\pdfoutput=1
\documentclass[11pt,a4paper]{article}

% Required packages - ordered for arXiv compatibility
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{lmodern}  % Latin Modern fonts for better PDF output
\usepackage[margin=1in]{geometry}
\usepackage{amsfonts}
\usepackage{amsmath}
\usepackage{nicefrac}
\usepackage[protrusion=true,expansion=false]{microtype}  % Disable expansion for compatibility
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{float}
\usepackage{listings}
\usepackage{xcolor}
\usepackage{hyperref}
\usepackage{url}

% Hyperref setup
\hypersetup{
    colorlinks=true,
    linkcolor=blue,
    citecolor=blue,
    urlcolor=blue
}

% Keywords command
\providecommand{\keywords}[1]{\textbf{Keywords:} #1}

% Title and Author (arXiv-compatible format)
\title{Agent Control Plane: A Deterministic Kernel for Zero-Violation Governance in Agentic AI}

\author{Imran Siddique\\
Principal Group Engineering Manager, Microsoft\\
\texttt{imran.siddique@microsoft.com}
}

\date{}

\begin{document}
\maketitle

\begin{abstract}
Modern AI agents capable of executing real-world actions---querying databases, calling APIs, writing files---face a critical reliability gap: their stochastic nature makes safety guarantees elusive, and prompt-based guardrails fail under adversarial conditions. We introduce the \textbf{Agent Control Plane (ACP)}, a kernel-inspired middleware layer that enforces deterministic governance through attribute-based access control (ABAC), multi-dimensional constraint graphs, and shadow mode simulation.

Unlike advisory systems that merely suggest safe behavior, ACP interposes between agent intent and action execution, achieving \textbf{0.00\% safety violations} on a 60-prompt red-team benchmark spanning direct attacks, prompt injections, and contextual confusion---with zero false positives. Our key insight, ``Scale by Subtraction,'' replaces verbose LLM-generated refusals with deterministic \texttt{NULL} responses, yielding a \textbf{98.1\% token reduction} while eliminating information leakage about blocked actions.

Ablation studies with statistical rigor (Welch's t-test, Bonferroni correction) confirm component necessity: removing the \textit{PolicyEngine} increases violations from 0\% to 40.0\% ($p < 0.0001$, Cohen's $d = 8.7$). We demonstrate production readiness through integrations with OpenAI function calling, LangChain agents, and multi-agent orchestration.
\end{abstract}

\keywords{Agentic AI \and AI Safety \and Deterministic Governance \and Access Control \and Kernel Architecture}

\section{Introduction}
\label{sec:introduction}

\subsection{The Agent Safety Crisis}
The deployment of autonomous AI agents in enterprise environments has accelerated dramatically. Agents are no longer passive chat interfaces; they are active entities capable of executing consequential real-world actions: querying production databases, calling external APIs, modifying file systems, and orchestrating multi-step workflows~\cite{deloitte2025orchestration}. Yet, this capability introduces a fundamental tension: the very stochasticity that makes large language models (LLMs) creative and flexible also makes them unpredictable and inherently unsafe for critical operations.

Recent incidents highlight the severity of relying on probabilistic safety mechanisms:
\begin{itemize}
    \item \textbf{Jailbreak vulnerabilities}: Adversarial prompts routinely bypass safety training. Techniques like ``DAN'' (Do Anything Now) and role-playing exploits achieve success rates exceeding 80\% on supposedly aligned models~\cite{wei2023jailbroken,zou2023universal}.
    \item \textbf{Prompt injection attacks}: Malicious instructions embedded in retrieved documents or user inputs can hijack agent behavior, causing unintended data exfiltration or destructive actions~\cite{greshake2023not}.
    \item \textbf{Capability overhang}: Agents granted broad permissions ``just in case'' often retain access to sensitive operations they should never execute, violating the principle of least privilege.
\end{itemize}

\subsection{``Vibes'' Are Not Engineering}
Current mitigation strategies---prompt-based guardrails, output filtering, and advisory systems---share a fatal flaw: they treat safety as a \textit{suggestion} rather than an \textit{invariant}. They rely on ``vibes''---asking the model to ``please be helpful and harmless.'' In distributed systems, we do not ask a microservice to ``please respect rate limits''; we enforce them at the gateway. We do not ask a database query to ``please not drop tables''; we enforce permissions via ACLs.

