Observability for Delegated Execution in Agentic AI Systems
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Delegation-scoped execution is not identifiable from standard observables: audit logs and execution traces can be identical under multiple incompatible delegation assignments. This gap is especially acute in LLM-based agentic systems, where agents dynamically select tools, vary execution sequences across runs for the same instruction, and spawn cooperating sub-agents. These dynamics fragment and interleave traces, making delegation-scoped reconstruction from causal structure alone structurally underdetermined. Although individual actions are authorized and logged, existing audit, tracing, and security schemas lack the semantics to reconstruct what actions occurred under a given delegation across heterogeneous systems. We focus on delegation-scoped attribution and access/share footprint reconstruction, not intent inference or reasoning reconstruction. We present an agent-aware observability substrate consisting of a lightweight gateway and a common information model that binds delegation context at execution time. This enables reliable cross-tool delegation-scoped reconstruction and direct forensic queries without heuristic time-window correlation.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 13 of its 44 references that are in the map. First posted on arXiv 8 Jun 2026.
Builds on
13 of 44 references.
Closest ancestors · 3
Same direction, newest first
- 2025Agentic Misalignment: How LLMs Could Be Insider Threats5 Oct
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
- 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep
Other references · 10
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,568
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
- 2024ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stagescited by 82
- 2018HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flowscited by 43
- 2018SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Datacited by 28
- 2017Practical Whole-System Provenance Capturecited by 19
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026When Agents Act Unwatched: The Reduced-Supervision Paradox in Agentic AI
- 2026AgentTrace: A Structured Logging Framework for Agent System Observability
- 2025Verifiability-First Agents: Provable Observability and Lightweight Audit Agents for Controlling Autonomous LLM Systems
- 2026Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI
- 2026SARC: A Governance-by-Architecture Framework for Agentic AI Systems
- 2026One Monitor Does Not Fit All: Formalism-Agnostic Runtime Verification for Agentic AI
- 2026Reasoning Provenance for Autonomous AI Agents: Structured Behavioral Analytics Beyond State Checkpoints and Execution Traces
- 2026Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent Systems