A new arXiv paper describes a way to keep verifying whether an AI agent is still permitted to take its next action, continuously, rather than clearing it once at the outset of a task. The paper, “A Policy Algebra for Trust-Preserving Agentic AI Execution” (arXiv

.16402), was submitted August 17, 2026 by researcher Bhavesh Gadhe. Most production agent frameworks authorize a task the way a building authorizes a visitor: check the badge at the door, then let them wander every floor.

Consider a refund agent that needs to read one customer’s account, calculate what is owed, spend company money through a payment tool, ask a human when a case falls outside its authority, and leave a record of what it did. Today those checks typically live in separate systems, evaluated at different times, if they are evaluated together at all. The runtime described in the paper instead treats identity, data access, tool use, spending limits, approval requirements, and audit logging as one combined rule set, re-checked at every action the agent takes rather than once when the task begins.

The paper calls this a policy algebra. Individual security profiles and task-specific rules combine through a defined set of mathematical operations: the tightest applicable limit on data access wins, available budget narrows as it is spent, required approvals carry forward, and an evidence trail accumulates as the agent acts. The result, according to the authors, is always the least restrictive setting that still satisfies every rule in force. The same restrictions also carry across multi-agent calls, so a subagent cannot inherit a broader mandate than the original task warranted. As an open-ended job consumes more of its budget, the system steers it toward a recoverable, checkpointed result rather than letting it run until the budget simply runs out.

The authors frame their evaluation as a trade-off between reliability and capability, not as a test of raw capability, and the framing matters. Running the policy-algebra runtime, the system intervened, meaning it stopped or corrected the action, on 94.8% of events that would have violated policy. Read alone, that looks like a strong safety result. But the same runtime completed only 86.9% of tasks that were entirely legitimate, meaning roughly one in eight valid, rule-following jobs did not finish. The two figures only mean something together: near-total enforcement bought at the cost of a meaningful share of good work. The paper’s own numbers also do not separate how many of that 94.8% were fully blocked from how many were corrected mid-task and allowed to continue, a distinction that determines whether the agent still delivered useful output or simply failed differently.

The same runtime eliminated two specific failure modes the researchers tested for: cases where an agent’s effective permissions crept upward over the course of a task, and cases where an agent exhausted its full budget without producing anything recoverable. It also raised audit-trail completeness to 98.6%.

The underlying shift is architectural. Today’s agent permissions mostly get checked once, like a lock on a door: verify identity at entry, then trust whatever happens inside. This runtime behaves more like a guard who keeps watching and can intervene the moment an action strays out of bounds, wherever in the workflow that happens. That distinction matters most for agents handling money, customer data, or other actions that are hard to undo once taken.

An 86.9% completion rate on legitimate work is not a number most regulated operators would accept as shipped. A payments team whose enforcement layer misreads one in eight of its own valid refund requests as a violation would treat that as an outage, not a safety win. The paper does not state what completion rate would need to be reached before a bank or a payments processor could put this into production, and the results come from the authors’ own framework rather than an independent audit.

Teams building agents that touch money, sensitive data, or irreversible tool calls should treat the architecture, continuous authorization instead of a one-time check, as the paper’s real contribution, ahead of the specific numbers. Before adopting a similar system, ask for the false-block rate on legitimate actions broken out from the correction rate, and do not accept a combined “intervened” figure as proof the system is production-ready.

This article is based on the arXiv preprint “A Policy Algebra for Trust-Preserving Agentic AI Execution” (arXiv

.16402), submitted August 17, 2026 by researcher Bhavesh Gadhe.