🤖 AI Summary
Current AI agent systems lack effective runtime governance over tool usage and multi-agent behaviors, leading to a disconnect between compliance requirements and actual execution. This work proposes the SARC framework, which formalizes governance constraints as executable specifications—comprising source, category, predicate, and validation point—and embeds them as first-class objects within the agent’s operational loop. SARC enforces these constraints through a four-tier mechanism: pre-action gating, in-action monitoring, post-action auditing, and escalation routing, enabling real-time verification and enforcement before, during, and after actions, as well as along escalation pathways. In procurement task evaluations, SARC achieved zero violations of hard constraints and reduced soft constraint exceedances by 89.5%, with residual violations primarily attributable to execution stack errors rather than environmental risks, thereby demonstrating its effectiveness and traceability.
📝 Abstract
Agentic AI systems increasingly act through tools, sub-agents, and external services, but governance controls are still commonly attached to prompts, dashboards, or post-hoc documentation. This creates a structural mismatch in regulated settings: obligations that must constrain execution are often evaluated only after execution has occurred. We introduce SARC, a runtime governance architecture for tool-using agents that treats constraints as first-class specification objects alongside state, action space, and reward. A SARC specification declares each constraint's source, class, predicate, verification point, response protocol, and operating point, and compiles these into four enforcement sites in the agent loop: a Pre-Action Gate, an Action-Time Monitor, a Post-Action Auditor, and an Escalation Router. We formalize the minimal invariants required for specification-trace correspondence, show why finite reward penalties do not generally substitute for hard runtime constraints, and extend the architecture to multi-agent workflows through constraint propagation, authority intersection, and attribution-preserving trace trees. We implement a prototype audit checker and report a reproducible synthetic evaluation over 50 seeds comparing SARC against post-hoc audit, output filtering, workflow rules, and policy-as-code-only baselines on a procurement task. SARC executes zero hard-constraint violations under exact predicates; its declared PAA throttling response reduces soft-window overages by 89.5% relative to policy-as-code-only. Predicate-noise and enforcement-failure sweeps are consistent with the claim that residual hard violations under SARC scale with enforcement-stack error rather than environmental violation opportunity. SARC provides the architectural substrate through which obligations can be made executable, inspectable, and auditable at runtime.