The Irreversibility Budget: Fleet-Level Risk Accounting and Admission Control for Agent Operating Systems

# The Irreversibility Budget: Fleet-Level Risk Accounting and Admission Control for Agent Operating Systems
Source: [https://arxiv.org/html/2609.00275](https://arxiv.org/html/2609.00275)
Conference:Agentic OS Workshop, SOSP 2026; September 29, 2026; Prague, CzechiaBardia Mohammadiemail:[bmohammadi@mpi\-sws\.org](mailto:[email protected])Affiliation:Max Planck Institute for Software Systems,Saarbrücken,GermanyLaurent Bindschaedleremail:[bindsch@mpi\-sws\.org](mailto:[email protected])Affiliation:Max Planck Institute for Software Systems,Saarbrücken,Germany

© none

###### Abstract\.

Fleets of LLM agents now externalize effects that cannot be fully undone: they move money, deploy code, delete data, and disclose information\. Current controls check one effect at a time, so a fleet of individually authorized agents can overdraw its principal’s risk under a shared trigger while every local gate stays correct\. We propose the*irreversibility budget*, a cumulative account of residual value\-at\-risk that a trusted runtime maintains for each principal across agents, workflows, and tenants\. Treating irreversibility as a first\-class resource, the runtime charges each effect its residual loss below the agent and denies the marginal effect once the aggregate would overdraw the budget\. Getting the price right is hard, because effects are heterogeneous, adversarially declared, and correlated\. We perform a controlled study in which per\-effect gates admit fleet\-level overdraws of up to48×48\\timesthe tenant’s risk limit while the budget holds every correctly charged run within that limit\. Conservative, dependency\-aware pricing remains the central open problem for a deployable design\.

## 1\.Introduction

Fleets of LLM agents now call tools, update durable state, and externalize effects whose consequences may not be fully reversible\. They move money, deploy code, delete data, and disclose information\. Managing scarce or dangerous shared quantities is the classic job of an operating system, which measures memory, CPU time, and I/O bandwidth, allocates them to principals, charges them at use, and defends them under contention\. Agent operating systems are only beginning to emerge\([Packer et al\., 2023](https://arxiv.org/html/2609.00275#bib.bib13);[Mei et al\., 2025](https://arxiv.org/html/2609.00275#bib.bib14)\), but any of them will inherit this job for a quantity today’s runtimes leave unmanaged: the irreversible exposure a fleet creates in the outside world\. Unlike memory, it is a residual loss that depends on the effect, its compensation, and how other agents are spending at the same time\.

Existing controls do not manage this quantity\. They answer local questions: one defers settlement, another validates a task’s authority, a third prices a review, and a fourth insures an individual action\([Mohammadi et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib1);[Chen et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib2);[Madras et al\., 2018](https://arxiv.org/html/2609.00275#bib.bib10);[Mozannar and Sontag, 2020](https://arxiv.org/html/2609.00275#bib.bib11);[Chen, 2026](https://arxiv.org/html/2609.00275#bib.bib17);[Xu et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib8);[Hua et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib18)\)\. None keeps a running balance across agents\. Consider, for example, fifty individually capped procurement agents that all watch the same supplier price spike and, each acting rationally, decide to buy at once\. Every purchase clears its local cap, yet together they commit a seven\-figure position no reviewer approved\. Each action is allowed, but the fleet overdraws\. Accounting for this before commit is hard: effects differ in how much loss survives them, an agent can misdeclare or split an effect to slip under a cap, and a shared trigger correlates losses that a naive account would simply add up\.

We propose the*irreversibility budget*, a cumulative account of residual value\-at\-risk that a trusted runtime maintains for every*principal*: an agent, the workflow it runs in, or the tenant that owns them\. The key idea is to treat irreversibility as a first\-class resource, the way an operating system treats memory: a trusted runtime below the agent charges each effect the loss expected to survive recovery, adds it to one running balance per principal, and then denies or escalates the next effect once that balance would exceed the authorized budget\. This meets the three difficulties in turn: pricing residual loss rather than face value handles heterogeneity, charging below the agent stops a compromised model from misdeclaring or splitting an effect to slip under a cap, and a single shared balance turns a correlated burst into a visible overdraw that no per\-effect gate can see\. The outcome is that existing per\-effect controls stop being independent gates and become spending policies over one shared resource\. Realizing it takes a resource model that defines the quantity and the budgets it is charged against, plus a runtime that prices and reserves against them, both shown on the procurement example in Figure[1](https://arxiv.org/html/2609.00275#acmlabel1)\.

We evaluate the abstraction with a controlled simulation of this procurement fleet, a study of public agent traces, and a ledger microbenchmark\. The results support the claim and mark its limit\. Local gates approve every purchase, yet the fleet overdraws its risk limit by2\.4×2\.4\\timeson average, and by48×48\\timesonce it has grown to a thousand agents\. The budget holds every run within the limit at every size, and because it prices effects by type it admits more useful work than a flat cap at the same safety\. Its weakness is pricing: when effect types are misdeclared, or a shared trigger correlates losses that the charges assumed independent, realized loss can still exceed what the ledger accounted for\. The ledger itself is cheap\. Making those charges conservative and dependency\-aware is the open problem\.

The paper makes three contributions: irreversible exposure as a typed, cumulative admission quantity for agent operating systems \(§[3](https://arxiv.org/html/2609.00275#S3)\), a trusted runtime that combines risk\-typed effects, hierarchical reserve\-confirm\-cancel ledgers, and value\-at\-risk admission control \(§[4](https://arxiv.org/html/2609.00275#S4)\), and a controlled feasibility study that isolates the fleet\-level composition failure and shows dependency\-aware pricing to be the central open requirement \(§[5](https://arxiv.org/html/2609.00275#S5)\)\.

