\pdfoutput=1
\documentclass[11pt,a4paper]{article}

% Required packages - ordered for arXiv compatibility
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{lmodern}  % Latin Modern fonts for better PDF output
\usepackage[margin=1in]{geometry}
\usepackage{amsfonts}
\usepackage{amsmath}
\usepackage{nicefrac}
\usepackage[protrusion=true,expansion=false]{microtype}
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{float}
\usepackage{listings}
\usepackage{xcolor}
\usepackage{enumitem}
\usepackage{natbib}  % For citations (plainnat style)
\usepackage{hyperref}
\usepackage{url}

% Hyperref setup
\hypersetup{
    colorlinks=true,
    linkcolor=blue,
    citecolor=blue,
    urlcolor=blue
}

% Code listing style
\lstset{
    basicstyle=\ttfamily\small,
    breaklines=true,
    frame=single,
    backgroundcolor=\color{gray!10}
}

% Keywords command
\providecommand{\keywords}[1]{\textbf{Keywords:} #1}

% Title and Author (arXiv-compatible format)
\title{Agent Control Plane: A Deterministic Kernel for Zero-Violation Governance in Agentic AI\thanks{Large language models were used to assist with grammar and formatting. All technical claims, experimental results, and intellectual contributions are original work by the authors.}}

\author{Imran Siddique\\
Principal Group Engineering Manager, Microsoft\\
\texttt{imran.siddique@microsoft.com}
}

\date{}

\begin{document}
\maketitle

\begin{abstract}
Modern AI agents capable of executing real-world actions---querying databases, calling APIs, writing files---face a critical reliability gap: their stochastic nature makes safety guarantees elusive, and prompt-based guardrails fail under adversarial conditions. We introduce the \textbf{Agent Control Plane (ACP)}, a kernel-inspired middleware layer that enforces deterministic governance through attribute-based access control (ABAC), multi-dimensional constraint graphs, and shadow mode simulation.

Unlike advisory systems that merely suggest safe behavior, ACP interposes between agent intent and action execution, achieving \textbf{0.00\% safety violations} on a 60-prompt red-team benchmark spanning direct attacks, prompt injections, and contextual confusion---with zero false positives. Our key insight, ``Scale by Subtraction,'' replaces verbose LLM-generated refusals with deterministic \texttt{NULL} responses, yielding a \textbf{98.1\% token reduction} while eliminating information leakage about blocked actions.

Ablation studies with statistical rigor (Welch's t-test, Bonferroni correction) confirm component necessity: removing the \textit{PolicyEngine} increases violations from 0\% to 40.0\% ($p < 0.0001$, Cohen's $d = 8.7$). We demonstrate production readiness through integrations with OpenAI function calling, LangChain agents, and multi-agent orchestration. Code is available at \url{https://github.com/imran-siddique/agent-control-plane}.
\end{abstract}

\keywords{Agentic AI \and AI Safety \and Deterministic Governance \and Access Control \and Kernel Architecture \and Multi-Agent Systems}

\section{Introduction}
\label{sec:introduction}

\subsection{The Agent Safety Crisis}
The deployment of autonomous AI agents in enterprise environments has accelerated dramatically. Agents are no longer passive chat interfaces; they are active entities capable of executing consequential real-world actions: querying production databases, calling external APIs, modifying file systems, and orchestrating multi-step workflows~\citep{deloitte2025orchestration}. Yet, this capability introduces a fundamental tension: the very stochasticity that makes large language models (LLMs) creative and flexible also makes them unpredictable and inherently unsafe for critical operations.

Recent incidents highlight the severity of relying on probabilistic safety mechanisms:
\begin{itemize}[nosep]
    \item \textbf{Jailbreak vulnerabilities}: Adversarial prompts routinely bypass safety training. Techniques like ``DAN'' (Do Anything Now) and role-playing exploits achieve success rates exceeding 80\% on supposedly aligned models~\citep{wei2023jailbroken,zou2023universal}.
    \item \textbf{Prompt injection attacks}: Malicious instructions embedded in retrieved documents or user inputs can hijack agent behavior, causing unintended data exfiltration or destructive actions~\citep{greshake2023not}.
    \item \textbf{Capability overhang}: Agents granted broad permissions ``just in case'' often retain access to sensitive operations they should never execute, violating the principle of least privilege.
\end{itemize}

\subsection{``Vibes'' Are Not Engineering}
Current mitigation strategies---prompt-based guardrails, output filtering, and advisory systems---share a fatal flaw: they treat safety as a \textit{suggestion} rather than an \textit{invariant}. They rely on ``vibes''---asking the model to ``please be helpful and harmless.'' In distributed systems, we do not ask a microservice to ``please respect rate limits''; we enforce them at the gateway. We do not ask a database query to ``please not drop tables''; we enforce permissions via ACLs.

