Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales
Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
Why It Matters
What makes this one worth your time
This work is relevant for AI engineers and researchers focused on enhancing the reliability and governance of AI agent actions, particularly in environments where trust in model rationales is insufficient.
EBTE offers a server-verified approach to ensure AI agent actions align with predefined policies without relying on model rationales.
Summary
The paper introduces Explanation-Bound Tool Execution (EBTE), a mediation layer for AI agents that converts rationales into action claims and verifies them against server-held facts to ensure compliance with intent and policy. The approach is tested across various scenarios, demonstrating its ability to handle contradictions and maintain conformance with specified profiles.
Key contributions
- Introduction of Explanation-Bound Tool Execution (EBTE) for AI agents.
- Formalization of a mediation layer that verifies action claims against server-held facts.
- Implementation and testing of EBTE across multiple scenarios to demonstrate its effectiveness.
Notable insights
- EBTE transforms decision-relevant rationales into structured claims for server verification, reducing reliance on model introspection.
- The approach includes a versioned reference profile with minimized audit packets to ensure efficient conformance checking.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2607.25364v2 Announce Type: new Abstract: Tool-using agents expose structured calls but commonly attach free-form rationales. Such rationales are neither authorization nor reliable introspection. We present Explanation-Bound Tool Execution (EBTE), a claim-carrying mediation layer that converts decision-relevant rationale content into typed action claims and checks them against server-held intent, policy, payload, tool, risk, provenance, and freshness facts. EBTE cannot widen baseline authority: conflicts deny, incomplete or uncertain claims review, and only matching claims remain eligible for governed execution. We formalize this composition under explicit mediation and trusted-fact assumptions and implement a versioned reference profile with minimized audit packets. Across 136 authored conformance scenarios, the full profile matches all specified dispositions, admits none of 96 designated hard contradictions, and passes 232 metamorphic checks. A draft-only reference integration forwards none of 48 authored hard cases under EBTE while preserving all 16 soft-review and 4 aligned draft paths. In a frozen 2026-07-12 exploratory 224-attempt hosted-model record, the historical generation/runner agreement counts are 71/96, 66/96, and 19/32; a zero-call revalidation of the preserved minimized claims under the current pipeline yields 70/96, 65/96, and 17/32. In an AgentDojo-derived semantic check, existing high-risk controls make all 12 attack proposals non-allow, while EBTE resolves the task--proposal contradictions as deny. Together, these studies establish profile conformance and demonstrate the feasibility of server-checked action claims within the evaluated settings.