Cordon: Semantic Transactions for Tool-Using LLM Agents

2026-06-16

AI Summary

Current tool-augmented large language model agents lack task-level execution boundaries, making it difficult to ensure atomicity and traceability in multi-step workflows. This work proposes a semantic transaction mechanism that introduces task-level transactions as isolation boundaries through a runtime system, unifying the management of tool intentions, state transitions, external effects, and audit metadata. The mechanism executes reversible operations within a shadow state, buffers irreversible actions in an effect outbox, and records metadata necessary for recovery. Experimental results demonstrate that this approach effectively detects cross-step violations missed by existing defenses, significantly reduces the failure rate of irreversible operations, and maintains high task completion rates with minimal approval overhead and latency.

Abstract

Tool-using LLM agents are shifting the unit of computation from explicit human-issued commands to model-driven tasks with stateful consequences. Yet today's agent runtimes still expose tools as isolated RPCs. This interface gives runtimes a convenient integration point, but it lacks a task-scoped execution boundary for commit, rollback, recovery, and audit across multi-step agent workflows. We argue that this mismatch calls for a runtime containment boundary rather than another per-call guardrail. This paper introduces Cordon, a transactional runtime system for staging and validating irreversible agent effects before commit. A semantic transaction is a task-level execution boundary that binds tool intents and runtime-tracked result lineage to reversible local state, staged external effects, delegated authority, and audit metadata. Cordon implements this abstraction with a transaction manager that tracks derived result objects, executes reversible mutations in shadow state, stages outward-facing actions in an effect outbox, and records recovery metadata. The runtime then validates the composed execution flow before it commits state or releases external effects. Our evaluation across adversarial and benign workflows shows that Cordon exposes cross-step violations missed by existing defenses. It also reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.

Problem

• tool-using LLM agents
• semantic transactions
• runtime containment
• irreversible effects
• multi-step workflows

Innovation

• semantic transactions
• tool-using LLM agents
• transactional runtime
• effect staging
• audit and recovery