an-approval-gate-holds-only-under-complete-mediation CLM-0022Gating irreversible actions works only if the harness mediates every side effect, not only the branch awaiting approval. Where a gate suspends its own branch while a sibling's effect still executes, the control reads as a barrier and is not one — and the shipped implementations in widely used agent frameworks have this gap rather than it being a misconfiguration.
Evidence for: Ashby's law of requisite variety (holds)
Capability: Prioritizing safety under conflicting goals · Agentic, Security
Observed on
2026, six open-source agent frameworks.
Applies when
- Effect on the capability:
- helps, narrowly
- Needs:
- a harness that sees every side effect
- Fails when:
- The harness suspends only the branch awaiting approval while a sibling's side effect executes. Shipped frameworks have this gap, so the gate reads as a barrier and is not one.
Sources
- supportsStop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control PrimitivesDifferential probes found the sibling leak in every framework shipping a pre-execution gate (five of six, across four execution models and two language runtimes), plus replay double-execution, cancellation orphans and timeout zombies. Live models leaked 215 of 1,200 runs. An environment-external admission gate enforcing complete mediation blocked every measured violation with no legitimate refusals, which isolates mediation as the property doing the work.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.Following instructions hidden in data · reviewed by AI
- In a hierarchical multi-agent system where a controller gates acceptance of worker outputs on semantic entropy and semantic density computed over resampled completions, the intervention helps only where failures come from semantic instability (vague or contradictory outputs) and hurts where they come from evidence selection or reasoning-chain errors \u2014 gaining on ambiguity/hallucination-prone benchmarks while losing 10-14 points on multi-hop QA.Getting more from several models than from one · reviewed by AI
- For long-horizon LLM agents in environments where an erroneous action changes world state, restoring an earlier checkpoint and carrying forward a structured reflection memory that excludes branch-local state claims beats either intervention alone, because reflection alone cannot undo environmental damage and rollback alone re-explores the same failure.Completing tasks that take many steps or many hours · reviewed by AI
Notes
This is the sharpest kind of efficacy claim in the catalog: not "does the technique help" but "does the implementation have the property the technique's value depends on." The mechanism is old — complete mediation is a 1970s access-control requirement — and the finding is that agent frameworks reimplemented gates without it. The framework counts are perishable; the mediation requirement is not.