Trustworthy Agentic AI Requires Deterministic Architectural Boundaries

2026-02-10

AI Summary

Current agent-based AI architectures struggle to meet the stringent safety and knowledge reliability demands of high-stakes scientific workflows due to the absence of deterministic mechanisms for separating instructions from data. This work proposes Trinity Defense Architecture—the first deterministic architecture for agent AI—integrating three core mechanisms: action governance via finite-action calculus, information flow control through mandatory access labels, and privilege separation via perception-execution isolation. Together, these ensure secure compartmentalization and trustworthy control, while unforgeable provenance techniques guarantee system integrity. The study demonstrates that training alone cannot resolve authorization vulnerabilities stemming from the “deadly triad” of autonomy, capability, and connectivity, thereby establishing the necessity and efficacy of architectural-level mediation in high-risk AI deployments.

Technology Category

• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness
• Multiagent Systems: Agent/AI Theories and Architectures
• Cognitive Modeling & Cognitive Systems: Agent Architectures

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

Current agentic AI architectures are fundamentally incompatible with the security and epistemological requirements of high-stakes scientific workflows. The problem is not inadequate alignment or insufficient guardrails, it is architectural: autoregressive language models process all tokens uniformly, making deterministic command--data separation unattainable through training alone. We argue that deterministic, architectural enforcement, not probabilistic learned behavior, is a necessary condition for trustworthy AI-assisted science. We introduce the Trinity Defense Architecture, which enforces security through three mechanisms: action governance via a finite action calculus with reference-monitor enforcement, information-flow control via mandatory access labels preventing cross-scope leakage, and privilege separation isolating perception from execution. We show that without unforgeable provenance and deterministic mediation, the ``Lethal Trifecta''(untrusted inputs, privileged data access, external action capability) turns authorization security into an exploit-discovery problem: training-based defenses may reduce empirical attack rates but cannot provide deterministic guarantees. The ML community must recognize that alignment is insufficient for authorization security, and that architectural mediation is required before agentic AI can be safely deployed in consequential scientific domains.

Problem

• agentic AI
• architectural boundaries
• deterministic security
• authorization
• scientific workflows

Innovation

• deterministic architecture
• action governance
• information-flow control
• privilege separation
• Trinity Defense Architecture