# Proof-Carrying Agent Actions: Model-Agnostic Runtime Governance for Heterogeneous Agent Systems

arXiv: https://arxiv.org/abs/2606.04104 · HTML: https://mlsanity.com/paper/2606.04104/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 20 references that are in the map.
- First posted on arXiv 2 Jun 2026.

## Builds on (most cited first, 3 of 3)

- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [Auditable Agents](https://mlsanity.com/paper/2604.05485/) (2026)
- [Selective Conformal Risk Control](https://mlsanity.com/paper/2512.12844/) (2025)

## Built on by (most cited first, 7 of 7)

- [CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems](https://mlsanity.com/paper/2607.13716/) (2026)
- [Final Authority in AI Governance: Frontier-Provider Sovereignty and Action-Centered Deployer Governance](https://mlsanity.com/paper/2607.13040/) (2026)
- [PRIMUS: Identity, Governance, and Verification for Multi-Agent Federations](https://mlsanity.com/paper/2609.07910/) (2026)
- [ZeroGate: Trust-Preserving Fast Paths for Governed AI Agent Runtimes](https://mlsanity.com/paper/2609.25443/) (2026)
- [Beyond Approved Actions: Runtime Validation of Persistent Outcomes in Agent Workflows](https://mlsanity.com/paper/2609.31301/) (2026)
- [Same Winners, Different Success Rates: Evaluating How LLM Agents Recover from Failures](https://mlsanity.com/paper/2609.34215/) (2026)
- [KedgeFlow: A Programmable Control Plane for Enterprise AI Agents](https://mlsanity.com/paper/2610.14810/) (2026)

## Abstract (arXiv)

Agent systems execute through runtimes with very different control points: local coding tools, framework SDKs, managed agent platforms, API gateways, and observer-only integrations. A high-risk action such as publishing data externally may therefore appear as a shell command in one runtime, a tool call in another, and a hosted session transition in a third. This makes it difficult to answer a basic governance question consistently: what action was authorized, under whose authority, with what approval semantics, and with what evidence after execution? This paper presents Proof-Carrying Agent Actions (PCAA), a runtime-neutral governance model centered on an action certificate rather than on a vendor-native session record. PCAA organizes control around five checkpoints: pre-action admissibility, action open, assumption capture, approval, and outcome closure. It binds these checkpoints to a portable action envelope, runtime and approval receipts, and replay-ready proof. The model is extended in two practical ways: the certificate is externality-aware, carrying boundary facts such as destination visibility and account provenance, and approval is described by explicit enforceability classes rather than by a single reviewed or unreviewed bit. We study the model through a reference implementation in a heterogeneous agent control plane and a disclosure-bounded evaluation protocol. On a protected benchmark expanded from 24 executable seeds to 96 traces across four runtime families, PCAA preserves route quality while exposing distinct failure modes under ablation. The paper contributes a systems formulation of runtime governance around certificate-bearing actions and an implementation-grounded account of how that formulation can remain portable under runtime churn without collapsing into vendor-specific control surfaces.