AI Safety
New Framework Lets Servers Verify AI Agent Actions Without Relying on Model Explanations
Researchers propose a mediation system that converts AI agent reasoning into verifiable claims, checking them against policy and intent before execution.
Artificial intelligence agents that use tools often explain their decisions with free-form rationales—but these explanations cannot be trusted as authorization or proof of actual intent. A new approach called Explanation-Bound Tool Execution (EBTE) solves this problem by turning those rationales into structured, checkable claims that a server can verify before allowing action.
The Problem With Agent Reasoning#
When an AI agent calls a tool or performs an action, it typically provides some reasoning to justify the decision. However, these natural-language rationales are unreliable. They may not truly reflect the agent's internal logic, they cannot serve as authorization mechanisms, and they may conflict with actual policies or safety constraints. Systems that blindly trust agent explanations expose themselves to misuse or unintended consequences.
How EBTE Works#
Rather than accepting an agent's stated rationale at face value, EBTE intercepts tool calls and translates their reasoning into typed action claims. These claims are then cross-checked against server-held facts about:
- Intended behavior
- Applicable policies
- Payload contents
- Which tools are permitted
- Risk assessments
- Provenance and audit trails
- Whether information is fresh
If a claim conflicts with any of these facts, the system denies the action. Only claims that match verified intent and policy pass through to execution. Crucially, EBTE cannot grant permissions beyond what was already authorized—it can only restrict or deny.
Testing and Results#
The team formalized EBTE's design under explicit mediation and trust assumptions, then built and tested a reference implementation. Across 136 test scenarios, the system:
- Matched all specified expected outcomes
- Rejected all 96 designated hard-contradiction cases
- Passed 232 metamorphic (structural consistency) checks
In a separate evaluation using recorded model interactions from 2026-07-12, the framework correctly validated preserved claims at rates of 70–71% on the first test suite, 65–66% on the second, and 17–19% on the third. When applied to high-risk attack scenarios adapted from AgentDojo security benchmarks, EBTE consistently blocked all 12 proposed attacks while maintaining alignment with legitimate tasks.
