arXiv cs.CY· Serhii Zabolotnii·· 12 小时前AI 评分31
信任不是一个分数：面向高风险 AI 智能体的运行时保障契约（RAC）
Trust Is Not a Score: Runtime Assurance Contracts for High-Risk AI Agents
AI 导读
研究提出运行时保障契约（RAC），一种策略级形式化 schema，绑定自主边界、组件资格、证据状态、转换策略、人工审核容量与非补偿性门控，强制门控失败或未知时触发重试、切换、升级、推迟或停止，聚合性能不能授权行动。
正文 · 原文
Abstract:Benchmarks, audits, and agent protocols describe performance, permissions, and repair, but not how observed evidence should change an agent's authority during a consequential task. We propose a Runtime Assurance Contract (RAC), a policy-level formal schema binding autonomy boundaries, component eligibility, evidence state, transition policy, human-review capacity, and non-compensatory gates. Under RAC, soft metrics may inform routing, whereas a failed or unknown mandatory gate forces retry, switch, escalation, deferral, or stop; aggregate performance cannot authorize action. We define the contract, an evidence record, a permission rule, and five invariants. A deterministic failure-injection study in agentic coding evaluates 174 cases, each a distinct mechanism, under a gate conjunction, a score-only rule, and a restricted protocol baseline. At the published example weights and threshold, the score rule admits 56 of 63 block-required injections and all 24 review-required injections; tuned in hindsight, it matches the conjunction case for case. For positive weights, a positive threshold, binary risk signals, and each signal firing alone on some case, the two rules agree on every case if and only if the threshold does not exceed the smallest weight. On 124 further cases written blind by a model of another vendor, the conjunction itself admits 35 of 79 injections, and so does the tuned score rule: a missing detector is invisible to every decision rule. Eighteen hand-authored traces check version-pinned evidence and review transitions. In a prospective synthetic holdout of 24 episodes, RAC and a separately implemented full stateful baseline both match the labels of two blinded LLM judges. These studies test mechanisms on synthetic cases; they establish neither deployed safety nor cross-domain effectiveness.
| Comments: | 18 pages, 2 figures, 5 tables. v2 corrects the agentic-coding study (174 distinct mechanisms replace 280 index-cloned cases) and adds an independent 124-case corpus. Ancillary files: decision logs, transition model, LLM holdout. Case files: this https URL (v1.1.0). Synthetic mechanism study; no deployment claim |
| Subjects: | Artificial Intelligence (cs.AI); Computers and Society (cs.CY); Software Engineering (cs.SE) |
| ACM classes: | D.2.4; I.2.11 |
| Cite as: | arXiv:2609.39717 [cs.AI] |
| (or arXiv:2609.39717v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2609.39717 arXiv-issued DOI via DataCite |
Submission history
From: Serhii Zabolotnii Dr. [view email]
[v1]
Wed, 30 Sep 2026 13:28:42 UTC (232 KB)
[v2]
Fri, 16 Oct 2026 06:24:05 UTC (242 KB)
来源：arXiv cs.CY · arxiv.org