![Three-zone diagram. Left: fifty agent icons connected to one shared trigger labeled price spike, each proposing a purchase. Center: a trusted runtime at the commit boundary prices each effect by residual loss and charges it to a shared budget ledger, drawn as a bar filling toward a red limit line, denying the effect that would cross it. Right: outcome bars showing local gates exceeding the limit by 2.4 times while the budget stays within it.](https://arxiv.org/html/2609.00275v1/figures/IB_Figure.png)Figure 1\.The irreversibility budget on the running example\. Fifty procurement agents share one trigger and each proposes a locally authorized purchase \(left\)\. A trusted runtime prices each effect by its residual loss and charges it against one shared ledger, denying the marginal effect once the aggregate would exceed the tenant’s limit \(center\)\. Per\-effect gates overdraw by2\.4×2\.4\\times, the budget stays within the limit \(right\)\.Three\-zone diagram\. Left: fifty agent icons connected to one shared trigger labeled price spike, each proposing a purchase\. Center: a trusted runtime at the commit boundary prices each effect by residual loss and charges it to a shared budget ledger, drawn as a bar filling toward a red limit line, denying the effect that would cross it\. Right: outcome bars showing local gates exceeding the limit by 2\.4 times while the budget stays within it\.
## 2\.Background and Motivation

#### A running example

We make the procurement fleet concrete and reuse it throughout\. Each of the fifty agents owns one product line and may place supplier orders up to $50k under a per\-agent rate limit, and the tenant tolerates $250k of unhedged exposure over a trading day\. On an ordinary day the agents buy independently and stay well inside that envelope\. However, imagine a shared trigger where a supplier price\-spike alert makes “buy now” rational for every agent at once\. These are the parameters simulated by the evaluation in §[5](https://arxiv.org/html/2609.00275#S5)\.

#### Why it generalizes

This failure is not special to procurement\. It appears wherever agents change the outside world: payroll runs, infrastructure automation, data deletion, customer communication, and incident response\. Operators in these settings already cap scarce or risky quantities with quotas, approval limits, and desk\-level risk controls, precisely because local permission has never implied aggregate safety\. Agent fleets revive that pressure at higher speed and with weaker principal boundaries, which turns the operator’s question from whether an action is allowed into how much irreversible exposure remains before the next commit\.

#### Why counting is not enough

Answering that question means pricing effects rather than counting them\. In the example, a canceled draft order, a completed supplier order, and a signed long\-term contract carry very different residual loss once compensation, recovery, and revocation are exhausted\. A control that treats every effect as one unit is therefore unsafe if it undercounts the irreversible ones and unusably conservative if it treats them all as maximal\. Reversibility is a coordinate in the price rather than a binary gate\.

#### The gap

Existing systems act one effect at a time\. Table[1](https://arxiv.org/html/2609.00275#S2.T1)lists the closest: Atomix defers settlement until it is safe\([Mohammadi et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib1)\), Cordon validates a task’s authority before release\([Chen et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib2)\), actuarial gates such as AAI quote and bind capital for a single trajectory\([Chen, 2026](https://arxiv.org/html/2609.00275#bib.bib17)\), guardrails and DLP validate payloads\([OWASP Gen AI Security Project, Agentic Security Initiative, 2025](https://arxiv.org/html/2609.00275#bib.bib15)\), and sagas supply compensation paths\([Garcia\-Molina and Salem, 1987](https://arxiv.org/html/2609.00275#bib.bib3);[Helland, 2007](https://arxiv.org/html/2609.00275#bib.bib4)\)\. Each answers its local question well, and none keeps the cumulative, cross\-agent balance that would have caught the fleet in the example\. The missing mechanism is a pre\-commit account that spans agents, workflows, and tenants\.

Table 1\.Existing mechanisms control local effects or domain\-specific counters, but none maintains a heterogeneous cross\-agent exposure account\.
#### Three requirements

The pre\-commit account faces three difficulties, and each rules out a simpler design\. Heterogeneous effects rule out a face\-value collective cap, which charges a canceled draft and a signed contract alike and is safe only when it is uselessly conservative\. Adversarial agents rule out trusting declared charges, because a compromised tool can split one large order into many sub\-cap orders or misdeclare the effect type that sets the charge\. Shared drivers rule out summing independent charges, since one price\-spike alert or prompt injection makes many agents choose the same irreversible effect\. A deployable control must therefore account before commit, canonicalize types, and price dependence\.

## 3\.Resource Model

§[2](https://arxiv.org/html/2609.00275#S2)argued that a fleet needs a pre\-commit account that prices effects, spans principals, and treats correlated exposures as more than a sum\. This section defines that account as a resource\. There are three parts: the charge on an effect, the budget a principal spends against, and the risk\-pressure signal that drives admission\.

#### Irreversible exposure

For an external effectee, define its chargec⁡\(e\)c\(e\)as the residual loss over a configured horizon after available compensation, recovery, and revocation have been applied\. Effect outcomes are stochastic, so the runtime charges at a confidence level:cγ​\(e\)c\_\{\\gamma\}\(e\)is theγ\\gamma\-quantile of the residual\-loss distribution supplied by the pricing component\. The charge is a scalar in a financial domain, or a vector when money, data loss, availability, and legal exposure cannot be reduced to a common unit\. Reversibility\([Garcia\-Molina and Salem, 1987](https://arxiv.org/html/2609.00275#bib.bib3)\)enters the price as one coordinate among several rather than acting as a binary gate\.

#### Irreversibility budget

Each principalppis assigned a windowed budgetBpB\_\{p\}, and the runtime maintains a balance of reserved plus committed exposure against it\. The invariant is simple: a principal may not externalize an effect when the marginal charge would exceed its budget at the required confidence level\. In the running example, each of the fifty agents spends against its own allocation, its workflow’s, and the tenant’s $250k envelope, so no agent’s local freedom can overdraw the fleet’s ceiling\. Budgets are replenished on a horizon set by the budget authority: short windows bound bursts, longer windows bound campaigns\.

