# Autonomy in Check: Governor-Mediated Adaptive Security at the Edge

arXiv: https://arxiv.org/abs/2609.18338 · HTML: https://mlsanity.com/paper/2609.18338/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 31 references that are in the map.
- First posted on arXiv 16 Sep 2026.

## Builds on (most cited first, 10 of 10)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Safe Reinforcement Learning via Shielding](https://mlsanity.com/paper/1708.08611/) (2017)
- [AgentSight: System-Level Observability for AI Agents Using eBPF](https://mlsanity.com/paper/2508.02736/) (2025)
- [Vehicular Edge Computing and Networking: A Survey](https://mlsanity.com/paper/1908.06849/) (2019)
- [A Survey of Challenges for Runtime Verification from Advanced Application Domains (Beyond Software)](https://mlsanity.com/paper/1811.06740/) (2018)
- [A Comprehensive Tutorial and Survey of O-RAN: Exploring Slicing-aware Architecture, Deployment Options, Use Cases, and Challenges](https://mlsanity.com/paper/2405.03555/) (2024)
- [Agentic AI for 6G: A New Paradigm for Autonomous RAN Security Compliance](https://mlsanity.com/paper/2512.12400/) (2025)
- [MobiLLM: An Agentic AI Framework for Closed-Loop Threat Mitigation in 6G Open RANs](https://mlsanity.com/paper/2509.21634/) (2025)
- [Adaptive Lightweight Security for Performance Efficiency in Critical Healthcare Monitoring](https://mlsanity.com/paper/2406.03786/) (2024)
- [Adaptive Security at the Edge for 6G-Enabled Healthcare IoT](https://mlsanity.com/paper/2607.27858/) (2026)

## Abstract (arXiv)

Adaptive security at the network edge increasingly relies on automated planners, including rule-based controllers, learned policies, and LLM-assisted agents, that translate observations into enforcement actions. Once such a planner can influence live policy state, syntactic validity is not enough. A semantically wrong action, produced from incomplete or manipulated observations, can be faithfully executed by an enforcement substrate that cannot judge mission context. We address this problem by treating the boundary between planner output and kernel enforcement input as the primary security object. We propose a split-control architecture in which an untrusted planner emits typed security intents, a deterministic governor checks each intent against safety, resource, temporal-stability, and proportionality invariants, and only admitted actions are bound to signed receipts and compiled into pre-installed eBPF map updates. The paper formalizes this trust-boundary problem, defines three threat classes, develops the governor admission predicate, and reports an end-to-end prototype. Across rule-based and LLM-assisted planners on a Raspberry Pi 5 testbed connected to the university 5G Test Network, the governor admits, rejects, and bounds intents at microsecond cost without disrupting protected-flow regularity. The contribution is conceptual as much as empirical: adaptive security does not need to trust the author of an action. It needs a mediation boundary that decides whether the action is admissible.