# Can AI Agents Deliver Verifiable Network-Wide Outcomes Across Authority Boundaries?

arXiv: https://arxiv.org/abs/2609.10181 · HTML: https://mlsanity.com/paper/2609.10181/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 16 references that are in the map.
- First posted on arXiv 9 Sep 2026.

## Builds on (most cited first, 8 of 8)

- [AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents](https://mlsanity.com/paper/2503.18666/) (2025)
- [Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework](https://mlsanity.com/paper/2601.11893/) (2026)
- [What do LLMs need to Synthesize Correct Router Configurations?](https://mlsanity.com/paper/2307.04945/) (2023)
- [Enhancing Network Management Using Code Generated by Large Language Models](https://mlsanity.com/paper/2308.06261/) (2023)
- [NetAgentBench: A State-Centric Benchmark for Evaluating Agentic Network Configuration](https://mlsanity.com/paper/2604.09678/) (2026)
- [Contract-based Agentic Intent Framework for Network Slicing in O-RAN](https://mlsanity.com/paper/2603.01663/) (2026)
- [Evaluating Agentic Configuration Repair for Computer Networks](https://mlsanity.com/paper/2606.06212/) (2026)
- [From Network Automation to Trustworthy Autonomous Networking in the LLM Era: A Network Control Intelligence Perspective](https://mlsanity.com/paper/2608.01538/) (2026)

## Abstract (arXiv)

AI agents are increasingly involved in network automation, where they can initiate configuration changes through mediated operational interfaces and assess the resulting state. Nonetheless, operational networks usually span many devices and administrative domains. Realizing an operator's intent requires coordinating agents with distinct authority scopes that define the resources they can access, the operations they can invoke, and the network state they can observe. This division limits the blast radius of an erroneous action but fragments the evidence needed to assess the network-wide outcome. Successful execution of a configuration action proposed by one agent does not establish that remote devices responded as intended or that routing changes reached the required devices. A valid observation may also become stale after a subsequent change. Before the coordinated operation can be declared complete, a trusted assurance layer must collect current observations from the required scopes and determine whether they collectively support the operator's intended network-wide outcome. To address the completion admission problem, we present EvidenceNet, a runtime assurance layer for deciding whether coordinated agent operations have achieved an operator's network intent. Its broker collects the post-change observations required by a completion contract, and its admission gate checks that the evidence comes from the required scopes, remains current, and satisfies the task rules. A verifier agent provides an additional assessment of the observation content. Experiments on live routing networks show that post-change state checks recognize successful outcomes that configuration-action records alone cannot establish. Controlled interventions further show that EvidenceNet rejects completion when otherwise satisfactory observations have the wrong source, have been substituted, or are stale.