From Admission to Invariants: Measuring Deviation in Delegated Agent Systems

TL;DR

This paper demonstrates the fundamental limitations of enforcement mechanisms in detecting behavioral drift in autonomous agents and introduces the Invariant Measurement Layer (IML) to overcome these limitations.

Contribution

The paper proves a theoretical impossibility for enforcement-based monitoring and proposes IML as a novel solution to detect behavioral drift at admission time.

Findings

Enforcement signals cannot fully observe behavioral deviations due to structural limitations.

IML can detect behavioral drift within 9-258 steps, outperforming enforcement triggers.

Theoretical proof of non-identifiability of admission-time behavior space under local observability.

Abstract

Autonomous agent systems are governed by enforcement mechanisms that flag hard constraint violations at runtime. The Agent Control Protocol identifies a structural limit of such systems: a correctly-functioning enforcement engine can enter a regime in which behavioral drift is invisible to it, because the enforcement signal operates below the layer where deviation is measurable. We show that enforcement-based governance is structurally unable to determine whether an agent behavior remains within the admissible behavior space A0 established at admission time. Our central result, the Non-Identifiability Theorem, proves that A0 is not in the sigma-algebra generated by the enforcement signal g under the Local Observability Assumption, which every practical enforcement system satisfies. The impossibility arises from a fundamental mismatch: g evaluates actions locally against a point-wise rule set, while A0 encodes global, trajectory-level behavioral properties set at admission time. An agent can therefore drift -- systematically shifting its behavioral distribution away from admission-time expectations -- while every individual action remains within the permitted action space. We define the Invariant Measurement Layer (IML), which bypasses this limitation by retaining direct access to the generative model of A0, restoring observability precisely in the region where enforcement is structurally blind. We prove an information-theoretic impossibility for enforcement-based monitoring and show IML detects admission-time drift with provably finite detection delay. Validated across four settings: three drift scenarios (300 and 1000 steps), a live n8n webhook pipeline, and a LangGraph StateGraph agent -- enforcement triggers zero violations while IML detects each drift type within 9-258 steps of drift onset.