#### Risk pressure

We call the depletion signal*risk pressure*, the analog of memory pressure: as a kernel reclaims pages and throttles when free memory runs low, the runtime tightens admission as the free budget falls and, in the extreme, freezes externalization \(§[4](https://arxiv.org/html/2609.00275#S4)\)\. Risk pressure is a scheduling signal rather than a proof of safety, turning a fixed per\-call verdict into a control loop over a scarce quantity\.

## 4\.The Runtime

The resource model says what to charge, and the runtime is the machinery that charges it\. Its jobs are to make an effect’s exposure observable before the effect commits, to stop a fleet from double\-spending one budget, and to decide admission when the budget runs low\. The mechanisms below meet these jobs, each an existing primitive moved below the agent’s trust boundary, so a compromised model can neither price nor quietly spend its own risk\.

#### Risk\-typed effects

To make exposure observable before commit, tool specifications declare effect classes, exposure bounds, reversibility paths, compensation mechanisms, authority requirements, and dependency hints\. Existing taxonomies of reversible, compensatable, and irreversible effects provide the initial type structure\([Garcia\-Molina and Salem, 1987](https://arxiv.org/html/2609.00275#bib.bib3)\)\. Pricing sits below the agent, so chargescγ​\(e\)c\_\{\\gamma\}\(e\)come from specifications and a trusted pricing service, never from the model; the charge itself is only as trusted as the specification author and its auditor\. Many domains already encode partial versions of this information in approval rules, cloud quotas, and retention policies, and the runtime makes those implicit controls executable at the commit boundary\.

#### Canonicalization

A charge is only as sound as the type it is read from, so the runtime assigns that type itself rather than accepting one from the caller\. A trusted registry binds each effect class to the evidence that identifies it: the calling tool’s identity and signed specification, the API endpoint and request schema the call resolves to, and the settlement receipt that later confirms what actually happened\. A compromised workflow can therefore propose a final transfer, but it cannot declare that transfer refundable, because it never supplies the label\. What the registry cannot resolve is charged at the most expensive matching class, so an unrecognized effect is throttled rather than silently admitted\. The trusted base is wider than the ledger: the registry and its auditors, the tool wrappers, the pricing service, and principal attribution\.

#### Charge lifecycle

Charges are initialized from the conservative bound in the effect specification, calibrated offline by replaying traces and stress cases against realized residual loss, and audited against settlement receipts, which are the only ground truth about how much recovery actually returned\. They are adjusted when the pricer detects a dependency, either a correlation class declared on a workflow or a shared trigger inferred from the proposal stream, so the marginal charge for the next effect in that class rises instead of repeating the independent price\. §[5](https://arxiv.org/html/2609.00275#S5)breaks both the binding and the calibration, and reports what each is worth\.

#### Hierarchical ledgers and reservations

Per\-principal ledgers expose nativereserve,confirm, andcancelcalls that keep a fleet from double\-spending one risk envelope: speculative branches reserve before acting, confirm on commit, and refund on cancellation or successful compensation\([O’Neil, 1986](https://arxiv.org/html/2609.00275#bib.bib5);[Helland, 2007](https://arxiv.org/html/2609.00275#bib.bib4)\)\. Admission checks every ledger on the effect’s principal path and reserves atomically across them\. Algorithm[1](https://arxiv.org/html/2609.00275#alg1)gives the reserve procedure\. The ledger must guarantee four invariants: no overdraft, idempotent confirmation, crash recovery, and hierarchical roll\-up\.

Algorithm 1Value\-at\-risk admission \(reserve\)\.1:input:effect

ee, principal path

PP\(agent

→\\toworkflow

→\\totenant\)

2:

c←pricer\.charge​\(e,context,γ\)c\\leftarrow\\textsc\{pricer\.charge\}\(e,\\ \\text\{context\},\\ \\gamma\)⊳\\trianglerightcharge, never from the agent

3:atomically

4:for allledger

ℓ∈P\\ell\\in Pdo

5:if

ℓ\.reserved\+ℓ\.committed\+c\>ℓ\.B\\ell\.\\text\{reserved\}\+\\ell\.\\text\{committed\}\+c\>\\ell\.Bthenreturndeny

6:endif

7:endfor

8:for allledger

ℓ∈P\\ell\\in Pdo

ℓ\.reserved\+=c\\ell\.\\text\{reserved\}\\mathrel\{\+\}=c
9:endfor

10:returnreservation id⊳\\trianglerightconfirmcommits it;cancelrefunds it

#### Admission and scheduling under risk pressure

*Value\-at\-risk admission control*is the rule: an effect commits only if reserved and committed exposure stay within allocation at every principal on the agent\-to\-workflow\-to\-tenant path\. As risk pressure rises, the runtime tightens confidence, demotes low\-value spenders, expires stale reservations, batches approvals, or escalates to a rate\-limited authority with explicit latency and capacity budgets\. Escalation does not raiseBB\. Instead, the authority mints a separate audited exception allocation and charges the effect against that, so the principal’s ordinary budget is untouched and the extra exposure is recorded as approved rather than as headroom, because approved exposure is risk a principal chose to take, whereas the failure mode is risk the ledger failed to stop\. Delegation treats*capabilities as risk currency*: attenuable tokens denominated in risk units that an agent must spend rather than merely present\. Schedulers already trade fairness, priority, and utilization under scarcity; here the scarce quantity is irreversible exposure, and denial happens before the effect commits\.

#### The contract

The ledger guarantee is narrow\. It prevents overdraft in*declared charge units*, under four assumptions: authenticated principals, strongly consistent budget authorities, idempotent reservation lifecycles, and charges supplied by trusted effect specifications\. It does not guarantee bounded realized loss under stale prices, correlations absent from the charge model, malicious type declarations, or misattributed workflows\. The design therefore exposes two layers of guarantee: a*declared\-charge bound*that the ledger enforces unconditionally, and a*realized\-loss bound*that depends on calibrated, dependency\-aware pricing\.

