\relax 
\providecommand\hyper@newdestlabel[2]{}
\providecommand\HyField@AuxAddToFields[1]{}
\providecommand\HyField@AuxAddToCoFields[2]{}
\citation{deloitte2025orchestration}
\citation{wei2023jailbroken,zou2023universal}
\citation{greshake2023not}
\@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{1}{section.1}\protected@file@percent }
\newlabel{sec:introduction}{{1}{1}{Introduction}{section.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.1}The Agent Safety Crisis}{1}{subsection.1.1}\protected@file@percent }
\citation{selfcorrecting2026}
\citation{guardrailsai2023}
\citation{nvidia2023nemo}
\citation{inan2023llamaguard}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.2}``Vibes'' Are Not Engineering}{2}{subsection.1.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {1.3}The Solution: A Deterministic Kernel}{2}{subsection.1.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {1.4}Contributions}{2}{subsection.1.4}\protected@file@percent }
\citation{langchain2022}
\citation{autogpt2023}
\citation{autogen2023}
\citation{crewai2024}
\citation{agentbench2024}
\citation{wildguard2024}
\citation{chan2024visibility}
\citation{nist2014abac}
\@writefile{toc}{\contentsline {section}{\numberline {2}Related Work}{3}{section.2}\protected@file@percent }
\newlabel{sec:related}{{2}{3}{Related Work}{section.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Guardrail Systems}{3}{subsection.2.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Agent Frameworks}{3}{subsection.2.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Agent Safety Evaluation}{3}{subsection.2.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4}Access Control Models}{3}{subsection.2.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}System Design}{3}{section.3}\protected@file@percent }
\newlabel{sec:design}{{3}{3}{System Design}{section.3}{}}
\@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces The ACP Architecture. Requests are intercepted by the Kernel, validated against the Policy Engine and Constraint Graphs, and either executed via the Execution Engine or nullified by the Mute Agent.}}{4}{figure.1}\protected@file@percent }
\newlabel{fig:architecture}{{1}{4}{The ACP Architecture. Requests are intercepted by the Kernel, validated against the Policy Engine and Constraint Graphs, and either executed via the Execution Engine or nullified by the Mute Agent}{figure.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}The Agent Kernel}{4}{subsection.3.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}PolicyEngine}{4}{subsection.3.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Constraint Graphs: Multi-Dimensional Context}{5}{subsection.3.3}\protected@file@percent }
\@writefile{lof}{\contentsline {figure}{\numberline {2}{\ignorespaces Multi-dimensional constraint validation. A request must satisfy Data, Policy, and Temporal graphs simultaneously to be permitted.}}{5}{figure.2}\protected@file@percent }
\newlabel{fig:constraint_graphs}{{2}{5}{Multi-dimensional constraint validation. A request must satisfy Data, Policy, and Temporal graphs simultaneously to be permitted}{figure.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}MuteAgent: Scale by Subtraction}{5}{subsection.3.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Multi-Agent Integration}{6}{subsection.3.5}\protected@file@percent }
\newlabel{sec:multiagent}{{3.5}{6}{Multi-Agent Integration}{subsection.3.5}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.6}Shadow Mode}{6}{subsection.3.6}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}Experiments}{6}{section.4}\protected@file@percent }
\newlabel{sec:experiments}{{4}{6}{Experiments}{section.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Methodology}{6}{subsection.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}Main Results}{7}{subsection.4.2}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {1}{\ignorespaces Safety and Efficiency Performance (n=300 per condition)}}{7}{table.1}\protected@file@percent }
\newlabel{tab:main_results}{{1}{7}{Safety and Efficiency Performance (n=300 per condition)}{table.1}{}}
\@writefile{lof}{\contentsline {figure}{\numberline {3}{\ignorespaces Safety Violation Rate and Token Efficiency comparison between Baseline (no governance) and ACP-protected agents. Error bars represent standard deviation across 5 seeds.}}{7}{figure.3}\protected@file@percent }