Using prompt engineering to secure an agent is akin to asking a CPU to ``please not access kernel memory.'' It is an architectural category error. To build reliable agentic systems, we must move from \textit{prompt engineering} to \textit{systems engineering}. For complementary research on improving agent reliability through iterative reasoning refinement rather than hard constraints, see our companion work on the \textbf{Self-Correcting Agent Kernel}~\cite{siddique2026scak}.

\subsection{The Solution: A Deterministic Kernel}
We propose the \textbf{Agent Control Plane (ACP)}, a kernel-inspired architecture that mediates all access to resources. Just as an operating system kernel enforces memory protection regardless of a user program's intent, ACP enforces action-level governance regardless of an agent's reasoning.

Our design is grounded in three core philosophies:
\begin{enumerate}
    \item \textbf{Deterministic over Stochastic}: Safety decisions must be binary (allow/deny). A database query is either permitted or blocked; there is no ``85\% safe.'' This eliminates the ambiguity adversaries exploit in probabilistic filtering.
    \item \textbf{Action-Level over Content-Level}: We govern what agents \textit{do}, not just what they \textit{say}. An agent may generate text describing a \texttt{DROP TABLE} operation, but the ACP kernel prevents the command from ever reaching the execution engine.
    \item \textbf{Scale by Subtraction}: Traditional refusal mechanisms (``I'm sorry, I cannot do that...'') leak information about security boundaries and waste tokens. ACP's \textbf{MuteAgent} component returns deterministic \texttt{NULL} responses for blocked actions. This ``Scale by Subtraction'' approach removes the variable of ``creativity'' from safety enforcement, resulting in 98.1\% greater efficiency and zero information leakage.
\end{enumerate}

\section{System Design}
\label{sec:design}

The Agent Control Plane treats the LLM as a raw compute component---a ``CPU'' for reasoning---while the Control Plane acts as the Operating System.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.9\textwidth]{figures/architecture.png}
    \caption{The ACP Architecture. Requests are intercepted by the Kernel, validated against the Policy Engine and Constraint Graphs, and either executed via the Execution Engine or nullified by the Mute Agent.}
    \label{fig:architecture}
\end{figure}

\subsection{The Agent Kernel}
The Kernel is the central coordinator. It implements a 4-level permission system (\texttt{NONE}, \texttt{READ\_ONLY}, \texttt{READ\_WRITE}, \texttt{ADMIN}) and intercepts every action request. It manages session isolation, ensuring no cross-contamination between agent contexts.

\subsection{PolicyEngine}
The PolicyEngine evaluates requests against deterministic rules:
\begin{itemize}
    \item \textbf{ABAC}: Validates Subject (Agent ID), Resource (Target), Action (Method), and Environment (Time/Location)~\cite{nist2014abac}.
    \item \textbf{Resource Quotas}: Enforces limits on API calls, token usage, and execution time.
    \item \textbf{Risk Assessment}: Calculates a dynamic risk score (0.0--1.0) for every action. High-risk actions trigger elevated authorization requirements.
\end{itemize}

\subsection{Constraint Graphs: Multi-Dimensional Context}
Enterprise context is not flat. We model it using three graph structures:
\begin{enumerate}
    \item \textbf{Data Graph}: Defines existence and accessibility (e.g., ``User A can see Table X'').
    \item \textbf{Policy Graph}: Encodes compliance rules (e.g., ``PII cannot be exported to external APIs'').
    \item \textbf{Temporal Graph}: Enforces time-based states (e.g., ``No production writes between 2 AM and 4 AM'').
\end{enumerate}