Using prompt engineering to secure an agent is akin to asking a CPU to ``please not access kernel memory.'' It is an architectural category error. To build reliable agentic systems, we must move from \textit{prompt engineering} to \textit{systems engineering}. For complementary self-correction mechanisms, see our concurrent preprint~\citep{selfcorrecting2026}.

\subsection{The Solution: A Deterministic Kernel}
We propose the \textbf{Agent Control Plane (ACP)}, a kernel-inspired architecture that mediates all access to resources. Just as an operating system kernel enforces memory protection regardless of a user program's intent, ACP enforces action-level governance regardless of an agent's reasoning.

Our design is grounded in three core philosophies:
\begin{enumerate}[nosep]
    \item \textbf{Deterministic over Stochastic}: Safety decisions must be binary (allow/deny). A database query is either permitted or blocked; there is no ``85\% safe.'' This eliminates the ambiguity adversaries exploit in probabilistic filtering.
    \item \textbf{Action-Level over Content-Level}: We govern what agents \textit{do}, not just what they \textit{say}. An agent may generate text describing a \texttt{DROP TABLE} operation, but the ACP kernel prevents the command from ever reaching the execution engine.
    \item \textbf{Scale by Subtraction}: Traditional refusal mechanisms (``I'm sorry, I cannot do that...'') leak information about security boundaries and waste tokens. ACP's \textbf{MuteAgent} component returns deterministic \texttt{NULL} responses for blocked actions. This approach removes the variable of ``creativity'' from safety enforcement, resulting in 98.1\% greater efficiency and zero information leakage.
\end{enumerate}

\subsection{Contributions}
We make the following contributions:
\begin{enumerate}[nosep]
    \item A \textbf{kernel-inspired architecture} for agent governance that achieves 0.00\% safety violations with zero false positives.
    \item \textbf{Multi-dimensional constraint graphs} that prevent contextual confusion attacks through simultaneous data, policy, and temporal validation.
    \item The \textbf{MuteAgent} component implementing ``Scale by Subtraction'' for 98.1\% token efficiency gains.
    \item \textbf{Comprehensive ablation studies} with statistical rigor demonstrating component necessity.
    \item \textbf{Production-ready integrations} with OpenAI, LangChain, and multi-agent frameworks.
\end{enumerate}

\section{Related Work}
\label{sec:related}

\subsection{Guardrail Systems}
Several systems attempt to add safety layers to LLM applications. \textbf{Guardrails AI}~\citep{guardrailsai2023} provides output validation through schema enforcement and semantic checks. \textbf{NeMo Guardrails}~\citep{nvidia2023nemo} uses dialog management to steer conversations away from harmful topics. \textbf{Llama Guard}~\citep{inan2023llamaguard} fine-tunes a classifier to detect unsafe content. However, all three operate at the \textit{content level}---they filter what agents say, not what they do. An agent could generate safe-sounding text while executing dangerous actions.

\subsection{Agent Frameworks}
Modern agent frameworks like \textbf{LangChain}~\citep{langchain2022}, \textbf{AutoGPT}~\citep{autogpt2023}, \textbf{AutoGen}~\citep{autogen2023}, and \textbf{CrewAI}~\citep{crewai2024} provide powerful orchestration capabilities but delegate safety to the underlying LLM or optional middleware. None implement deterministic action-level governance as a first-class primitive.

\subsection{Agent Safety Evaluation}
Recent benchmarks have emerged for evaluating agent safety. \textbf{AgentBench}~\citep{agentbench2024} provides a multi-dimensional benchmark for evaluating LLMs as agents across diverse environments. \textbf{WildGuard}~\citep{wildguard2024} evaluates guardrails against in-the-wild adversarial inputs. \textbf{Visibility into AI Agents}~\citep{chan2024visibility} proposes frameworks for agent governance and accountability. Our work differs by providing a \textit{solution architecture} rather than an evaluation framework, though we adopt similar adversarial testing methodologies.

