Search papers, labs, and topics across Lattice.
The authors investigate the "cross-substrate authority gap"鈥攚here critical authorization state resides outside an agent's visible context or workspace鈥攂y benchmarking prompt-level authority augmentation against execution-time guards across multi-agent Git environments. They show that while surfacing authority relations into context boosts semantic task completion over blind baselines, model planning remains dangerously brittle, yielding unsafe publication actions in 12 of 16 runs. Ultimately, placing a deterministic execution guard directly at the workspace mutation boundary blocked 100% of unauthorized actions without extra model calls, demonstrating that safe memory governance cannot rely on planner-visible context alone.
Even when provided with complete authorization proofs in-context, LLM planners still execute unsafe mutations up to 75% of the time, proving that agent authority must be enforced deterministically at the execution boundary rather than delegated to model reasoning.
Agentic systems persist model-visible memory while mutating workspaces, while a runtime, registry, or approval service may hold authority state outside both. Identical final files can then require opposite safe actions. We call this the cross-substrate authority gap: decision- relevant authorization information resides outside the planner-visible workspace or memory state. Across two controlled mini-benchmark families, three experiments compare planner-observation augmentation with an execution-time authority check using real Git lineage, durably recorded agent execution attempts, deterministic oracles, and two model routes. Experiment 1 is a 128-cell controlled evidence ablation: authority-blind candidate evidence obtains 0/32 final semantic success, while raw receipts and a typed relation both obtain 32/32. The missing authority fact accounts for the gain; typed packaging provides no observed planning-accuracy gain over equal raw information. Experiment 2 uses 96 planning calls: workspace-visible evidence yields 12/16 unsafe publication decisions, and planning with the typed relation remains unreliable (15/32 first actions correct; 11/32 invalid or absent). Experiment 3 replays the same 32 fixed model-generated first-action intents with zero additional model calls; a deterministic execution guard prevents all six unsafe intents from becoming effects and permits all 12 valid authorized publish intents. These results position authority enforcement at the mutation boundary as the operational endpoint of memory governance.