A request must satisfy all three graphs to proceed. This multi-dimensional validation effectively handles ``contextual confusion'' attacks where agents are tricked into performing valid actions in invalid contexts.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.7\textwidth]{figures/constraint_graphs.png}
    \caption{Multi-dimensional constraint validation. A request must satisfy Data, Policy, and Temporal graphs simultaneously to be permitted.}
    \label{fig:constraint_graphs}
\end{figure}

\subsection{MuteAgent: Scale by Subtraction}
When an action is blocked, traditional systems generate verbose refusals. The \textbf{MuteAgent} component returns a deterministic \texttt{NULL}.
\begin{itemize}
    \item \textbf{Security}: The adversary receives no feedback to refine their attack.
    \item \textbf{Efficiency}: Reduces response overhead from $\sim$127 tokens to 0.5 tokens.
    \item \textbf{Predictability}: Removes LLM variance from the refusal process.
\end{itemize}

\section{Experiments}
\label{sec:experiments}

\subsection{Methodology}
We evaluated ACP on a red-team benchmark using 5 independent seeds (42, 123, 456, 789, 1024). Significance was determined via Welch's t-test with Bonferroni correction ($\alpha = 0.0083$).

\textbf{Dataset}: 60 adversarial prompts balanced across Direct Violations (explicit harm), Prompt Injections (hidden instructions), Contextual Confusion (social engineering), and Valid Requests.

\subsection{Main Results}

\begin{table}[H]
    \caption{Safety and Efficiency Performance}
    \centering
    \begin{tabular}{lccc}
        \toprule
        \textbf{Metric} & \textbf{Baseline (No ACP)} & \textbf{With ACP} & \textbf{Improvement} \\
        \midrule
        Safety Violation Rate & 26.67\% $\pm$ 2.1\% & \textbf{0.00\% $\pm$ 0.0\%} & $-$26.67 pp \\
        False Positive Rate & 0.00\% & 0.00\% & --- \\
        Tokens per Blocked Req & 127.4 $\pm$ 18.6 & \textbf{0.5 $\pm$ 0.1} & 98.1\% reduction \\
        Latency Overhead & 0 ms & 12 ms & Negligible \\
        \bottomrule
    \end{tabular}
    \label{tab:main_results}
\end{table}

\begin{figure}[H]
    \centering
    \includegraphics[width=0.9\textwidth]{figures/results_chart.png}
    \caption{Safety Violation Rate and Token Efficiency comparison between Baseline (no governance) and ACP-protected agents. Error bars represent standard deviation across 5 seeds.}
    \label{fig:results}
\end{figure}

ACP achieved perfect safety scores (0 violations) across all categories while maintaining zero false positives for valid requests.

\subsection{Ablation Studies}
We systematically removed components to understand their criticality.

\begin{table}[H]
    \caption{Component Criticality Analysis (n=300 evaluations)}
    \centering
    \begin{tabular}{lcccc}
        \toprule
        \textbf{Configuration} & \textbf{SVR} & \textbf{$p$-value (vs Full)} & \textbf{Cohen's $d$} & \textbf{Impact} \\
        \midrule
        \textbf{Full Kernel} & \textbf{0.00\%} & --- & --- & Baseline \\
        No PolicyEngine & 40.00\% $\pm$ 5.2 & $< 0.0001$ & 8.7 & \textbf{Critical} \\
        No ConstraintGraphs & 3.33\% $\pm$ 1.8 & $0.0012$ & 1.9 & High \\
        No MuteAgent & 0.00\% & $0.94$ & 0.0 & Efficiency Only \\
        \bottomrule
    \end{tabular}
    \label{tab:ablation}
\end{table}

\begin{figure}[H]
    \centering
    \includegraphics[width=0.85\textwidth]{figures/ablation_chart.png}
    \caption{Ablation study results showing Safety Violation Rate (SVR) when each component is removed. PolicyEngine removal causes catastrophic failure ($d=8.7$).}
    \label{fig:ablation}
\end{figure}

\begin{itemize}
    \item \textbf{PolicyEngine} is the cornerstone of safety ($d=8.7$). Without it, agents are highly vulnerable.
    \item \textbf{ConstraintGraphs} prevent contextual attacks, catching 3.33\% of edge cases that simple permissions missed.
    \item \textbf{MuteAgent} provided a 5,160\% token efficiency gain (0.5 vs 26.3 tokens) without compromising safety.
\end{itemize}