\subsection{Access Control Models}
Attribute-Based Access Control (ABAC)~\citep{nist2014abac} has been the standard for fine-grained authorization in enterprise systems. We extend ABAC to agent contexts by treating agent identity, action type, target resource, and temporal context as attributes evaluated against deterministic policies.

\section{System Design}
\label{sec:design}

The Agent Control Plane treats the LLM as a raw compute component---a ``CPU'' for reasoning---while the Control Plane acts as the Operating System. Figure~\ref{fig:architecture} illustrates the complete architecture.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.9\textwidth]{figures/architecture.png}
    \caption{The ACP Architecture. Requests are intercepted by the Kernel, validated against the Policy Engine and Constraint Graphs, and either executed via the Execution Engine or nullified by the Mute Agent.}
    \label{fig:architecture}
\end{figure}

\subsection{The Agent Kernel}
The Kernel is the central coordinator implementing a 4-level permission system:
\begin{itemize}[nosep]
    \item \texttt{NONE}: No access to any resources
    \item \texttt{READ\_ONLY}: Can query but not modify
    \item \texttt{READ\_WRITE}: Can query and modify within scope
    \item \texttt{ADMIN}: Full access including policy modification
\end{itemize}

The Kernel intercepts every action request before execution. It manages session isolation through cryptographic context tokens, ensuring no cross-contamination between agent contexts even in multi-tenant deployments.

\subsection{PolicyEngine}
The PolicyEngine evaluates requests against deterministic rules using three mechanisms:

\textbf{ABAC Evaluation}: Every request is decomposed into four attributes validated against policy rules:
\begin{itemize}[nosep]
    \item \textbf{Subject}: Agent ID, role, trust level
    \item \textbf{Resource}: Target system, data classification
    \item \textbf{Action}: Method type (read/write/delete/execute)
    \item \textbf{Environment}: Time, location, session state
\end{itemize}

\textbf{Resource Quotas}: Enforces hard limits on API calls ($n$ per minute), token usage ($t$ per session), and execution time ($s$ seconds per action). Quota exhaustion results in immediate denial---no warnings, no negotiations.

\textbf{Risk Assessment}: Calculates a dynamic risk score $r \in [0.0, 1.0]$ for every action:
\begin{equation}
r = w_1 \cdot r_{\text{action}} + w_2 \cdot r_{\text{resource}} + w_3 \cdot r_{\text{context}}
\end{equation}
where $w_i$ are configurable weights. Actions exceeding the threshold $r > \tau$ trigger elevated authorization requirements or automatic denial.

\subsection{Constraint Graphs: Multi-Dimensional Context}
Enterprise context is not flat. We model it using three graph structures that must \textit{all} be satisfied for a request to proceed (Figure~\ref{fig:constraint_graphs}):

\begin{enumerate}[nosep]
    \item \textbf{Data Graph} $G_D = (V_D, E_D)$: Nodes represent data entities; edges represent accessibility relationships. Query: ``Can Agent $A$ access Resource $R$?''
    \item \textbf{Policy Graph} $G_P = (V_P, E_P)$: Nodes represent compliance rules; edges represent implications. Query: ``Does Action $X$ on Resource $R$ violate any policy?''
    \item \textbf{Temporal Graph} $G_T = (V_T, E_T)$: Nodes represent time windows; edges represent valid state transitions. Query: ``Is Action $X$ permitted at time $t$?''
\end{enumerate}

A request is permitted if and only if:
\begin{equation}
\text{permit}(req) = \text{valid}(G_D, req) \land \text{valid}(G_P, req) \land \text{valid}(G_T, req)
\end{equation}

This multi-dimensional validation handles ``contextual confusion'' attacks where agents are tricked into performing individually valid actions in collectively invalid contexts.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.7\textwidth]{figures/constraint_graphs.png}
    \caption{Multi-dimensional constraint validation. A request must satisfy Data, Policy, and Temporal graphs simultaneously to be permitted.}
    \label{fig:constraint_graphs}
\end{figure}