## 5\.Evaluation

We evaluate the runtime design as a controlled feasibility study rather than a deployed agent OS\. Five research questions organize it: whether per\-effect safety fails under composition and a budgeted ledger can bound exposure before commit \(RQ1\), whether the need for accounting persists under fleet growth, fragmentation, and reactive alternatives \(RQ2\), what liveness and scheduling costs the budget introduces \(RQ3\), when risk typing and calibration help and when they fail \(RQ4\), and whether public agent traces support the shared\-trigger correlation the simulation assumes \(RQ5\)\.

#### Workload

The main workload is a discrete\-event procurement simulation of the running example, and Table[2](https://arxiv.org/html/2609.00275#S5.T2)lists its parameters\. Routine demand typically fills roughly 85% of the budget, a correlated market trigger raises every agent’s proposal probability for 50 ticks, and an executed purchase of valuevvrealizes residual exposurev⁡\(1−r\)v\(1\-r\)\. Charges come from declared effect types, and only the ledger microbenchmark models admission latency\.

#### Baselines

The*local\-gates*baseline enforces a per\-call cap and per\-agent rate limit with no shared state, and the*budget*runtime reserves the 95th\-percentile chargec0\.95​\(e\)=0\.52​vc\_\{0\.95\}\(e\)=0\.52\\,vand denies any effect whose charge would push the reserved balance pastBB\. We also run the strongest aggregate alternatives an operator would use: face\-value and pooled\-quantile caps, static per\-agent partitions, a reactive circuit breaker, and hierarchical sub\-budgets\.

#### Metrics and protocol

A run*overdraws*when realized exposure that no authority approved exceedsRRin any window, so overdraw measures what the ledger let through silently\. We also report realized exposure relative toRR, admitted routine and burst traffic, attacker value moved, sibling\-workflow throughput, and reservation latency\. Results are means over 300 seeded runs with 95% confidence intervals and Wilson intervals for overdraw proportions\. We release the simulator, seeds, parameters, benchmark, and trace analysis at[https://github\.com/mpi\-dsg/irreversibility\-budget](https://github.com/mpi-dsg/irreversibility-budget)\.

#### Ledger overhead

The ledger microbenchmark measures the reservation lifecycle in isolation rather than an integrated runtime, on a single host, in memory, with no persistence, replication, or crash recovery\. A reserve\-then\-confirm across a three\-level agent\-workflow\-tenant path costs2\.6​μ2\.6\\,\\mus at the median and 240 bytes per live reservation, and a shared tenant root under 32 concurrent threads sustains a few×105\\times 10^\{5\}reservation cycles per second\. This number bounds the accounting work rather than the cost of a durable budget authority, which must add a log write on every spend and, across hosts, a round of coordination on any violating spend\.

Table 2\.Simulation parameters\.
### 5\.1\.Composition \(RQ1\)

We ask whether per\-effect safety composes to the fleet\. Every proposal stays within its per\-call cap and rate limit, so the only difference between arms is whether admission also checks an aggregate budget\.

#### Results

Figure[2](https://arxiv.org/html/2609.00275#acmlabel2)contrasts the two arms\. Local gates approve every purchase and still overdraw in all 300 runs, at2\.4×2\.4\\timestolerance on average, while the budget overdraws in none of them, with a 95% upper bound of 1\.3% on overdraw probability, and settles near0\.48×0\.48\\timestolerance\. The gap is structural rather than a tuning artifact: no per\-call gate can see the running sum, so none can deny the marginal purchase that tips the fleet over\. The budget’s0\.48×0\.48\\timesoccupancy is simply the arithmetic of a full ledger whose realized exposure concentrates near the mean\-to\-quantile ratio0\.25/0\.520\.25/0\.52ofBB\.

Figure 2\.Realized aggregate exposure as a fraction of toleranceRR, with and without a colluding fragmentation attack\. Bars are means over 300 runs; ticks mark the 95th percentile\. Local gates approve every action and overdraw in every run\. The budget bounds exposure belowRRin both settings\.Horizontal bar chart of realized aggregate exposure relative to tolerance for four configurations; local gates exceed tolerance, budget stays below it\.

### 5\.2\.Scale and alternatives \(RQ2\)

We ask whether the gap grows, and whether cheaper alternatives close it\. We holdRRfixed and grow the fleet from ten to a thousand agents, then add two variants: a fragmentation attack that splits one economic action into many sub\-cap ones, and a circuit breaker that halts the fleet once observed loss reachesRR\.

#### Results

The overdraw grows with the fleet\. Local gates are safe at ten agents but reach2\.4×2\.4\\timestolerance at fifty,9\.7×9\.7\\timesat two hundred, and48×48\\timesat a thousand, because aggregate demand scales while each agent individually stays compliant\. The budget holds near0\.48×0\.48\\timesat every size\. The alternatives fail for instructive reasons\. Fragmentation slips the full $1\.5M transfer past local gates to3\.9×3\.9\\timestolerance, yet the ledger admits only $459k of that value, however finely the attacker splits it, because the charge attaches to exposure rather than to call count\. The circuit breaker ends at1\.03×R1\.03\\times Rwith instant observation and2\.2×R2\.2\\times Rat a fifty\-tick lag, because it reads loss only after the irreversible effect has already committed\.

#### Takeaway

The gap widens with scale, and only a control that reserves before commit, rather than counting calls or reacting to loss, stays safe as the fleet grows\.

### 5\.3\.Liveness \(RQ3\)

Safety by denial is easy to state and easy to abuse, so we ask what the budget costs in useful work\. We sweep the budget sizeB/RB/R\. Separately, four scheduling arms stress hoarding, sibling isolation, campaign pacing, and re\-authorization\.

