, and0\.005330\.00533, respectively: the product reduces AUC by49\.2%49\.2\\%relative to uncertainty and by10\.1%10\.1\\%relative to consequence\.

Figure 4:With equal menus, consequence\-aware allocation has far lower harm than uncertainty ranking at every cost;CASELmatches a risk\-ranked gate with fewer approvals, and the trajectory budget does not help\.\(a\) HSR versus compute cost; the band marks the common cost0\.4860\.486\. \(b\) HSR versus the share of actions sent to human approval\. \(c\) Paired differences at cost0\.4860\.486,CASELminus comparator, in HSR \(red diamonds\) and task success \(blue dots\), in points;∗∗∗:p<0\.001p<0\.001, two\-sided pairedtt\-test over the 20 seeds, Holm\-corrected over the ten tests\. Bands and bars are 95% CIs\.
### VI\-DAblations

Reversibility\.RestrictingCASELto verification raises HSR from7\.02%7\.02\\%to15\.53%15\.53\\%and MNH to0\.1940\.194at the same cost: matching the intervention to commitment semantics accounts for most of the gain\.Trajectory budget\.CASEL\+Budget has HSR11\.82%11\.82\\%and MNH0\.1670\.167at the same compute cost and is dominated along its wholeBHB\_\{H\}sweep \(Figure[4](https://arxiv.org/html/2610.36570#S6.F4)\(a\)\): a full ledger escalates low\-risk actions late in a trajectory, where expected harm is small\. In the harm–approval plane it lies onCASEL’s curve \(Figure[4](https://arxiv.org/html/2610.36570#S6.F4)\(b\)\): it trades compute for approvals rather than reducing harm, so the default configuration omits the ledger\.Calibration\.Using the raw score raises HSR by1\.201\.20points and MNH by0\.0050\.005and raises task success by0\.820\.82points\. All ten differences in Figure[4](https://arxiv.org/html/2610.36570#S6.F4)\(c\) are significant \(Holm\-correctedp<10−4p<10^\{\-4\}\)\.

### VI\-EChecks of the Guarantees and Stress Tests

Threshold rule\.Per seed we keep one random step from each of 40,000 fresh calibration trajectories \(i\.i\.d\. records\) and apply Eq\. \([5](https://arxiv.org/html/2610.36570#S5.E5)\) to the deployed policy \(20\-point grid,δ=0\.1\\delta=0\.1\)\. Sweepingϵ\\epsilonover0\.0060\.006–0\.0160\.016: forϵ≥0\.015\\epsilon\\geq 0\.015the rule certifies the unrestricted policy \(coverage69\.1%69\.1\\%, true selective risk0\.00480\.0048\); atϵ=0\.014\\epsilon=0\.014it binds in all 20 seeds \(τ^=0\.014\\hat\{\\tau\}=0\.014, coverage62\.3%62\.3\\%, risk0\.00350\.0035, cost0\.5530\.553\); below, the Hoeffding slack \(≈0\.010\\approx 0\.010\) blocks certification\. With160,000160\{,\}000records the rule binds atϵ=0\.009\\epsilon=0\.009\(coverage63\.1%63\.1\\%\) and certifies88of 20 seeds at0\.0080\.008\(coverage52\.6%52\.6\\%\)\. True selective risk never exceededϵ\\epsilon\.

Ledger\.Proposition 2 is therefore an analysis of when budgeting is sound, not a guarantee of the evaluated system: forCASEL\+Budget its premise fails on54%54\\%of directly executed steps \(pt​ct\>r¯tp\_\{t\}c\_\{t\}\>\\bar\{r\}\_\{t\}\)\. Realized direct\-execution harm exceeds the budget by10%10\\%atBH=0\.04B\_\{H\}=0\.04and2%2\\%at0\.080\.08, and residual harm from intervened actions \(0\.0860\.086, about half of MNH\) is not covered\.