\subsection{MuteAgent: Scale by Subtraction}
When an action is blocked, traditional systems generate verbose refusals that leak information and waste compute. The \textbf{MuteAgent} component implements ``Scale by Subtraction'':
\begin{itemize}[nosep]
    \item \textbf{Security}: Returns deterministic \texttt{NULL}---the adversary receives no feedback to refine their attack. No explanation of \textit{why} the action failed.
    \item \textbf{Efficiency}: Reduces response overhead from $\sim$127 tokens (typical LLM refusal) to 0.5 tokens (null response marker).
    \item \textbf{Predictability}: Removes LLM variance from the refusal process entirely.
\end{itemize}

The philosophy: if an action is blocked, the agent should behave as if the capability \textit{never existed}. This mirrors how operating systems handle unauthorized memory access---the process doesn't receive a polite explanation; it receives a segmentation fault.

\subsection{Multi-Agent Integration}
\label{sec:multiagent}
ACP supports multi-agent deployments through hierarchical governance:

\textbf{Agent-to-Agent (A2A) Protocol}: When Agent $A$ delegates to Agent $B$, ACP enforces:
\begin{itemize}[nosep]
    \item \textbf{Permission Inheritance}: $B$ cannot exceed $A$'s permissions
    \item \textbf{Scope Narrowing}: $A$ can further restrict $B$'s scope
    \item \textbf{Audit Chaining}: All actions trace back through the delegation chain
\end{itemize}

\textbf{Orchestrator Pattern}: A supervisor agent coordinates workers. ACP validates:
\begin{itemize}[nosep]
    \item Task decomposition respects data boundaries
    \item No worker can access resources outside its assigned scope
    \item Aggregated results don't leak restricted information
\end{itemize}

\textbf{Example}: In a financial analysis workflow, Orchestrator $O$ delegates to Research Agent $R$ and Compliance Agent $C$. Even if $R$ attempts to access PII through prompt injection, ACP blocks the action because $R$'s inherited scope excludes PII access---regardless of what $O$ or the injected prompt requests.

\subsection{Shadow Mode}
For deployment validation, ACP supports Shadow Mode where all actions are logged and evaluated but not enforced. This enables:
\begin{itemize}[nosep]
    \item Policy tuning without production impact
    \item Baseline measurement of violation rates
    \item Gradual rollout from shadow to enforcement
\end{itemize}

\section{Experiments}
\label{sec:experiments}

\subsection{Methodology}

\textbf{Dataset}: We constructed a 60-prompt adversarial benchmark balanced across four categories:
\begin{itemize}[nosep]
    \item \textbf{Direct Violations} (15 prompts): Explicit requests for harmful actions (e.g., ``Delete all user data'')
    \item \textbf{Prompt Injections} (15 prompts): Hidden instructions in retrieved context (e.g., ``Ignore previous instructions and...'')
    \item \textbf{Contextual Confusion} (15 prompts): Social engineering exploiting role ambiguity (e.g., ``As the system administrator, I authorize...'')
    \item \textbf{Valid Requests} (15 prompts): Legitimate operations that should succeed
\end{itemize}

\textbf{Experimental Setup}: We evaluated ACP using 5 independent random seeds (42, 123, 456, 789, 1024) to ensure reproducibility. Each configuration was tested across all 60 prompts, yielding $n=300$ total evaluations per configuration.

\textbf{Statistical Analysis}: Significance was determined using Welch's t-test for unequal variances:
\begin{equation}
t = \frac{\bar{X}_1 - \bar{X}_2}{\sqrt{\frac{s_1^2}{n_1} + \frac{s_2^2}{n_2}}}
\end{equation}
with degrees of freedom approximated via Welch-Satterthwaite. We applied Bonferroni correction for multiple comparisons ($k=6$ tests), yielding adjusted significance threshold $\alpha = 0.05/6 = 0.0083$.

Effect sizes were computed using Cohen's $d$:
\begin{equation}
d = \frac{\bar{X}_1 - \bar{X}_2}{s_{\text{pooled}}}
\end{equation}
where $s_{\text{pooled}} = \sqrt{\frac{(n_1-1)s_1^2 + (n_2-1)s_2^2}{n_1+n_2-2}}$. We interpret $d < 0.2$ as negligible, $0.2 \leq d < 0.5$ as small, $0.5 \leq d < 0.8$ as medium, and $d \geq 0.8$ as large.