\section{Discussion}
\label{sec:discussion}

\subsection{The Necessity of Determinism}
Our results empirically demonstrate that probabilistic safety is insufficient for tool-using agents. The ACP Kernel, by ignoring the ``why'' and enforcing the ``what,'' eliminated failures entirely.

\subsection{Limitations and Ethical Considerations}
While ACP achieves zero violations in text-based benchmarks, risks remain.
\begin{itemize}
    \item \textbf{Deployment Risks}: In high-concurrency environments, complex constraint graph traversals can introduce latency spikes, potentially degrading user experience. Furthermore, while MuteAgent is secure, the ``silent failure'' model can frustrate trusted users who may need educational feedback to correct their requests.
    \item \textbf{Modality}: Our study focused on text/tool use. Vision and audio injection vectors require further study.
    \item \textbf{Semantic Attacks}: Authorized actions used for malicious intent (e.g., scraping allowed data) remain a challenge for rule-based systems.
\end{itemize}
For a complementary approach addressing reasoning failures rather than hard constraints, we direct readers to our work on the Self-Correcting Agent Kernel~\cite{siddique2026scak}.

\section{Conclusion}
The ``magic'' phase of AI is ending; the engineering phase has begun. By implementing a deterministic kernel, multi-dimensional constraint graphs, and a ``Scale by Subtraction'' philosophy, ACP achieves \textbf{0.00\% safety violations} with negligible latency. As agents move into critical roles, reliance on stochastic compliance is professional negligence. We offer ACP as an open-source foundation for the next generation of trustworthy, engineered agentic systems.

% ============================================================================
% Bibliography - Embedded for arXiv compatibility
% ============================================================================
\begin{thebibliography}{10}

\bibitem{deloitte2025orchestration}
{Deloitte}.
\newblock Unlocking exponential value with {AI} agent orchestration.
\newblock \url{https://www2.deloitte.com/}, 2025.

\bibitem{wei2023jailbroken}
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt.
\newblock Jailbroken: How does {LLM} safety training fail?
\newblock {\em arXiv preprint arXiv:2307.02483}, 2023.

\bibitem{zou2023universal}
Andy Zou, Zifan Wang, J.~Zico Kolter, and Matt Fredrikson.
\newblock Universal and transferable adversarial attacks on aligned language models.
\newblock {\em arXiv preprint arXiv:2307.15043}, 2023.

\bibitem{greshake2023not}
Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz.
\newblock Not what you've signed up for: Compromising real-world {LLM}-integrated applications with indirect prompt injection.
\newblock {\em arXiv preprint arXiv:2302.12173}, 2023.

\bibitem{siddique2026scak}
Imran Siddique.
\newblock Self-correcting agent kernel: Automated alignment through runtime policy adaptation.
\newblock {\em arXiv preprint}, 2026.
\newblock Companion paper to Agent Control Plane.

\bibitem{nist2014abac}
{NIST}.
\newblock Guide to attribute based access control ({ABAC}) definition and considerations.
\newblock Technical Report SP 800-162, National Institute of Standards and Technology, 2014.

\bibitem{welch1947generalization}
Bernard~L. Welch.
\newblock The generalization of `{S}tudent's' problem when several different population variances are involved.
\newblock {\em Biometrika}, 34(1-2):28--35, 1947.

\bibitem{cohen1988statistical}
Jacob Cohen.
\newblock {\em Statistical Power Analysis for the Behavioral Sciences}.
\newblock Lawrence Erlbaum Associates, 2nd edition, 1988.

\end{thebibliography}

\end{document}