Ambiguity\.In10%10\\%of test actions intent is missing: with probabilityat∼U⁡\(0\.2,0\.6\)a\_\{t\}\\sim U\(0\.2,0\.6\)a correctly executed call is still wrong\. Verify and sandbox leave this error, approval halves it, and clarify \(k=0\.2k=0\.2,q=0\.3q=0\.3\) removes95%95\\%beforeJ⁡\(m\)J\(m\)routes the call\. Withgt=at\+𝒩⁡\(0,0\.082\)g\_\{t\}=a\_\{t\}\+\\mathcal\{N\}\(0,0\.08^\{2\}\)andτg=0\.2\\tau\_\{g\}=0\.2,CASELclarifies9\.8%9\.8\\%of actions \(precision94%94\\%, recall92%92\\%\) and lowers HSR from19\.1%19\.1\\%to8\.4%8\.4\\%; at equal compute cost,CASELwithoutgtg\_\{t\}has18\.5%18\.5\\%and Risk\-Menu16\.4%16\.4\\%\(7\.87\.8–12\.4%12\.4\\%forτg∈\[0\.1,0\.4\]\\tau\_\{g\}\\in\[0\.1,0\.4\]\)\.

Misspecification\.Halvingp^\\hat\{p\},c^\\hat\{c\}, or every intervention’s effectiveness raisesCASEL’s HSR to16\.6%16\.6\\%,18\.8%18\.8\\%, and21\.0%21\.0\\%, still below Uncertainty\-Menu at the same cost \(23\.4%23\.4\\%,25\.9%25\.9\\%,24\.3%24\.3\\%\) and within0\.60\.6points of Risk\-Menu: the ordering is stable, but absolute harm depends onγm\\gamma\_\{m\}and unbiased estimates\.

## VIIDeployment Considerations

Adaptation and drift\.Only the signals incbasec\_\{\\rm base\},MscopeM\_\{\\rm scope\}and the preferred high\-risk modes are domain\-specific; in optical networks, for instance, alarm correlation and root\-alarm detection\[[28](https://arxiv.org/html/2610.36570#bib.bib28)\]show how far a fault propagates and can inform the scope factor\.λ,μ\\lambda,\\muare read off the deployment’s own cost–harm frontier \(Figure[4](https://arxiv.org/html/2610.36570#S6.F4)\), andγm\\gamma\_\{m\}is estimated conservatively on trajectory\-disjoint traces\. Such gates must be recalibrated per domain: RAGScope’s gate transfers poorly across sources but recovers with 100–200 target labels\.\[[21](https://arxiv.org/html/2610.36570#bib.bib21)\]When logged calibration or residual\-risk drift leaves its tolerance region, the controller re\-selectsτ^\\hat\{\\tau\}, re\-estimatesγm\\gamma\_\{m\}, or lowersλ\\lambdaandμ\\mu\.

Integration with existing AI tooling\.CASELneeds only an interception point for tool calls \(an MCP proxy, a pre\-execution hook, or a policy engine\) and no retraining\. In network operations, robotic test\-automation platforms for optical transport and commercial O\-RUs\[[29](https://arxiv.org/html/2610.36570#bib.bib29),[30](https://arxiv.org/html/2610.36570#bib.bib30)\]automate validation runs that can back the verify and sandbox branches\. Existing tools implement the branches: an LLM judge or an execution\-grounded reward model such as BoostAPR’s repair assessors\[[31](https://arxiv.org/html/2610.36570#bib.bib31)\]forverify, Cordon forsandbox, an approval service forapprove, and SAGE\-Agent forclarify\[[13](https://arxiv.org/html/2610.36570#bib.bib13),[9](https://arxiv.org/html/2610.36570#bib.bib9)\]\.

## VIIIDiscussion and Limitations

CASELis an allocation policy, not a safety guarantee; the simulation ranks allocation rules under assumed intervention effectiveness and costs, not their effect in deployment\.

Roadmap\.Planned \(not yet run\) evaluations estimateγm\\gamma\_\{m\}from real verifier and rollback outcomes onτ2\\tau^\{2\}\-Bench, WebArena, AgentDojo, AgentAbstain, and ToolEmu\[[5](https://arxiv.org/html/2610.36570#bib.bib5),[3](https://arxiv.org/html/2610.36570#bib.bib3),[6](https://arxiv.org/html/2610.36570#bib.bib6),[10](https://arxiv.org/html/2610.36570#bib.bib10),[32](https://arxiv.org/html/2610.36570#bib.bib32)\], and on domain benchmarks such as SP\-Bench,\[[1](https://arxiv.org/html/2610.36570#bib.bib1)\]where consequence rubrics must be domain\-specific\.CASELwas not compared experimentally with REFLEX\[[22](https://arxiv.org/html/2610.36570#bib.bib22)\]or CA2I\[[23](https://arxiv.org/html/2610.36570#bib.bib23)\], which act at other levels\.