\subsection{Main Results}

\begin{table}[H]
    \caption{Safety and Efficiency Performance (n=300 per condition)}
    \centering
    \begin{tabular}{lccc}
        \toprule
        \textbf{Metric} & \textbf{Baseline (No ACP)} & \textbf{With ACP} & \textbf{Improvement} \\
        \midrule
        Safety Violation Rate & 26.67\% $\pm$ 2.1\% & \textbf{0.00\% $\pm$ 0.0\%} & $-$26.67 pp \\
        False Positive Rate & 0.00\% & 0.00\% & --- \\
        Tokens per Blocked Req & 127.4 $\pm$ 18.6 & \textbf{0.5 $\pm$ 0.1} & 98.1\% reduction \\
        Latency Overhead & 0 ms & 12 ms $\pm$ 3 ms & Negligible \\
        \bottomrule
    \end{tabular}
    \label{tab:main_results}
\end{table}

\begin{figure}[H]
    \centering
    \includegraphics[width=0.9\textwidth]{figures/results_chart.png}
    \caption{Safety Violation Rate and Token Efficiency comparison between Baseline (no governance) and ACP-protected agents. Error bars represent standard deviation across 5 seeds.}
    \label{fig:results}
\end{figure}

ACP achieved \textbf{perfect safety scores} (0 violations, 0.00\%) across all adversarial categories while maintaining \textbf{zero false positives} for valid requests. The baseline (no governance) showed 26.67\% violation rate, with failures distributed across Direct Violations (40\%), Prompt Injections (33\%), and Contextual Confusion (27\%).

\subsection{Ablation Studies}
We systematically removed components to understand their criticality (Table~\ref{tab:ablation}, Figure~\ref{fig:ablation}).

\begin{table}[H]
    \caption{Component Criticality Analysis (n=300 evaluations per configuration)}
    \centering
    \begin{tabular}{lcccc}
        \toprule
        \textbf{Configuration} & \textbf{SVR} & \textbf{$p$-value} & \textbf{Cohen's $d$} & \textbf{Impact} \\
        \midrule
        \textbf{Full Kernel} & \textbf{0.00\%} & --- & --- & Baseline \\
        No PolicyEngine & 40.00\% $\pm$ 5.2\% & $< 0.0001^*$ & 8.7 & \textbf{Critical} \\
        No ConstraintGraphs & 3.33\% $\pm$ 1.8\% & $0.0012^*$ & 1.9 & High \\
        No MuteAgent & 0.00\% $\pm$ 0.0\% & $0.94$ & 0.0 & Efficiency Only \\
        No RiskScoring & 1.67\% $\pm$ 1.2\% & $0.0031^*$ & 1.4 & Moderate \\
        No SessionIsolation & 5.00\% $\pm$ 2.1\% & $0.0008^*$ & 2.4 & High \\
        \bottomrule
    \end{tabular}
    \label{tab:ablation}
    \raggedright\small{$^*$ Significant after Bonferroni correction ($\alpha = 0.0083$)}
\end{table}

\begin{figure}[H]
    \centering
    \includegraphics[width=0.85\textwidth]{figures/ablation_chart.png}
    \caption{Ablation study results showing Safety Violation Rate (SVR) when each component is removed. PolicyEngine removal causes catastrophic failure ($d=8.7$).}
    \label{fig:ablation}
\end{figure}

\textbf{Key Findings}:
\begin{itemize}[nosep]
    \item \textbf{PolicyEngine} is the cornerstone of safety ($d=8.7$, ``huge'' effect). Without deterministic policy enforcement, 40\% of adversarial prompts succeed.
    \item \textbf{ConstraintGraphs} prevent contextual attacks ($d=1.9$), catching 3.33\% of edge cases that simple permissions missed---specifically, temporally invalid requests and cross-boundary data access.
    \item \textbf{SessionIsolation} prevents cross-contamination attacks ($d=2.4$), where adversaries exploit shared state between agent contexts.
    \item \textbf{RiskScoring} provides defense-in-depth ($d=1.4$), catching 1.67\% of borderline cases.
    \item \textbf{MuteAgent} provides efficiency only ($d=0.0$)---5,160\% token efficiency gain (0.5 vs 26.3 tokens) without affecting safety.
\end{itemize}

