# From Agent Output to Authorized Transition

arXiv: https://arxiv.org/abs/2609.28216 · HTML: https://mlsanity.com/paper/2609.28216/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 20 of its 62 references that are in the map.
- First posted on arXiv 23 Sep 2026.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 20 of 20)

- [Identifying the Risks of LM Agents with an LM-Emulated Sandbox](https://mlsanity.com/paper/2309.15817/) (2023)
- [Runtime Governance for AI Agents: Policies on Paths](https://mlsanity.com/paper/2603.16586/) (2026)
- [AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents](https://mlsanity.com/paper/2605.26269/) (2026)
- [CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents](https://mlsanity.com/paper/2602.19547/) (2026)
- [Deontic Policies for Runtime Governance of Agentic AI Systems](https://mlsanity.com/paper/2606.19464/) (2026)
- [Proof-or-Stop: Don't Trust the Agent, Trust the Evidence -- Loop Engineering for Verifiable Evidence-Gated Lifecycle Control](https://mlsanity.com/paper/2607.14890/) (2026)
- [SWE-Bench Pro Verified: A Reliable Benchmark for Software Engineering Agents](https://mlsanity.com/paper/2609.08149/) (2026)
- [DEMM-Bench: A Cross-Regime Benchmark for Agent-Runtime Governance-Evidence Sufficiency](https://mlsanity.com/paper/2606.20634/) (2026)
- [Cognitive Admission Control: Risk-Conditioned Assurance for Consequential Actions in Agentic Distributed Systems](https://mlsanity.com/paper/2609.16313/) (2026)
- [Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines](https://mlsanity.com/paper/2601.23132/) (2026)
- [Agentic Agile-V: From Vibe Coding to Verified Engineering in Software and Hardware Development](https://mlsanity.com/paper/2605.20456/) (2026)
- [Cheap Code, Costly Judgment: A Case Study on Governable Agentic Software Engineering](https://mlsanity.com/paper/2607.01087/) (2026)
- [Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement](https://mlsanity.com/paper/2608.14590/) (2026)
- [Trustworthy AI Posture (TAIP): A Framework for Continuous AI Assurance of Agentic Systems at Horizontal and Vertical scale](https://mlsanity.com/paper/2603.03340/) (2026)
- [Decision Evidence Maturity Model for Agentic AI: A Property-Level Method Specification](https://mlsanity.com/paper/2605.04093/) (2026)
- [pcbGPT: Automatic PCB Schematic Synthesis from Natural Language Requirements](https://mlsanity.com/paper/2606.01188/) (2026)
- [Graphectory Viewer: A Tool for Process-Centric Analysis of Agentic Software Trajectories](https://mlsanity.com/paper/2608.17195/) (2026)
- [Beyond Code Generation: Reliability, Verification, and Cost Economics in the Agentic Software Development Lifecycle](https://mlsanity.com/paper/2609.04681/) (2026)
- [Agent-Integrated Software: Interaction Contracts and Continuous Assurance](https://mlsanity.com/paper/2609.11381/) (2026)
- [AI-GRACE: A Use-Case Operationalization Framework for Agentic AI: From Organizational Objectives and Obligations to Deployment Capabilities and Architecture](https://mlsanity.com/paper/2609.21192/) (2026)

## Abstract (arXiv)

Agentic engineering systems can edit repositories, run tools and tests, build firmware, synthesize schematics, and prepare deployable or manufacturable artifacts. The assurance problem is therefore shifting from whether an agent can produce an output to whether an engineering lifecycle is justified in acting on claims about that output. Current products and standards provide sandboxes, approvals, hooks, traces, policy enforcement, attestations, bills of materials, and assurance representations, but these capabilities remain fragmented. This paper presents the Agile-V Assurance Spine, a cross-domain transition contract for software, firmware, and PCB engineering. Evidence is admitted only when it establishes required properties through an authoritative source profile, is bound to the exact artifact and frozen policy baseline, remains current with respect to declared dependencies, and satisfies risk-appropriate independence and authority. Gate decisions are recorded as receipts; approvals and exceptions are exact-scope and time-bounded; and authorization is rechecked at the effect boundary before merge, deployment, flashing, release, or fabrication. A bounded review of contemporary research, commercial platforms, open-source infrastructure, and standards positions the model relative to evidence-gated lifecycle control, continuous assurance, runtime admission, provenance, and AI/ML inventories. The paper contributes a precise vocabulary, compositional architecture, domain profiles, mapping to open-source implementations, and an adversarial evaluation agenda. It does not claim regulatory conformity or demonstrated production superiority.