arXiv preprint, June 2026
Anuj Kaul, Qianlong Lan, Pranay Gupta
Research into runtime governance for autonomous agents. AgentBound evaluates proposed agent actions against delegated authority, behavioural policies, and environmental constraints before execution.
As agents take on consequential work — financial transactions, external communication, enterprise workflows — the question stops being whether a model can produce a good answer and becomes whether a particular action should be executed at all: on whose authority, and under what conditions.
Existing agent infrastructure authenticates workloads and controls resource access through identity federation and delegated authorization. That establishes whether an action is permitted in principle. It does not establish whether an authorised action should execute given the current behavioural and operational context.
AgentBound is a runtime governance framework that evaluates each proposed action against three independent authorities — delegated authorization, owner-signed behavioural constitutions, and site action contracts — and composes their judgments conservatively into a decision to permit, review, or deny before execution.
For accountability, it produces cryptographically verifiable governance receipts that bind an action to the exact delegation, policy, and semantic artifacts that governed it, so decisions can be independently replayed and verified. The paper also introduces standing delegation for long-running agents, and AgentBound-Bench, a benchmark for evaluating governance correctness, authority composition, and accountability.
AgentBound is not a substitute for model alignment. It is a deterministic layer between authorization and execution — an attempt to turn governance from something that must be trusted into something that can be checked.
arXiv:2606.30970 — a preprint. It has not been peer-reviewed.
We are studying the internal structure of models rather than only their outputs: how concepts are represented, how information moves through a network, and how those mechanisms give rise to behaviour. The goal is practical — systems that can be understood and evaluated, not only observed.
Reliability over a long horizon is a different problem from accuracy on a single step. We are interested in how errors compound across a task, which failures are detectable from inside the system, and what recovery looks like when a step goes wrong.
Extending the AgentBound line of work: how authority is delegated and represented, how policies compose when several apply at once, and how governance decisions remain fast enough to sit in the execution path.
Tools turn generated text into consequences. We are studying how to scope tool access, how to make irreversible actions distinguishable from reversible ones, and how agents should behave when a tool returns something unexpected or untrusted.
An approval gate is only useful if the person at it can actually evaluate what they are approving. We are studying how to present agent work for review, when to interrupt, and how to keep human oversight meaningful rather than ceremonial.
Benchmarks built around single responses say little about an agent that works for a day. We are developing evaluation methods for long-horizon work, including how to attribute an outcome to a step and how to capture structured human feedback at scale.
Most of what makes work correct inside an organisation is undocumented: exceptions, precedents, who decides. We are studying how systems can accumulate that context over time, keep it current, and apply it without hardening early mistakes into policy.
“We are interested in research that becomes more rigorous through deployment and products that become more trustworthy through research.”
Applied work has a way of exposing which questions actually matter. A system running against real information, real exceptions, and real consequences will surface the failure modes that a benchmark never does — and those failures are where the interesting research questions tend to live.
The relationship runs both ways. Understanding how a system represents information, where its reasoning degrades, and what it does when constrained is what makes it responsible to deploy at all. We publish what we believe is useful to others working on the same problems, and we are explicit about what remains open.
We are interested in conversations with researchers, and in hearing from engineers who want to work where research and deployment meet.