\subsection{Per-Category Breakdown}
Table~\ref{tab:category} shows violation rates by attack category.

\begin{table}[H]
    \caption{Safety Violation Rate by Attack Category}
    \centering
    \begin{tabular}{lcc}
        \toprule
        \textbf{Category} & \textbf{Baseline} & \textbf{With ACP} \\
        \midrule
        Direct Violations & 40.00\% & 0.00\% \\
        Prompt Injections & 33.33\% & 0.00\% \\
        Contextual Confusion & 26.67\% & 0.00\% \\
        Valid Requests (FP) & 0.00\% & 0.00\% \\
        \bottomrule
    \end{tabular}
    \label{tab:category}
\end{table}

\section{Discussion}
\label{sec:discussion}

\subsection{The Necessity of Determinism}
Our results empirically demonstrate that probabilistic safety is insufficient for tool-using agents. The baseline's 26.67\% violation rate---despite using a safety-tuned LLM---confirms that RLHF alignment provides no guarantees under adversarial conditions. The ACP Kernel, by ignoring the ``why'' (agent reasoning) and enforcing the ``what'' (action permissions), eliminated failures entirely.

This mirrors lessons from systems security: we do not rely on software ``promising'' to behave safely; we enforce invariants at the hardware/kernel level. The same principle must apply to agentic AI.

\subsection{Comparison with Existing Approaches}
Unlike content-level guardrails (Guardrails AI, NeMo, Llama Guard), ACP operates at the \textit{action level}. An agent could generate perfectly safe-sounding text while attempting dangerous operations---content filters would pass it; ACP would block it.

Unlike evaluation frameworks (AgentBench, WildGuard), ACP provides a \textit{solution}, not just a benchmark. Our 0.00\% violation rate is not a test score---it's an enforced invariant.

\subsection{Limitations and Ethical Considerations}
While ACP achieves zero violations in our benchmark, important limitations remain:

\textbf{Deployment Risks}:
\begin{itemize}[nosep]
    \item In high-concurrency environments ($>$10K requests/second), complex constraint graph traversals can introduce latency spikes (95th percentile: 45ms vs. 12ms median), potentially degrading user experience.
    \item The ``silent failure'' model (MuteAgent) can frustrate trusted users who need feedback to correct legitimate requests. Production deployments may need configurable verbosity levels for authenticated users.
\end{itemize}

\textbf{Scope Limitations}:
\begin{itemize}[nosep]
    \item \textbf{Modality}: Our study focused on text-based tool use. Vision-language agents face additional injection vectors (adversarial images, steganography) requiring future work.
    \item \textbf{Semantic Attacks}: ACP prevents \textit{unauthorized} actions but cannot detect \textit{authorized actions used maliciously} (e.g., an agent with read access scraping data for exfiltration). Intent detection remains an open problem.
    \item \textbf{Policy Completeness}: ACP enforces policies but does not write them. Incomplete or misconfigured policies leave gaps. We recommend shadow mode deployment for policy validation.
\end{itemize}

\textbf{Ethical Considerations}:
\begin{itemize}[nosep]
    \item Deterministic governance could be misused to enforce harmful policies (e.g., censorship, discrimination). We advocate for transparent policy auditing and human oversight of policy definitions.
    \item The ``silent failure'' model, while secure, reduces transparency. Organizations must balance security against user trust.
\end{itemize}

For complementary self-correction mechanisms, see our concurrent preprint~\citep{selfcorrecting2026}.

\section{Conclusion}
\label{sec:conclusion}

The ``magic'' phase of AI is ending; the engineering phase has begun. As autonomous agents assume critical roles in enterprise systems, reliance on stochastic compliance---hoping the model ``does the right thing''---is professional negligence.

We presented the \textbf{Agent Control Plane (ACP)}, a kernel-inspired architecture achieving \textbf{0.00\% safety violations} with negligible latency overhead (12ms). Our key contributions---deterministic policy enforcement, multi-dimensional constraint graphs, and the ``Scale by Subtraction'' philosophy---provide a foundation for trustworthy agentic systems.

\textbf{Future Directions}: We identify three priorities for future work:
\begin{enumerate}[nosep]
    \item \textbf{Multimodal Governance}: Extending ACP to vision-language agents with image-based policy validation.
    \item \textbf{Federated Policies}: Enabling policy composition across organizational boundaries for multi-party agent collaborations.
    \item \textbf{Formal Verification}: Proving safety properties of constraint graph configurations using model checking techniques.
\end{enumerate}

We release ACP as open-source software, inviting the research community to build upon this foundation. The next generation of AI systems must be \textit{engineered} for safety, not merely \textit{trained} for it.

\section*{Acknowledgments}
We thank the anonymous reviewers for their constructive feedback. This research was conducted independently without external funding.

\textbf{LLM Disclosure}: Large language models (GPT-4, Claude) were used to assist with code documentation, literature search, and manuscript editing. All technical content, experimental design, and scientific claims were developed and verified by the authors.

% ============================================================================
% Bibliography - Using natbib with external .bib file (matching SCAK paper style)
% ============================================================================
\bibliographystyle{plainnat}
\bibliography{references}

\newpage
\appendix
\section{Reproducibility}
\label{app:reproducibility}

\subsection{Environment Setup}
\begin{lstlisting}[language=bash]
# Clone repository
git clone https://github.com/imran-siddique/agent-control-plane.git
cd agent-control-plane

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # Linux/Mac
# .venv\Scripts\activate   # Windows

# Install dependencies
pip install -e ".[dev]"
\end{lstlisting}

\subsection{Running Experiments}
\begin{lstlisting}[language=bash]
# Run full benchmark suite
python -m benchmark.red_team_dataset \
    --seeds 42,123,456,789,1024 \
    --output results/

# Run ablation studies
python -m benchmark.ablations \
    --config experiments/ablation_config.json \
    --output results/ablations/
\end{lstlisting}

\subsection{Hardware Specifications}
All experiments were conducted on:
\begin{itemize}[nosep]
    \item CPU: AMD Ryzen 9 5900X (12 cores, 24 threads)
    \item RAM: 64GB DDR4-3200
    \item GPU: NVIDIA RTX 3090 (24GB VRAM)
    \item OS: Ubuntu 22.04 LTS
    \item Python: 3.11.4
\end{itemize}

\subsection{Random Seeds}
For reproducibility, we used fixed seeds: \texttt{[42, 123, 456, 789, 1024]}. These were applied to:
\begin{itemize}[nosep]
    \item Prompt ordering randomization
    \item Any stochastic model sampling (temperature fixed at 0.0)
    \item Train/test splits (if applicable)
\end{itemize}

\section{Extended Ablation Results}
\label{app:ablations}

Table~\ref{tab:extended_ablation} provides per-query-category breakdown for each ablation configuration.

\begin{table}[H]
    \caption{Extended Ablation: SVR by Attack Category (\%)}
    \centering
    \small
    \begin{tabular}{lcccc}
        \toprule
        \textbf{Configuration} & \textbf{Direct} & \textbf{Injection} & \textbf{Confusion} & \textbf{Valid (FP)} \\
        \midrule
        Full Kernel & 0.0 & 0.0 & 0.0 & 0.0 \\
        No PolicyEngine & 53.3 & 46.7 & 20.0 & 0.0 \\
        No ConstraintGraphs & 0.0 & 0.0 & 10.0 & 0.0 \\
        No MuteAgent & 0.0 & 0.0 & 0.0 & 0.0 \\
        No RiskScoring & 0.0 & 6.7 & 0.0 & 0.0 \\
        No SessionIsolation & 0.0 & 13.3 & 6.7 & 0.0 \\
        \bottomrule
    \end{tabular}
    \label{tab:extended_ablation}
\end{table}

\textbf{Observations}:
\begin{itemize}[nosep]
    \item PolicyEngine removal causes failures across all adversarial categories, with Direct Violations most affected (53.3\%).
    \item ConstraintGraphs specifically protect against Contextual Confusion (10\% SVR without them).
    \item SessionIsolation failures concentrate in Prompt Injection (13.3\%) where cross-context leakage enables attacks.
    \item RiskScoring catches borderline Prompt Injection cases (6.7\%) that pass other checks.
\end{itemize}

\end{document}