#### Results

Figure[3](https://arxiv.org/html/2609.00275#acmlabel3)shows the trade\-off\. A budget ofB=RB=Rpasses routine pre\-burst traffic in full and admits 14% of the correlated burst, and evenB=R/2B=R/2preserves 93% of routine traffic, so the price of safety falls mostly on the burst rather than on ordinary work\. The sharper cost is temporal: once the window’s budget is spent, post\-burst traffic starves until replenishment\. Enlarging the budget buys burst headroom but reintroduces overdraw, up to 33% of runs atB=2​RB=2R, so the knob is real but not free\. Table[3](https://arxiv.org/html/2609.00275#S5.T3)shows the scheduling arms recovering most of the lost liveness: fair\-share admission curbs hoarding, per\-workflow ledgers lift an innocent sibling’s throughput from 48% to 89%, and rate\-limited re\-authorization restores post\-burst liveness to 93% while making the extra $75k of exposure audited rather than silent\.

#### Takeaway

The budget trades burst liveness for safety on a tunable knob, and per\-workflow ledgers plus paced re\-authorization recover most of it without hiding exposure\.

Figure 3\.Safety and liveness against budget sizeB/RB/R\(300 runs; error bars are 95% Wilson intervals on the overdraw proportion\)\. Larger budgets admit more burst traffic and, past1\.5​R1\.5R, increase overdraw risk\.Line chart of overdraw probability, routine traffic executed, and burst admitted as budget size grows\.Table 3\.Four secondary arms: the budget’s scheduling policies and liveness stress tests, 300 runs each\.

### 5\.4\.Typing and pricing \(RQ4\)

The ledger enforces only declared charges, so we ask whether typing effects by residual loss beats flat counting, and how charge errors actually fail\. We scale declared charges by a factorε\\varepsilonaround the true quantile, compare a typed ledger against face\-value and pooled caps on a mixed refundable\-and\-final workload, and then break the charges’ independence assumption with a burst that depresses recovery\.

#### Results

Figure[4](https://arxiv.org/html/2609.00275#acmlabel4)shows that mispricing is asymmetric\. Underpricing fails silently, overdrawing in 32% of runs already at half the true charge, whereas overpricing fails only as throttling \(ε=4\\varepsilon=4executes 5% of proposed value\), a failure the scheduler can see and correct; charges should therefore fail conservatively\. When charges are right, typing pays: the typed ledger executes1\.8×1\.8\\timesthe value of a face\-value cap and1\.7×1\.7\\timesthe strongest pooled cap, a gain that tracks heterogeneity and shrinks to1\.2×1\.2\\timesas effect classes converge\. Two failures bound that result\. Misdeclaring colluding transfers as refundable re\-opens the cap to $1\.0M and overdraws in 77% of runs, and a shared trigger that depresses recovery from0\.750\.75to0\.250\.25makes additive per\-effect charging overdraw in 59% of runs while the ledger believes itself safe\. Repricing at the burst quantile fixes the latter only with near\-instant detection: a five\-tick lag in a fifty\-tick burst still overdraws 39% of runs, and a ten\-tick lag is no better than no detector at all\.

#### Takeaway

Typing buys real utility when charges are honest, but misdeclaration and correlated recovery let realized loss outrun the ledger’s belief, which makes conservative, dependency\-aware pricing the central open requirement\.

Figure 4\.Mispricing sensitivity: declared charges scaled byε\\varepsilonrelative to the 95th\-percentile charge \(300 runs; error bars are 95% Wilson intervals\)\. Underpricing fails toward silent overdraw; overpricing toward throttling\.Line chart of overdraw probability and executed value as declared charges are scaled below and above the true quantile\.

### 5\.5\.Trace evidence \(RQ5\)

The whole model rests on shared triggers correlating losses, which the simulator cannot justify on its own, so we test it against real behavior\. We analyzed 38,452 trajectories from the publicτ\\tau\-bench\([Yao et al\., 2025](https://arxiv.org/html/2609.00275#bib.bib21)\)and AgentDojo\([Debenedetti et al\., 2024](https://arxiv.org/html/2609.00275#bib.bib12)\)benchmarks and asked whether irreversible effects are agent\-idiosyncratic or task\-determined\. Inτ\\tau\-bench we read the 165 tasks with at least three trials as fleets of independent agents meeting the same context, and compare their agreement against a permutation null that breaks the task\-to\-effect link while preserving each effect’s marginal rate\. In AgentDojo the runs sharing one planted prompt injection, a single instruction placed in a shared resource and met by agents running different user tasks, are the fleet; we report the 35 injections with at least 20 runs\. A fixed vocabulary map tags pay, refund, delete, update, send, and create as external effects, and marks a prefix read\-only only when every call in it unambiguously is\.

#### Results

External effects account for 22% of tool calls, and a single agent’s effects are typically sparse and end\-loaded, so no agent bursts on its own\. The correlation lives across agents: which external effect fires is task\-determined rather than agent\-specific \(zzup to198198against an independent\-agent null\), and one planted instruction propagates the same external effect across 84% of a heterogeneous fleet on average \(minimum 48%\)\. This is precisely the structure the additive charges in RQ4 fail to price\.

#### Takeaway

Real traces confirm that shared context drives correlated external effects, so the regime the budget targets is the common case\.

## 6\.Discussion and Limitations

#### Limitations

The study establishes the accounting mechanism rather than a deployed system\. It does not show that value\-at\-risk is the right risk measure, that calibration is solved, or that distributed ledgers stay available under partition, and it does not exercise the full reserve\-confirm\-cancel lifecycle, capability delegation, vector charges, or refunds\. Two biases follow: liveness cost is measured pessimistically because refunds are absent, and safety is measured optimistically because prices are constructed rather than learned\. These failures define the contract a deployable budget must meet: trusted effect typing, dependency\-aware charging, workflow\-level attribution, and denial before commit\.

