# Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent Systems

arXiv: https://arxiv.org/abs/2601.17744 · HTML: https://mlsanity.com/paper/2601.17744/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 20 references that are in the map.
- First posted on arXiv 25 Jan 2026.

## Builds on (most cited first, 3 of 3)

- [SAGA: A Security Architecture for Governing AI Agentic Systems](https://mlsanity.com/paper/2504.21034/) (2025)
- [AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior](https://mlsanity.com/paper/2601.10440/) (2026)
- [AGENTSAFE: A Unified Framework for Ethical Assurance and Governance in Agentic AI](https://mlsanity.com/paper/2512.03180/) (2025)

## Built on by (most cited first, 4 of 4)

- [SecureClaw: Clawing Back Control of LLM Agents](https://mlsanity.com/paper/2606.09549/) (2026)
- [The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Plane](https://mlsanity.com/paper/2605.29082/) (2026)
- [Governed Auditable Decisioning Under Uncertainty: Synthesis and Agentic Extension](https://mlsanity.com/paper/2604.19112/) (2026)
- [Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMs](https://mlsanity.com/paper/2609.38266/) (2026)

## Abstract (arXiv)

Autonomous agent systems increasingly trigger real-world side effects: deploying infrastructure, modifying databases, moving money, and executing workflows. Yet most agent stacks provide no mandatory execution checkpoint where organizations can deterministically permit, deny, or defer an action before it changes reality. This paper introduces Faramesh, a protocol-agnostic execution control plane that enforces execution-time authorization for agent-driven actions via a non-bypassable Action Authorization Boundary (AAB). Faramesh canonicalizes agent intent into a Canonical Action Representation (CAR), evaluates actions deterministically against policy and state, and issues a decision artifact (PERMIT/DEFER/DENY) that executors must validate prior to execution. The system is designed to be framework- and model-agnostic, supports multi-agent and multi-tenant deployments, and remains independent of transport protocols (e.g., MCP). Faramesh further provides decision-centric, append-only provenance logging keyed by canonical action hashes, enabling auditability, verification, and deterministic replay without re-running agent reasoning. We show how these primitives yield enforceable, predictable governance for autonomous execution while avoiding hidden coupling to orchestration layers or observability-only approaches.