The paper's finding in CS6 — "agents reported task completion while the underlying system state contradicted those reports" — identifies what is arguably the hardest failure mode to detect in autonomous agent systems: the agent lies, and nobody has a mechanism to verify it.
Logs don't solve this because the agent writes the logs. Runtime monitoring doesn't solve it because it's reactive — the action already happened. Guardrails don't solve it because they constrain what the agent can do, not what it actually did.
The structural gap
The paper documents failures across authorization (CS2–3), resource consumption (CS4–5), identity (CS7–8), and integrity (CS6, CS10). What's common across all of them is the absence of a cryptographic binding between what was authorized and what was executed.
If every agent action required two signatures — one locking the authorization scope before execution, one locking the actual outcome after execution — and those two were hash-chained so any mismatch breaks the chain, then:
- CS6 (false completion reports): the post-execution signature would reflect the actual system state. if the agent claims "done" but the system contradicts it, the hash chain breaks and verifiers see the divergence.
- CS2–3 (unauthorized compliance): the pre-execution signature would bind the authorized identity. an agent complying with a non-owner would produce a receipt with no valid authorization chain.
- CS4–5 (unbounded resource consumption): each action in the chain would carry a receipt. anomalous volume becomes visible as a receipt count spike without corresponding authorization depth.
- CS10 (external constitution injection): the pre-execution receipt would bind to the original policy. if the policy mutates via an external artifact, the receipt chain diverges from the expected authorization baseline.
Implementation
We built this as Nobulex — two Ed25519 signatures per agent action, hash-chained via JCS/RFC 8785. Auditors verify offline without trusting the agent runtime. The bilateral receipt primitive was merged into Microsoft's Agent Governance Toolkit (PRs #1302, #1333), and 9 independent implementations validated byte-identical output.
This isn't a complete solution to the problems the paper raises — incentive structures and emergent multi-agent dynamics require additional work — but it addresses the verification gap: how do you prove what an agent did after the fact, without trusting the agent's own account?
MIT licensed, open source: https://github.com/arian-gogani/nobulex
Happy to discuss how this maps to specific case studies or how it could integrate with the OpenClaw architecture.
The paper's finding in CS6 — "agents reported task completion while the underlying system state contradicted those reports" — identifies what is arguably the hardest failure mode to detect in autonomous agent systems: the agent lies, and nobody has a mechanism to verify it.
Logs don't solve this because the agent writes the logs. Runtime monitoring doesn't solve it because it's reactive — the action already happened. Guardrails don't solve it because they constrain what the agent can do, not what it actually did.
The structural gap
The paper documents failures across authorization (CS2–3), resource consumption (CS4–5), identity (CS7–8), and integrity (CS6, CS10). What's common across all of them is the absence of a cryptographic binding between what was authorized and what was executed.
If every agent action required two signatures — one locking the authorization scope before execution, one locking the actual outcome after execution — and those two were hash-chained so any mismatch breaks the chain, then:
Implementation
We built this as Nobulex — two Ed25519 signatures per agent action, hash-chained via JCS/RFC 8785. Auditors verify offline without trusting the agent runtime. The bilateral receipt primitive was merged into Microsoft's Agent Governance Toolkit (PRs #1302, #1333), and 9 independent implementations validated byte-identical output.
This isn't a complete solution to the problems the paper raises — incentive structures and emergent multi-agent dynamics require additional work — but it addresses the verification gap: how do you prove what an agent did after the fact, without trusting the agent's own account?
MIT licensed, open source: https://github.com/arian-gogani/nobulex
Happy to discuss how this maps to specific case studies or how it could integrate with the OpenClaw architecture.