*Pricing and budget setting\.*The budget is only as sound as its charges and as useful as the authority’s choice ofBB\. A business tolerance does not directly define a charge budget, and larger budgets trade liveness for weaker realized\-loss bounds\. Vector budgets may be needed when losses are not commensurable, since data exposure, availability damage, and reputational harm resist a common scalar in a way money does not\. We use value\-at\-risk because operators know it and it is cheap to simulate, but the abstraction does not require it, and value\-at\-risk is not subadditive while expected shortfall is coherent\([Artzner et al\., 1999](https://arxiv.org/html/2609.00275#bib.bib16)\)\. Charges should fail conservatively, so mispricing escalates rather than silently admits\.

*Correlation\.*The tractable middle ground between independent charges and worst\-case coupling remains open: correlation classes declared per workflow, shared\-trigger detection from proposal streams, and marginal charges under an explicit dependency model\. Detection must run early enough to affect admission before most of the burst’s exposure commits\.

*Distributed accounting\.*A budget that can be double\-spent provides telemetry rather than control\. Across hosts, hard budgets require coordination on any violating spend, while advisory budgets reconcile later and cannot enforce safety\. The runtime should separate the two, shard by principal hierarchy, and report the availability cost of strong budget authorities\.

*Adversarial spenders\.*Prompt\-injected or colluding agents can fragment actions below thresholds, hoard reservations, misdeclare types, or manipulate refunds\([Debenedetti et al\., 2024](https://arxiv.org/html/2609.00275#bib.bib12);[OWASP Gen AI Security Project, Agentic Security Initiative, 2025](https://arxiv.org/html/2609.00275#bib.bib15)\)\. Canonicalization must therefore span agents and workflows, because the shared budget itself becomes the target, and re\-authorization must be rate\-limited and audited rather than an unlimited human escape hatch\. Our bonded\-recourse design settles the compensations themselves\([Bindschaedler et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib24)\)\.

*Liveness\.*A budget converts some unsafe commits into denial, contention, and auditable re\-authorization\. It can hold the bound and still starve routine work after a burst, or let an attacker convert theft into reservation denial\-of\-service\. Reservation expiry, workflow sub\-budgets, fair\-share admission, replenishment horizons, and authority overrides are scheduling policy\.

## 7\.Related Work

This work combines existing mechanisms from database transactions, OS resource accounting, financial risk control, and agent safety\. The novelty is their use together as a cross\-principal admission resource for typed, heterogeneous, adversarial agent effects\.

#### Database and OS primitives\.

Database escrow\([O’Neil, 1986](https://arxiv.org/html/2609.00275#bib.bib5)\)and saga compensation\([Garcia\-Molina and Salem, 1987](https://arxiv.org/html/2609.00275#bib.bib3);[Helland, 2007](https://arxiv.org/html/2609.00275#bib.bib4)\)supply the reserve\-confirm\-cancel lifecycle, resource containers\([Banga et al\., 1999](https://arxiv.org/html/2609.00275#bib.bib19)\)supply the move of charging a principal rather than a process, and coordination avoidance\([Hellerstein and Alvaro, 2020](https://arxiv.org/html/2609.00275#bib.bib6);[Bailis et al\., 2014](https://arxiv.org/html/2609.00275#bib.bib7)\)separates invariant\-preserving local updates from updates that require agreement\. We apply these primitives to risk units at the tool\-commit boundary, where the runtime must be able to deny before an external effect settles\.

#### Agent effect controls\.

The mechanisms summarized in Table[1](https://arxiv.org/html/2609.00275#S2.T1)protect individual effects or branches by controlling settlement time, semantic authority, or payload validity\([Mohammadi et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib1);[Chen et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib2);[OWASP Gen AI Security Project, Agentic Security Initiative, 2025](https://arxiv.org/html/2609.00275#bib.bib15)\)\. Our group’s vision papers argue for OS\-level confinement of exploratory effects\([Hu et al\., 2026b](https://arxiv.org/html/2609.00275#bib.bib22)\)and for checking effects instead of trusting code\([Hu et al\., 2026a](https://arxiv.org/html/2609.00275#bib.bib23)\); the budget adds what these lack: cumulative accounting across agents, workflows, and tenants\.

#### Risk pricing and safe learning\.

Settlement and underwriting systems price or compensate single actions and trajectories\([Hua et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib18);[Xu et al\., 2026](https://arxiv.org/html/2609.00275#bib.bib8)\)\. Constrained and safe reinforcement learning caps cumulative safety cost inside one agent’s policy optimization\([Achiam et al\., 2017](https://arxiv.org/html/2609.00275#bib.bib20)\)\. Single\-agent actuarial admission gates price actions and defend against fragmentation within a trajectory\([Chen, 2026](https://arxiv.org/html/2609.00275#bib.bib17)\)\. Our setting moves pricing below untrusted agents and aggregates across principals, so collusion and shared drivers naturally become first\-order concerns\.

#### Governance and operational caps\.

A governance proposal already names an*irreversibility budget*, but treats it as an additive cap with human re\-authorization\([Sahoo, 2026](https://arxiv.org/html/2609.00275#bib.bib9)\)\. Additivity suits sparse, human\-supervised settings rather than dense fleets with fragmentation, misdeclaration, and correlated recoverability\. Credit\-card limits, cloud quotas, and pre\-trade checks cap one known unit, whereas agent fleets need typed residual\-loss accounting\. The budget also differs from access control, which decides whether an action is allowed: the budget denies an allowed action because the aggregate would overdraw, a claim no per\-call mechanism expresses\.

## 8\.Conclusion

No runtime tracks the irreversible exposure that fleets of tool\-using agents build up together\. We proposed the irreversibility budget, a cumulative per\-principal account that a trusted runtime charges before commit, denying an effect once the fleet would overdraw\. Local gates approved every action and still overdrew by up to48×48\\times, while the budget held every correctly charged run within the risk limit\. Conservative, dependency\-aware pricing remains open, but irreversibility as a first\-class resource gives agent operating systems a place to account for it\.

