Beyond Agent Harnesses: Cross-Substrate Authority for Multi-Agent Systems
Yang Li and Sergey Volkov at the University of Hong Kong with collaborators name the cross-substrate authority gap, where the fact that decides whether an action is safe lives in a runtime, registry or approval service that the planner cannot see, and show a deterministic execution-time check handles it where planner-side evidence does not.
Ask this paper
The gap, stated precisely: Agentic systems keep model-visible memory while mutating workspaces, but authority state can sit outside both, so two runs producing identical final files can require opposite safe actions.
Experiment 1 isolates the missing fact: In a 128-cell evidence ablation, authority-blind candidate evidence gets 0 of 32 final semantic successes while raw receipts and a typed relation each get 32 of 32. Typed packaging gives no observed planning-accuracy gain over equal raw information.
Experiment 2 shows planning stays unreliable: Across 96 planning calls, workspace-visible evidence produces 12 of 16 unsafe publication decisions, and even with the typed relation only 15 of 32 first actions are correct with 11 of 32 invalid or absent.
Experiment 3 moves the check to execution: Replaying the same 32 fixed model-generated intents with zero additional model calls, a deterministic execution guard blocks all six unsafe intents and permits all 12 valid authorized publishes.
The conclusion for system design: Authority enforcement belongs at the mutation boundary rather than in planner observations, which the authors position as the operational endpoint of memory governance.
Abstract
Agentic systems persist model-visible memory while mutating workspaces, while a runtime, registry, or approval service may hold authority state outside both. Identical final files can then require opposite safe actions. We call this the cross-substrate authority gap: decision- relevant authorization information resides outside the planner-visible workspace or memory state. Across two controlled mini-benchmark families, three experiments compare planner-observation augmentation with an execution-time authority check using real Git lineage, durably recorded agent execution attempts, deterministic oracles, and two model routes. Experiment 1 is a 128-cell controlled evidence ablation: authority-blind candidate evidence obtains 0/32 final semantic success, while raw receipts and a typed relation both obtain 32/32. The missing authority fact accounts for the gain; typed packaging provides no observed planning-accuracy gain over equal raw information. Experiment 2 uses 96 planning calls: workspace-visible evidence yields 12/16 unsafe publication decisions, and planning with the typed relation remains unreliable (15/32 first actions correct; 11/32 invalid or absent). Experiment 3 replays the same 32 fixed model-generated first-action intents with zero additional model calls; a deterministic execution guard prevents all six unsafe intents from becoming effects and permits all 12 valid authorized publish intents. These results position authority enforcement at the mutation boundary as the operational endpoint of memory governance.