A new arXiv paper argues that agent safety cannot depend only on prompts once AI systems can modify files, send messages, launch jobs, or change workflow state.
The proposed system, Aegis, treats a model’s output as an action proposal rather than an instruction to execute immediately. A trusted runtime checks the proposal against active policy, resolves provenance on the server side, fails closed when uncertain, and can route selected cases through a quorum-style authorization process.
That design shifts governance from “make the model behave” to “control the boundary where actions happen.” The authors evaluated Aegis across repeated sandbox tasks and compared prompt-policy conditioning with runtime mediation.
The practical consequence is clear for teams building agents with real permissions: safety controls need to live in infrastructure, not just in model instructions. The paper is still a research system, but it describes a pattern that resembles how mature software systems already handle authorization, auditing, and failure under uncertainty.