## References

- Achiamet al\.\(2017\)J\. Achiam, D\. Held, A\. Tamar, and P\. AbbeelConstrained policy optimization\.InProceedings of the 34th International Conference on Machine Learning \(ICML 2017\),D\. Precup and Y\. W\. Teh \(Eds\.\),Proceedings of Machine Learning Research, Vol\.70,Sydney, Australia,pp\. 22–31\.External Links:[Link](https://proceedings.mlr.press/v70/achiam17a.html)Cited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px3.p1.1)\.
- Artzneret al\.\(1999\)P\. Artzner, F\. Delbaen, J\. Eber, and D\. HeathCoherent measures of risk\.Mathematical Finance9\(3\),pp\. 203–228\.External Links:[Document](https://dx.doi.org/10.1111/1467-9965.00068)Cited by:[§6](https://arxiv.org/html/2609.00275#S6.SS0.SSS0.Px1.p2.1)\.
- Bailiset al\.\(2014\)P\. Bailis, A\. D\. Fekete, M\. J\. Franklin, A\. Ghodsi, J\. M\. Hellerstein, and I\. StoicaCoordination avoidance in database systems\.Proceedings of the VLDB Endowment8\(3\),pp\. 185–196\.External Links:[Document](https://dx.doi.org/10.14778/2735508.2735509)Cited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px1.p1.1)\.
- Bangaet al\.\(1999\)G\. Banga, P\. Druschel, and J\. C\. MogulResource containers: a new facility for resource management in server systems\.InProceedings of the Third USENIX Symposium on Operating Systems Design and Implementation \(OSDI ’99\),New Orleans, LA, USA,pp\. 45–58\.External Links:[Link](https://www.usenix.org/conference/osdi-99/resource-containers-new-facility-resource-management-server-systems)Cited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px1.p1.1)\.
- Bindschaedleret al\.\(2026\)L\. Bindschaedler, Q\. Botha, and C\. SiebenbrunnerBonded recourse for smart\-contract settlement of compensable agent side effects\.InProceedings of the 8th International Conference on Blockchain Computing and Applications \(BCCA 2026\),Barcelona, Spain\.Note:To appearCited by:[§6](https://arxiv.org/html/2609.00275#S6.SS0.SSS0.Px1.p5.1)\.
- Chen \(2026\)H\. ChenInsuring every action: an authority frontier framework for runtime actuarial control of autonomous AI agents\.External Links:2605\.25632,[Document](https://dx.doi.org/10.48550/arXiv.2605.25632),[Link](https://arxiv.org/abs/2605.25632)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1),[§2](https://arxiv.org/html/2609.00275#S2.SS0.SSS0.Px4.p1.1),[Table 1](https://arxiv.org/html/2609.00275#S2.T1.4.4.1.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px3.p1.1)\.
- Chenet al\.\(2026\)Z\. Chen, H\. Liu, D\. Xu, D\. Dong, J\. Li, B\. Pu, and J\. ZhaiCordon: semantic transactions for tool\-using LLM agents\.External Links:2606\.17573,[Document](https://dx.doi.org/10.48550/arXiv.2606.17573),[Link](https://arxiv.org/abs/2606.17573)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1),[§2](https://arxiv.org/html/2609.00275#S2.SS0.SSS0.Px4.p1.1),[Table 1](https://arxiv.org/html/2609.00275#S2.T1.4.3.1.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px2.p1.1)\.
- Debenedettiet al\.\(2024\)E\. Debenedetti, J\. Zhang, M\. Balunović, L\. Beurer\-Kellner, M\. Fischer, and F\. TramèrAgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS 2024\),Vol\.37,Vancouver, Canada,pp\. 82895–82920\.Note:Datasets and Benchmarks TrackExternal Links:[Document](https://dx.doi.org/10.52202/079017-2636)Cited by:[§5\.5](https://arxiv.org/html/2609.00275#S5.SS5.p1.1),[§6](https://arxiv.org/html/2609.00275#S6.SS0.SSS0.Px1.p5.1)\.
- Garcia\-Molina and Salem \(1987\)H\. Garcia\-Molina and K\. SalemSagas\.InProceedings of the 1987 ACM SIGMOD International Conference on Management of Data \(SIGMOD ’87\),New York, NY, USA,pp\. 249–259\.External Links:[Document](https://dx.doi.org/10.1145/38713.38742)Cited by:[§2](https://arxiv.org/html/2609.00275#S2.SS0.SSS0.Px4.p1.1),[Table 1](https://arxiv.org/html/2609.00275#S2.T1.4.6.1.1),[§3](https://arxiv.org/html/2609.00275#S3.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2609.00275#S4.SS0.SSS0.Px1.p1.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px1.p1.1)\.
- Helland \(2007\)P\. HellandLife beyond distributed transactions: an apostate’s opinion\.InProceedings of the Third Biennial Conference on Innovative Data Systems Research \(CIDR 2007\),Asilomar, CA, USA,pp\. 132–141\.External Links:[Link](https://www.cidrdb.org/cidr2007/papers/cidr07p15.pdf)Cited by:[§2](https://arxiv.org/html/2609.00275#S2.SS0.SSS0.Px4.p1.1),[Table 1](https://arxiv.org/html/2609.00275#S2.T1.4.6.1.1),[§4](https://arxiv.org/html/2609.00275#S4.SS0.SSS0.Px4.p1.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px1.p1.1)\.
- Hellerstein and Alvaro \(2020\)J\. M\. Hellerstein and P\. AlvaroKeeping CALM: when distributed consistency is easy\.Communications of the ACM63\(9\),pp\. 72–81\.External Links:[Document](https://dx.doi.org/10.1145/3369736)Cited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px1.p1.1)\.
- Huet al\.\(2026a\)J\. Hu, A\. Goel, and L\. BindschaedlerDon’t trust the code, check its effects\.InProceedings of the 5th Workshop on Practical Adoption Challenges of ML for Systems \(PACMI 2026\),Note:To appearCited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px2.p1.1)\.
- Huet al\.\(2026b\)J\. Hu, B\. Mohammadi, A\. Goel, and L\. BindschaedlerExternalization barriers: an OS abstraction for untrusted agent exploration\.InThe 2nd Workshop on OS Design for AI Agents \(AgenticOS 2026\),Prague, Czech Republic\.Note:To appearCited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px2.p1.1)\.
- Huaet al\.\(2026\)W\. Hua, T\. Peng, C\. Wang, J\. Pei, I\. Kaufman, B\. Lim, and C\. FangQuantifying trust: financial risk management for trustworthy AI agents\.External Links:2604\.03976,[Document](https://dx.doi.org/10.48550/arXiv.2604.03976),[Link](https://arxiv.org/abs/2604.03976)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px3.p1.1)\.
- Madraset al\.\(2018\)D\. Madras, T\. Pitassi, and R\. S\. ZemelPredict responsibly: improving fairness and accuracy by learning to defer\.InAdvances in Neural Information Processing Systems 31 \(NeurIPS 2018\),Vol\.31,Montreal, Canada,pp\. 6150–6160\.Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1)\.
- Meiet al\.\(2025\)K\. Mei, X\. Zhu, W\. Xu, M\. Jin, W\. Hua, Z\. Li, S\. Xu, R\. Ye, Y\. Ge, and Y\. ZhangAIOS: LLM agent operating system\.InSecond Conference on Language Modeling \(COLM 2025\),Montreal, Canada\.Note:Also available as arXiv:2403\.16971External Links:[Link](https://openreview.net/forum?id=L4HHkCDz2x)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p1.1)\.
- Mohammadiet al\.\(2026\)B\. Mohammadi, N\. Potamitis, L\. H\. Klein, A\. Arora, and L\. BindschaedlerAtomix: timely, transactional tool use for reliable agentic workflows\.InICLR 2026 Workshop on Agents in the Wild: Safety, Security, and Beyond \(AIWILD\),Rio de Janeiro, Brazil\.Note:Also available as arXiv:2602\.14849 \[cs\.LG\]External Links:[Link](https://openreview.net/forum?id=UeRbEpSVUz)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1),[§2](https://arxiv.org/html/2609.00275#S2.SS0.SSS0.Px4.p1.1),[Table 1](https://arxiv.org/html/2609.00275#S2.T1.4.2.1.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px2.p1.1)\.
- Mozannar and Sontag \(2020\)H\. Mozannar and D\. SontagConsistent estimators for learning to defer to an expert\.InProceedings of the 37th International Conference on Machine Learning \(ICML 2020\),H\. Daumé III and A\. Singh \(Eds\.\),Proceedings of Machine Learning Research, Vol\.119,Virtual Event,pp\. 7076–7087\.External Links:[Link](https://proceedings.mlr.press/v119/mozannar20b.html)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1)\.
- OWASP Gen AI Security Project, Agentic Security Initiative \(2025\)OWASP Gen AI Security Project, Agentic Security InitiativeAgentic AI \- threats and mitigations\.Note:White paper, version 1\.1Version 1\.1, February 2025External Links:[Link](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)Cited by:[§2](https://arxiv.org/html/2609.00275#S2.SS0.SSS0.Px4.p1.1),[Table 1](https://arxiv.org/html/2609.00275#S2.T1.4.5.1.1),[§6](https://arxiv.org/html/2609.00275#S6.SS0.SSS0.Px1.p5.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px2.p1.1)\.
- O’Neil \(1986\)P\. E\. O’NeilThe Escrow transactional method\.ACM Transactions on Database Systems11\(4\),pp\. 405–430\.External Links:[Document](https://dx.doi.org/10.1145/7239.7265)Cited by:[§4](https://arxiv.org/html/2609.00275#S4.SS0.SSS0.Px4.p1.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px1.p1.1)\.
- Packeret al\.\(2023\)C\. Packer, S\. Wooders, K\. Lin, V\. Fang, S\. G\. Patil, I\. Stoica, and J\. E\. GonzalezMemGPT: towards LLMs as operating systems\.External Links:2310\.08560,[Document](https://dx.doi.org/10.48550/arXiv.2310.08560),[Link](https://arxiv.org/abs/2310.08560)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p1.1)\.
- Sahoo \(2026\)S\. SahooThe controllability trap: a governance framework for military AI agents\.InICLR 2026 Workshop on Agents in the Wild: Safety, Security, and Beyond \(AIWILD\),Rio de Janeiro, Brazil\.Note:Also available as arXiv:2603\.03515 \[cs\.CY\]External Links:[Link](https://openreview.net/forum?id=yLkGf4Uw14)Cited by:[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px4.p1.1)\.
- Xuet al\.\(2026\)B\. Xu, X\. Dai, F\. Yang, and K\. ZhangWhen agent automation becomes profitable: quantifying and insuring autonomous AI risk through trace\-economic underwriting\.External Links:2606\.16465,[Document](https://dx.doi.org/10.48550/arXiv.2606.16465),[Link](https://arxiv.org/abs/2606.16465)Cited by:[§1](https://arxiv.org/html/2609.00275#S1.p2.1),[§7](https://arxiv.org/html/2609.00275#S7.SS0.SSS0.Px3.p1.1)\.
- Yaoet al\.\(2025\)S\. Yao, N\. Shinn, P\. Razavi, and K\. Narasimhanτ\\tau\-bench: a benchmark for tool\-agent\-user interaction in real\-world domains\.InThe Thirteenth International Conference on Learning Representations \(ICLR 2025\),Virtual Event\.Note:Also available as arXiv:2406\.12045External Links:[Link](https://openreview.net/forum?id=roNSXZpUDN)Cited by:[§5\.5](https://arxiv.org/html/2609.00275#S5.SS5.p1.1)\.