# Organizational Control Layer: Governance Infrastructure at the Execution Boundary of LLM Agent Systems

arXiv: https://arxiv.org/abs/2606.04306 · HTML: https://mlsanity.com/paper/2606.04306/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Placed in General LLM agent frameworks and benchmarks, one of 16 directions in LLM agents and tool use.
- Builds on 22 of its 45 references that are in the map.
- First posted on arXiv 3 Jun 2026.

## Placed in

- LLM agents and tool use / [General LLM agent frameworks and benchmarks](https://mlsanity.com/agents/general-llm-agent-frameworks-and-benchmarks/)

## Builds on (most cited first, 22 of 22)

- [Training language models to follow instructions with human feedback](https://mlsanity.com/paper/2203.02155/) (2022)
- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [WebArena: A Realistic Web Environment for Building Autonomous Agents](https://mlsanity.com/paper/2307.13854/) (2023)
- [AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation](https://mlsanity.com/paper/2308.08155/) (2023)
- [CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Society](https://mlsanity.com/paper/2303.17760/) (2023)
- [Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations](https://mlsanity.com/paper/2312.06674/) (2023)
- [Why Do Multi-Agent LLM Systems Fail?](https://mlsanity.com/paper/2503.13657/) (2025)
- [Multi-Agent Collaboration Mechanisms: A Survey of LLMs](https://mlsanity.com/paper/2501.06322/) (2025)
- [NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails](https://mlsanity.com/paper/2310.10501/) (2023)
- [Defeating Prompt Injections by Design](https://mlsanity.com/paper/2503.18813/) (2025)
- [Cooperate or Collapse: Emergence of Sustainable Cooperation in a Society of LLM Agents](https://mlsanity.com/paper/2404.16698/) (2024)
- [Proactive Agent: Shifting LLM Agents from Reactive Responses to Active Assistance](https://mlsanity.com/paper/2410.12361/) (2024)
- [ContextAgent: Context-Aware Proactive LLM Agents with Open-World Sensory Perceptions](https://mlsanity.com/paper/2505.14668/) (2025)
- [MAS-ZERO: Designing Multi-Agent Systems with Zero Supervision](https://mlsanity.com/paper/2505.14996/) (2025)
- [LLM Economist: Large Population Models and Mechanism Design in Multi-Agent Generative Simulacra](https://mlsanity.com/paper/2507.15815/) (2025)
- [Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs](https://mlsanity.com/paper/2601.11369/) (2026)
- [Towards Enforcing Company Policy Adherence in Agentic Workflows](https://mlsanity.com/paper/2507.16459/) (2025)
- [MARS: toward more efficient multi-agent collaboration for LLM reasoning](https://mlsanity.com/paper/2509.20502/) (2025)
- [Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents](https://mlsanity.com/paper/2603.20953/) (2026)
- [AgenticPay: A Multi-Agent LLM Negotiation System for Buyer-Seller Transactions](https://mlsanity.com/paper/2602.06008/) (2026)
- [Evaluating Multi-Turn Bargain Skills in LLM-Based Seller Agent](https://mlsanity.com/paper/2509.06341/) (2025)
- [What Makes a Sale? Simulating End-to-End Seller--Buyer Retail Dynamics with LLM Agents](https://mlsanity.com/paper/2604.04468/) (2026)

## Built on by (most cited first, 3 of 3)

- [Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit](https://mlsanity.com/paper/2608.27427/) (2026)
- [The Civilization Framework: Sovereign-Anchored Communication Between Personal Multi-Agent Systems](https://mlsanity.com/paper/2609.03425/) (2026)
- [PRIMUS: Identity, Governance, and Verification for Multi-Agent Federations](https://mlsanity.com/paper/2609.07910/) (2026)

## Abstract (arXiv)

LLM-based agents are increasingly deployed in workflows where generated outputs may trigger state-changing actions, such as price offers, refunds, payments, or tool calls. This creates an execution-boundary problem: a platform must decide whether an agent's proposed action is authorized before the action is executed. We introduce the Organizational Control Layer (OCL), a model-agnostic governance layer that separates proposal generation from environment-facing execution. OCL intercepts generated actions, checks them against role, policy, and economic constraints, and either approves, revises, blocks, or escalates them without modifying the underlying LLM generator. We evaluate OCL on adversarial buyer--seller negotiation environments adapted from AgenticPay. Across multiple frontier LLM backends, OCL reduces observed unsafe executions from 88% to 0% while increasing valid success from 12% to 96%. Ablations show that this gain comes from combining pre-execution enforcement with structured recovery, rather than from prompting or blocking alone. These results suggest that deployment-grade LLM agent systems require explicit governance at the boundary between language generation and executable action.