## IXConclusion

In a controlled simulation with equal menus and costs, allocating scrutiny by consequence\-weighted risk and reversibility roughly halves severe side effects relative to uncertainty ranking; a per\-mode cost matches a risk\-ranked gate with fewer approvals, and a trajectory budget did not help\.

## References

- \[1\]Y\. Yuan et al\., “SP\-Mind: An autonomous reasoning agent for spatial proteomics analysis,” in*Proc\. ICML*, 2026\. \[Online\]\. Available:https://icml\.cc/virtual/2026/poster/63717
- \[2\]L\. Xiao et al\., “A YANG\-grounded LLM agent supporting multi\-vendor OpenROADM optical transport networks,” in*Proc\. ACM SIGCOMM Conf\.*, 2026, pp\. 2109–2115, doi:10\.1145/3789240\.3822606\.
- \[3\]S\. Zhou et al\., “WebArena: A realistic web environment for building autonomous agents,” in*Proc\. ICLR*, 2024\. \[Online\]\. Available:https://iclr\.cc/virtual/2024/poster/17826
- \[4\]S\. Yao et al\., “τ\\tau\-bench: A benchmark for tool\-agent\-user interaction in real\-world domains,” in*Proc\. ICLR*, 2025\. \[Online\]\. Available:https://proceedings\.iclr\.cc/paper\_files/paper/2025/file/1b126cc38b8638e07bef37e7b2bb72bf\-Paper\-Conference\.pdf
- \[5\]V\. Barres et al\., “τ2\\tau^\{2\}\-bench: Evaluating conversational agents in a dual\-control environment,” in*Proc\. ICML*, 2026\. \[Online\]\. Available:https://icml\.cc/virtual/2026/poster/64377
- \[6\]E\. Debenedetti et al\., “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” in*Proc\. NeurIPS Datasets and Benchmarks*, 2024\. \[Online\]\. Available:https://openreview\.net/forum?id=m1YYAQjO3w
- \[7\]S\. Yao et al\., “ReAct: Synergizing reasoning and acting in language models,” in*Proc\. ICLR*, 2023\. \[Online\]\. Available:https://openreview\.net/forum?id=WE\_vluYUL\-X
- \[8\]N\. Shinn et al\., “Reflexion: Language agents with verbal reinforcement learning,” in*Proc\. NeurIPS*, 2023\. \[Online\]\. Available:https://proceedings\.neurips\.cc/paper\_files/paper/2023/hash/1b44b878bb782e6954cd888628510e90\-Abstract\-Conference\.html
- \[9\]M\. Suri et al\., “Structured uncertainty guided clarification for LLM agents,” in*Findings of ACL*, 2026\. \[Online\]\. Available:https://aclanthology\.org/2026\.findings\-acl\.2028/
- \[10\]X\. Liu et al\., “AgentAbstain: Do LLM agents know when not to act?” in*Proc\. NeurIPS*, 2026, to be published\. \[Online\]\. Available:https://agentabstain\.github\.io/
- \[11\]A\. Cuadron et al\., “SABER: Small actions, big errors—Safeguarding mutating steps in LLM agents,” arXiv preprint, 2025, doi:10\.48550/arXiv\.2512\.07850\.
- \[12\]R\. Betser et al\., “AgenTRIM: Tool risk mitigation for agentic AI,” in*Findings of EMNLP*, 2026, to be published\. \[Online\]\. Available:https://github\.com/FujitsuResearch/AgenTRIM
- \[13\]Z\. Chen et al\., “Cordon: Semantic transactions for tool\-using LLM agents,” arXiv preprint, 2026, doi:10\.48550/arXiv\.2606\.17573\.
- \[14\]C\. K\. Chow, “On optimum recognition error and reject tradeoff,”*IEEE Trans\. Inf\. Theory*, vol\. 16, no\. 1, pp\. 41–46, 1970, doi:10\.1109/TIT\.1970\.1054406\.
- \[15\]Y\. Geifman and R\. El\-Yaniv, “SelectiveNet: A deep neural network with an integrated reject option,” in*Proc\. ICML*, 2019, pp\. 2151–2159\. \[Online\]\. Available:https://proceedings\.mlr\.press/v97/geifman19a\.html
- \[16\]A\. N\. Angelopoulos et al\., “Conformal risk control,” in*Proc\. ICLR*, 2024\. \[Online\]\. Available:https://openreview\.net/forum?id=33XGfHLtZg
- \[17\]G\. Qiao et al\., “Focus\-Then\-Contact: Speeding up robotic contact\-rich task learning with affordance\-guided real\-world residual reinforcement learning,” in*Proc\. ICML*, 2026\. \[Online\]\. Available:https://icml\.cc/virtual/2026/poster/66289
- \[18\]Y\. Li et al\., “DRAFT\-RL: Multi\-agent chain\-of\-draft reasoning for reinforcement learning\-enhanced LLMs,” in*Proc\. AAAI*, 2026, pp\. 29530–29537, doi:10\.1609/aaai\.v40i35\.40195\.
- \[19\]Y\. Li et al\., “Retrieval\-augmented multi\-agent multimodal framework for fake news detection,” in*Proc\. IEEE ICASSP*, 2026\. \[Online\]\. Available:https://cmsworkshops\.com/ICASSP2026/view\_paper\.php?PaperNum=9709
- \[20\]C\. Guo et al\., “On calibration of modern neural networks,” in*Proc\. ICML*, 2017, pp\. 1321–1330\. \[Online\]\. Available:https://proceedings\.mlr\.press/v70/guo17a\.html
- \[21\]Z\. Liu et al\., “RAGScope: A leakage\-controlled, cost\-aware evidence\-gating protocol for RAG hallucination triage,” in*Proc\. IEEE ICTAI*, 2026, to be published\. \[Online\]\. Available:https://arxiv\.org/abs/2609\.39075
- \[22\]T\. Wu and W\. Y\. B\. Lim, “REFLEX with Jev for efficient selective control in LLM agents,” arXiv preprint, 2026, doi:10\.48550/arXiv\.2609\.26532\.
- \[23\]A\. Anbar Jafari et al\., “Consequence\-aware agentic AI: A pre\-execution outcome assessment framework for responsible large language model agents,” PhilArchive preprint, 2026\. \[Online\]\. Available:https://philarchive\.org/rec/JAFCAA
- \[24\]Y\. Zhang et al\., “MISO: Model\-internal\-state\-guided optimization for ranking models,” arXiv preprint, 2026, doi:10\.48550/arXiv\.2608\.07035\.
- \[25\]Y\. Li et al\., “Counterfactual rollout replay: Forkable environments as free process rewards for software engineering agents,” in*Proc\. NeurIPS*, 2026, to be published\. \[Online\]\. Available:https://www\.researchgate\.net/publication/414926561
- \[26\]Z\. Kang et al\., “LP\-DETR: Layer\-wise progressive relation for object detection,” in*Proc\. ICIC*, 2024, pp\. 144–156, doi:10\.1007/978\-981\-96\-9794\-6\_13\.
- \[27\]X\. Deng et al\., “CoVis: A collaborative framework for fine\-grained graphic visual understanding,” in*Proc\. IEEE CSCWD*, 2025, doi:10\.1109/CSCWD64889\.2025\.11033610\.
- \[28\]L\. Xiao et al\., “Joint alarm correlation and root alarm detection in optical transport networks with graph\-attention,” in*Proc\. IEEE CAMAD*, 2025, pp\. 1–6, doi:10\.1109/CAMAD67323\.2025\.11229899\.
- \[29\]L\. Xiao et al\., “Optical network robotic automation platform for multi\-vendor optical transport network: Accelerating validation, troubleshooting, and proof of concept efforts,” in*Proc\. ONDM*, 2025, pp\. 1–6, doi:10\.23919/ONDM65745\.2025\.11029373\.
- \[30\]L\. Xiao et al\., “Opening the black box: Zero\-touch conformance and security testing of commercial O\-RUs,” in*Proc\. ACM WiNTECH*, 2026, pp\. 97–104, doi:10\.1145/3831662\.3844170\.
- \[31\]Y\. Li et al\., “BoostAPR: Boosting automated program repair via execution\-grounded reinforcement learning with dual reward models,” in*Proc\. ICML*, 2026\. \[Online\]\. Available:https://github\.com/yuanhao2023/BoostAPR
- \[32\]Y\. Ruan et al\., “Identifying the risks of LM agents with an LM\-emulated sandbox,” in*Proc\. ICLR*, 2024\. \[Online\]\. Available:https://iclr\.cc/virtual/2024/poster/19037