Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Traditional software relies on contracts -- APIs, type systems, assertions -- to specify and enforce correct behavior. AI agents, by contrast, operate on prompts and natural language instructions with no formal behavioral specification. This gap is the root cause of drift, governance failures, and frequent project failures in agentic AI deployments. We introduce Agent Behavioral Contracts (ABC), a formal framework that brings Design-by-Contract principles to autonomous AI agents. An ABC contract C = (P, I, G, R) specifies Preconditions, Invariants, Governance policies, and Recovery mechanisms as first-class, runtime-enforceable components. We define (p, delta, k)-satisfaction -- a probabilistic notion of contract compliance that accounts for LLM non-determinism and recovery -- and prove a Drift Bounds Theorem showing that contracts with recovery rate gamma > alpha (the natural drift rate) bound behavioral drift to D* = alpha/gamma in expectation, with Gaussian concentration in the stochastic setting. We establish sufficient conditions for safe contract composition in multi-agent chains and derive probabilistic degradation bounds. We implement ABC in AgentAssert, a runtime enforcement library, and evaluate on AgentContract-Bench, a benchmark of 200 scenarios across 7 models from 6 vendors. Results across 1,980 sessions show that contracted agents detect 5.2-6.8 soft violations per session that uncontracted baselines miss entirely (p < 0.0001, Cohen's d = 6.7-33.8), achieve 88-100% hard constraint compliance, and bound behavioral drift to D* < 0.27 across extended sessions, with 100% recovery for frontier models and 17-100% across all models, at overhead < 10 ms per action.
Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 18 of its 51 references that are in the map. First posted on arXiv 25 Feb 2026.
Builds on
18 of 51 references.
Closest ancestors · 7
Same direction, newest first
- 2026Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents18 Feb
- 2026AIR: Improving Agent Safety through Incident Response12 Feb
- 2026POLARIS: Typed Planning and Governed Execution for Agentic AI in Back-Office Automation16 Jan
- 2025Enforcing Temporal Constraints for LLM Agents25 Dec
- 2025AGENTSAFE: A Unified Framework for Ethical Assurance and Governance in Agentic AI2 Dec
- 2025VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation3 Oct
- 2025ProbGuard: Proactive Runtime Monitoring for LLM Agent Safety via Probabilistic Prediction1 Aug
Other references · 11
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
- 2016Concrete Problems in AI Safetycited by 1,582
- 2026Agent Drift: Quantifying Behavioral Degradation in Multi-Agent LLM Systems Over Extended Interactionscited by 26
- 2026Agent Contracts: A Formal Framework for Resource-Bounded Autonomous AI Systemscited by 12
- 2026The Devil Behind Moltbook: Anthropic Safety is Always Vanishing in Self-Evolving AI Societiescited by 6
- 2026StepShield: When, Not Whether to Intervene on Rogue Agentscited by 5
- 2017Stochastic Assume-Guarantee Contracts for Cyber-Physical System Design Under Probabilistic Requirementscited by 2
- 2025A DbC Inspired Neurosymbolic Layer for Trustworthy Agent Designcited by 2
Built on by
Citing papers per year: 2026: 18.
18 papers.
Sort:
By area:
- 2026Formal Analysis and Supply Chain Security for Agentic AI Skillscited by 21
- 2026Runtime Governance for AI Agents: Policies on Pathscited by 17
- 2026Exploiting LLM Agent Supply Chains via Payload-less Skillscited by 5
- 2026Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defensecited by 3
- 2026Skill Drift Is Contract Violation: Proactive Maintenance for LLM Agent Skill Librariescited by 3
- 2026SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systemscited by 2
- 2026MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Securitycited by 2
- 2026Outcome Monitors: Recovery Affordances for Silent Tool Failurescited by 2
- 2026When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escapecited by 1
- 2026Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agentscited by 1
- 2026Retrieval-Conditioned Topology Selection with Provable Budget Conservation for Multi-Agent Code Generationcited by 1
- 2026Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolationcited by 1
6 more
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deploymentcited by 1
- 2026Agent Behavioral Contracts II: Certifying Compositional Reliability Without Assuming Independencecited by 1
- 2026Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with a Proof-of-Concept Evaluation on Embodied Agentscited by 0
- 2026Behavioral Governance for Autonomous AI Agents: The AgentBound Frameworkcited by 0
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Controlcited by 0
- 2026Do Agent Benchmarks Do What They Say? An Executable-Contract Audit of Tool-Using Agent Environmentscited by 0
- 2026Do Agent Benchmarks Do What They Say? An Executable-Contract Audit of Tool-Using Agent Environments29 Sep 2026
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Control20 Aug 2026
- 2026Outcome Monitors: Recovery Affordances for Silent Tool Failures19 Aug 2026