\newlabel{fig:results}{{3}{7}{Safety Violation Rate and Token Efficiency comparison between Baseline (no governance) and ACP-protected agents. Error bars represent standard deviation across 5 seeds}{figure.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Ablation Studies}{7}{subsection.4.3}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {2}{\ignorespaces Component Criticality Analysis (n=300 evaluations per configuration)}}{8}{table.2}\protected@file@percent }
\newlabel{tab:ablation}{{2}{8}{Component Criticality Analysis (n=300 evaluations per configuration)}{table.2}{}}
\@writefile{lof}{\contentsline {figure}{\numberline {4}{\ignorespaces Ablation study results showing Safety Violation Rate (SVR) when each component is removed. PolicyEngine removal causes catastrophic failure ($d=8.7$).}}{8}{figure.4}\protected@file@percent }
\newlabel{fig:ablation}{{4}{8}{Ablation study results showing Safety Violation Rate (SVR) when each component is removed. PolicyEngine removal causes catastrophic failure ($d=8.7$)}{figure.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Per-Category Breakdown}{8}{subsection.4.4}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {3}{\ignorespaces Safety Violation Rate by Attack Category}}{9}{table.3}\protected@file@percent }
\newlabel{tab:category}{{3}{9}{Safety Violation Rate by Attack Category}{table.3}{}}
\@writefile{toc}{\contentsline {section}{\numberline {5}Discussion}{9}{section.5}\protected@file@percent }
\newlabel{sec:discussion}{{5}{9}{Discussion}{section.5}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}The Necessity of Determinism}{9}{subsection.5.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.2}Comparison with Existing Approaches}{9}{subsection.5.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.3}Limitations and Ethical Considerations}{9}{subsection.5.3}\protected@file@percent }
\citation{selfcorrecting2026}
\bibstyle{plainnat}
\bibdata{references}
\bibcite{chan2024visibility}{{1}{2024}{{Chan et~al.}}{{Chan, Ezell, Kaufmann, Wei, Hammond, Bradley, Bluemke, Rajkumar, Krueger, Korbak, et~al.}}}
\bibcite{langchain2022}{{2}{2022}{{Chase}}{{}}}
\bibcite{crewai2024}{{3}{2024}{{CrewAI}}{{}}}
\bibcite{deloitte2025orchestration}{{4}{2025}{{Deloitte}}{{}}}
\bibcite{greshake2023not}{{5}{2023}{{Greshake et~al.}}{{Greshake, Abdelnabi, Mishra, Endres, Holz, and Fritz}}}
\bibcite{guardrailsai2023}{{6}{2023}{{Guardrails AI}}{{}}}
\@writefile{toc}{\contentsline {section}{\numberline {6}Conclusion}{10}{section.6}\protected@file@percent }
\newlabel{sec:conclusion}{{6}{10}{Conclusion}{section.6}{}}
\bibcite{wildguard2024}{{7}{2024}{{Han et~al.}}{{Han, Rao, Ettinger, Jiang, Lin, Lambert, Choi, and Dziri}}}
\bibcite{inan2023llamaguard}{{8}{2023}{{Inan et~al.}}{{Inan, Upasani, Chi, et~al.}}}
\bibcite{agentbench2024}{{9}{2023}{{Liu et~al.}}{{Liu, Yu, Zhang, Xu, Lei, Lai, Gu, Ding, Men, Yang, et~al.}}}
\bibcite{autogen2023}{{10}{2023}{{Microsoft Research}}{{}}}
\bibcite{nist2014abac}{{11}{2014}{{NIST}}{{}}}
\bibcite{nvidia2023nemo}{{12}{2023}{{NVIDIA}}{{}}}
\bibcite{selfcorrecting2026}{{13}{2026}{{Self-Correcting Agent Team}}{{}}}
\bibcite{autogpt2023}{{14}{2023}{{Significant-Gravitas}}{{}}}
\bibcite{wei2023jailbroken}{{15}{2023}{{Wei et~al.}}{{Wei, Haghtalab, and Steinhardt}}}
\bibcite{zou2023universal}{{16}{2023}{{Zou et~al.}}{{Zou, Wang, Kolter, and Fredrikson}}}
\@writefile{toc}{\contentsline {section}{\numberline {A}Reproducibility}{12}{appendix.A}\protected@file@percent }
\newlabel{app:reproducibility}{{A}{12}{Reproducibility}{appendix.A}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {A.1}Environment Setup}{12}{subsection.A.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {A.2}Running Experiments}{12}{subsection.A.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {A.3}Hardware Specifications}{12}{subsection.A.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {A.4}Random Seeds}{12}{subsection.A.4}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {B}Extended Ablation Results}{12}{appendix.B}\protected@file@percent }
\newlabel{app:ablations}{{B}{12}{Extended Ablation Results}{appendix.B}{}}
\@writefile{lot}{\contentsline {table}{\numberline {4}{\ignorespaces Extended Ablation: SVR by Attack Category (\%)}}{13}{table.4}\protected@file@percent }
\newlabel{tab:extended_ablation}{{4}{13}{Extended Ablation: SVR by Attack Category (\%)}{table.4}{}}
\gdef \@abspage@last{13}