- 2026Agent Behavioral Contracts II: Certifying Compositional Reliability Without Assuming Independence13 Aug 2026
- 2026Behavioral Governance for Autonomous AI Agents: The AgentBound Framework29 Jun 2026
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment18 May 2026
- 2026Exploiting LLM Agent Supply Chains via Payload-less Skills14 May 2026
- 2026Skill Drift Is Contract Violation: Proactive Maintenance for LLM Agent Skill Libraries9 May 2026
- 2026MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Security7 May 2026
- 2026Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation7 May 2026
- 2026Retrieval-Conditioned Topology Selection with Provable Budget Conservation for Multi-Agent Code Generation7 May 2026
- 2026Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense4 May 2026
6 more
- 2026Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents27 Apr 2026
- 2026When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escape25 Apr 2026
- 2026Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with a Proof-of-Concept Evaluation on Embodied Agents9 Apr 2026
- 2026SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems3 Apr 2026
- 2026Runtime Governance for AI Agents: Policies on Paths17 Mar 2026
- 2026Formal Analysis and Supply Chain Security for Agentic AI Skills27 Feb 2026
- 2026Formal Analysis and Supply Chain Security for Agentic AI Skillscited by 21
- 2026Runtime Governance for AI Agents: Policies on Pathscited by 17
- 2026Exploiting LLM Agent Supply Chains via Payload-less Skillscited by 5
- 2026Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defensecited by 3
- 2026Skill Drift Is Contract Violation: Proactive Maintenance for LLM Agent Skill Librariescited by 3
- 2026SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systemscited by 2
- 2026When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escapecited by 1
- 2026Retrieval-Conditioned Topology Selection with Provable Budget Conservation for Multi-Agent Code Generationcited by 1
- 2026Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolationcited by 1
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deploymentcited by 1
- 2026Agent Behavioral Contracts II: Certifying Compositional Reliability Without Assuming Independencecited by 1
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Controlcited by 0
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Control20 Aug 2026
- 2026Agent Behavioral Contracts II: Certifying Compositional Reliability Without Assuming Independence13 Aug 2026
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment18 May 2026
- 2026Exploiting LLM Agent Supply Chains via Payload-less Skills14 May 2026
- 2026Skill Drift Is Contract Violation: Proactive Maintenance for LLM Agent Skill Libraries9 May 2026
- 2026Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation7 May 2026
- 2026Retrieval-Conditioned Topology Selection with Provable Budget Conservation for Multi-Agent Code Generation7 May 2026
- 2026Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense4 May 2026
- 2026When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escape25 Apr 2026
- 2026SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems3 Apr 2026
- 2026Runtime Governance for AI Agents: Policies on Paths17 Mar 2026
- 2026Formal Analysis and Supply Chain Security for Agentic AI Skills27 Feb 2026
- 2026MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Securitycited by 2
- 2026Outcome Monitors: Recovery Affordances for Silent Tool Failurescited by 2
- 2026Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agentscited by 1
- 2026Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with a Proof-of-Concept Evaluation on Embodied Agentscited by 0
- 2026Behavioral Governance for Autonomous AI Agents: The AgentBound Frameworkcited by 0
- 2026Do Agent Benchmarks Do What They Say? An Executable-Contract Audit of Tool-Using Agent Environmentscited by 0
- 2026Do Agent Benchmarks Do What They Say? An Executable-Contract Audit of Tool-Using Agent Environments29 Sep 2026
- 2026Outcome Monitors: Recovery Affordances for Silent Tool Failures19 Aug 2026
- 2026Behavioral Governance for Autonomous AI Agents: The AgentBound Framework29 Jun 2026
- 2026MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Security7 May 2026
- 2026Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents27 Apr 2026
- 2026Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with a Proof-of-Concept Evaluation on Embodied Agents9 Apr 2026
Similar, not cited
Close in wording, no citation either way
- 2026Trust Is Not a Score: Runtime Assurance Contracts for High-Risk AI Agents
- 2026Specifying AI-SDLC Processes: A Protocol Language for Human-Agent Boundaries
- 2026Containment Verification: AI Safety Guarantees Independent of Alignment
- 2026A Policy Algebra for Trust-Preserving Agentic AI Execution
- 2026Maat: Independent Deterministic Contract-Based Governance for Multi-Agent LLM Workflows
- 2026Harness as an Asset: Enforcing Determinism via the Convergent AI Agent Framework (CAAF)
- 2026Engineering Reliable Commit Gates for Agentic AI: Cost-Aware Verification Portfolios under Common-Mode Data Failures
- 2026A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance