Toward a Science of Intent: Closure Gaps and Delegation Envelopes for Open-World AI Agents Maximiliano Armesto Christophe Kolb Taller Technologies
arXiv:2604.25000v1 [cs.AI] 27 Apr 2026
[email protected] [email protected]
Abstract Recent work has framed intelligence in verifiable tasks as reducing time-to-solution through learned structure and test-time search, while systems work has explored learned runtimes in which computation, memory and I/O migrate into model state. These perspectives do not explain why capable models remain difficult to deploy in open institutions. We propose intent compilation: the transformation of partially specified human purpose into inspectable artifacts that bind execution. The relevant deployment distinction is closed-world solver versus open-world agent. In closed worlds, a checker is largely given; in open worlds, verification is distributed across semantic, evidentiary, procedural and institutional dimensions. We formalize this residual openness as a closure-gap vector, define delegation envelopes as pre-authorized regions of action space, distinguish misclosure from undersearch, and outline benchmark metrics for testing when closure interventions outperform additional inference-time search.
Keywords. Agentic AI; intent representation; AI governance; runtime verification; policy-as-code; humanAI interaction; authorization; benchmarks.
1
Introduction
Recent work on agents emphasizes time: once a task is verifiable, learned structure and test-time compute reduce time-to-solution [1–5]. In parallel, work on world models and learned runtimes asks how much computation, memory and I/O can migrate into learned state [6–8]. These programs explain faster solving, richer planning and reusable computation. They do not settle a different question: when is a candidate output authorized to become an institutional action? A large class of deployed-system failures arises not from inability to generate a plausible answer, but from failure to bind it to the right task, admissible evidence, permitted procedure or legitimate authority. A legal assistant may draft a correct clause but not be authorized to send it; a security agent may identify a compromised host but lack authority to delete data; a travel agent may find a cheaper itinerary using a stale policy document. The failure is not merely weak reasoning. It is missing closure. This paper names the missing object: intent compilation, the externalization of partially specified purpose into artifacts that bind a stochastic runtime: what is asked, what evidence may be used, what procedure may be followed and who is authorized to act. The compiler analogy is disciplined. A classical compiler lowers explicit source code into executable form; intent compilation starts earlier, from goals, assumptions, risk tolerances and institutional roles, and targets a composite runtime of model, evidence substrate, tool harness, monitors and governance shell. The language-model-versus-world-model distinction matters for internal mechanism, but it is insufficient for deployment. The relevant distinction is closed-world solver versus open-world agent. In a closed-world task, the checker is largely given: legal moves, success criteria and admissible evidence are settled in advance. 1
In an open-world task, the checker is distributed across unresolved semantic, evidentiary, procedural and institutional conditions. Additional search may help when those conditions are settled; otherwise longer reasoning traces can become fluent work over an undercompiled problem. Contributions. The paper defines intent compilation, closure gaps, time-to-authorized-action, delegation envelopes and misclosure, then proposes benchmark metrics for testing when closure interventions outperform additional search. Methodological status and scope. This article is a conceptual framework and research agenda, not an empirical report of a new deployed system. It defines intent compilation and constructs for testing it: closure gaps, contracts, delegation envelopes, misclosure and time-to-authorized-action. Claims about compilation versus search are hypotheses and benchmark designs. Author-developed systems named later are illustrative, not independent evidence.
2
Preliminaries: task episodes, actions, and openness
We use “open-world” operationally rather than in the narrow knowledge-representation sense. A task episode is open when the conditions for valid action remain materially underspecified at run time. This underspecification may concern meaning, evidence, method, or authority. Definition 1 (Task episode). A task episode is a tuple 𝑒 = (𝑢, 𝑥, 𝐴, 𝑅, 𝑃, ℎ0 ), where 𝑢 is a user request, 𝑥 is non-linguistic context, 𝐴 is the available action space, 𝑅 is the evidence substrate, 𝑃 is the operative policy or institutional rule set, and ℎ0 is the initial interaction history. A task episode is closed to the extent that the validity conditions for actions in 𝐴 are already specified. It is open to the extent that those conditions must be resolved during the episode. Definition 2 (Action). An action is not merely text. We write 𝑎 = (𝑜 𝑝, 𝑜𝑏 𝑗, 𝑐𝑜𝑛𝑡𝑒𝑛𝑡, 𝑎𝑐𝑡𝑜𝑟, 𝑡𝑜𝑜𝑙, 𝑡), where 𝑜 𝑝 is an operation, 𝑜𝑏 𝑗 the object of the operation, 𝑐𝑜𝑛𝑡𝑒𝑛𝑡 the informational payload, 𝑎𝑐𝑡𝑜𝑟 the acting role or principal, 𝑡𝑜𝑜𝑙 the execution channel, and 𝑡 the time. The same textual content can be authorized as analysis, prohibited as execution, or mandatory to escalate depending on the other components of the action. The surface string underdetermines the action. “Notify the customer” may mean drafting, sending, logging or requesting approval. “Fix the vendor issue” may require retrieving a contract, opening a ticket, issuing a credit or escalating to legal. Linguistic competence is only one part of the episode. Definition 3 (Intent compilation). Given a task episode 𝑒, intent compilation is the process of producing a contract tuple 𝐾𝑡 = (𝑆𝑡 , 𝐸 𝑡 , 𝑀𝑡 , 𝐼𝑡 ), where 𝑆𝑡 specifies task semantics, 𝐸 𝑡 specifies evidence admissibility, 𝑀𝑡 specifies permitted method, and 𝐼𝑡 specifies institutional authority. The compiler also exposes residual closure gaps indicating which parts of the episode remain insufficiently specified for autonomous action. The notation 𝑀𝑡 denotes method and avoids overloading 𝑃, which denotes operative policy. The contracts are architectural roles, not product categories. They can be implemented by typed schemas, retrieval rules, workflow engines, monitors, access-control systems, approval queues or combinations of these mechanisms. 2
3
Closure gaps and time-to-authorized-action
A closed-world task can be evaluated against a checker that is assumed to exist. An open-world task requires the system to help construct, retrieve, or ratify parts of the checker before acting. We represent the unresolved remainder by a closure-gap vector 𝐶𝑡 = (𝐶sem,𝑡 , 𝐶evid,𝑡 , 𝐶proc,𝑡 , 𝐶inst,𝑡 ). The four components ask: what exactly is being asked; on what grounds; by what method; and under whose authority? Definition 4 (Closure gap). Let J = {sem, evid, proc, inst}. For 𝑖 ∈ J , let 𝜌𝑖 (𝐾𝑡 , ℎ𝑡 ) be an idealized indicator that contract dimension 𝑖 is sufficiently specified for the class of actions under consideration at history ℎ𝑡 . A probabilistic closure gap is 𝐶𝑖,𝑡 = 1 − Pr 𝜌𝑖 (𝐾𝑡 , ℎ𝑡 ) = 1 | ℎ𝑡 , 𝐾𝑡 . A cost-sensitive closure gap is 𝑐 𝐶𝑖,𝑡 = E [cost to close𝑖 | ℎ𝑡 , 𝐾𝑡 ] .
Observable signals such as clarification frequency, citation conflicts, retry depth, or permission-denied events are proxy features for estimating these latent gaps. They are not the gaps themselves. The four-way decomposition is operational, not exhaustive. It mirrors the recurring structure of authorized action: content, grounds, method and authority. Risk is not treated as a fifth contract; it is a cross-cutting severity parameter that changes the threshold of closure required before action. A reversible formatting change may tolerate modest closure; a medical recommendation, production deployment, or legal commitment requires much stricter closure across all contracts.
3.1
From latency decomposition to event traces
It is tempting to write 𝑇authorized ≈ 𝑇compile + 𝑇search + 𝑇escalate . This expression is rhetorically useful but formally coarse. Compilation, search and escalation may overlap; retrieval can be both evidence compilation and search; clarification can invalidate prior reasoning; and escalation can halt the episode. We therefore define time-to-authorized-action over an event trace. Let an episode trace be 𝜏 = ((𝑞 1 , 𝑠1 , 𝑓1 , 𝑐 1 ), . . . , (𝑞 𝑛 , 𝑠 𝑛 , 𝑓𝑛 , 𝑐 𝑛 )), where each event has type 𝑞 𝑗 ∈ {compile, search, escalate, execute, wait}, start time 𝑠 𝑗 , finish time 𝑓 𝑗 , and accounting cost 𝑐 𝑗 . The wall-clock time-to-authorized-action is 𝑇authorized = inf{𝑡 : ∃𝑎 𝑡 ∈ 𝐴𝑡 such that 𝑎 𝑡 is ratified or lies inside the delegation envelope} − 𝑠0 . The accounting weight for event class 𝑞 is ∑︁
𝑊𝑞 (𝜏) =
𝑐𝑗.
𝑗:𝑞 𝑗 =𝑞
In sequential episodes, 𝑇authorized may approximate the sum of compile, search, escalation, and waiting intervals. In concurrent or preemptive episodes, 𝑊compile , 𝑊search , and 𝑊escalate should be interpreted as cost categories over the trace rather than as disjoint wall-clock intervals. 3
Hypothesis 1 (Closure intervention hypothesis). On task distributions stratified by high closure gap, interventions that reduce the dominant 𝐶𝑖 will improve time-to-authorized-action and contract compliance more cost-effectively than additional inference-time search, holding base model capability constant. On low-closure-gap tasks, additional search should dominate. This hypothesis is conditional: the marginal value of search depends on whether the world is sufficiently closed for search to be meaningful.
3.2
Routing over loci of intelligence
The closure vector induces a routing policy over loci of intelligence: internal inference, clarification, retrieval, simulation or tool use, escalation, and abstention. Table 1 gives the operational version. Dominant unresolved dimension
Diagnostic signal
Best next move
Closure condition and failure if skipped
Internal search gap
Clear contract but weak candidate, failing tests, low confidence under agreed checker Ambiguous referents, unstable acceptance criteria, repeated clarification questions Stale source, missing provenance, conflicting citations, inadmissible document Tool mismatch, retry loops, missing rollback, workflow violation Role mismatch, missing approval, policy conflict, irreversible action outside role
Think, plan, search, verify
Candidate meets the checker. If skipped: premature or weak solution.
Ask, disambiguate, instantiate task schema
Acceptance criteria are explicit. If skipped: solving the wrong problem.
Retrieve, cite, reconcile, reject inadmissible source
Grounds satisfy evidence policy. If skipped: fluent reasoning from prohibited or untraceable evidence.
Simulate, use approved tool path, monitor, define rollback Escalate, seek approval, abstain
Method satisfies workflow and safety constraints. If skipped: brittle or unsafe actuation. Permission predicate is satisfied or escalation is logged. If skipped: correct answer, wrong decision.
Semantic gap
Evidentiary gap
Procedural gap
Institutional gap
Table 1: Routing policy over closure gaps. Additional search is one intervention among several. The correct next move depends on which component of residual openness dominates.
Figure 1: Intent compilation as a publication-oriented schematic. A partially specified request is externalized into four contracts that expose residual closure gaps and define a delegation envelope for autonomous action, clarification, escalation or abstention.
4
4
The four-contract stack
Intent compilation produces ratification surfaces: points at which a person, team or institution can inspect what will bind the stochastic runtime. The four contracts are separable because each fails differently, and coupled because authorized action requires their conjunction.
4.1
Semantic contract
The semantic contract specifies the task ontology: entities, relations, output schema, acceptance criteria, forbidden interpretations, and ambiguity tolerances. Contemporary prompts sometimes play this role, but prompts are not durable contracts. A robust semantic contract should be typed, versioned, inspectable, and linked to acceptance criteria. This connects intent compilation to requirements engineering and problem frames [9, 10], while shifting the representation target from deterministic software artifacts to stochastic action runtimes. A semantic failure occurs when the system solves a plausible but unauthorized problem. For example, “modernize this service” remains open until boundaries, preserved behavior, release scope, regression tests and acceptance criteria are explicit.
4.2
Evidentiary contract
The evidentiary contract specifies admissible sources, freshness requirements, provenance duties, uncertainty representation, and conflict-resolution rules. Retrieval is one mechanism for evidentiary closure, but the deeper issue is admissibility. A system that reasons from a stale, prohibited, or untraceable source is not epistemically aligned merely because its conclusion is plausible. Retrieval-augmented generation, provenance standards, and software signing systems provide components of this layer [11–13]; intent compilation treats admissibility as part of the task contract rather than as an incidental retrieval setting.
4.3
Procedural contract
The procedural contract defines allowed tools, search budgets, tests, stop conditions, retry rules, monitoring hooks, rollback paths and escalation triggers. These obligations are often scattered across orchestration code, CI pipelines and convention; they should be part of the task’s executable method. Workflow theory, Petri nets, BPMN/YAWL, runtime verification, and agent-computer interfaces provide relevant machinery [14–19]. A procedural failure occurs when a system uses the wrong method even if the answer is acceptable: a patch from an unlogged tool chain may pass tests but fail review because the method is unauditable.
4.4
Institutional contract
The institutional contract defines role, permission, privacy boundary, approval path, logging requirement, rollback right, liability surface, and separation of duties. This layer is technical because it changes the semantics of action. The same content may be permissible as a draft, prohibited as a sent message, or required as an escalation report. Policy-as-code, RBAC, XACML, Cedar, capability systems, separation of duties and accountable algorithms provide ingredients for this layer [20–27]. Throughout, “authorized” means authorized under an explicit operative policy. It does not imply that the policy is ethically justified, socially desirable, or complete. Intent compilation makes authorization inspectable; it does not guarantee that the institution’s rules are good.
5
4.5
Running example: travel rebooking
Consider the request “Rebook the trip because the vendor moved the meeting.” A closed-world solver might search flight options and select an itinerary. An open-world agent must first compile the request. Semantic contract: identify the traveler, trip, meeting time, cabin constraints, arrival deadline, and acceptance criteria. Evidentiary contract: use the current booking record, corporate travel policy, airline inventory less than 15 minutes old, and approved employee profile; reject stale policy documents. Procedural contract: retrieve current booking, check policy, search alternatives, compare fare delta, hold fare if allowed, draft notification, and release any hold if escalation fails. Institutional contract: act autonomously only for domestic rebooking, same cabin, and fare delta below a declared cap; escalate for international travel, visa risk, policy exception, or fare delta above cap. Inside the resulting envelope, the agent may place a fare hold and draft a notification. At the boundary, it asks about a near-cap fare increase. Outside the envelope, it must not purchase a ticket or alter an international itinerary without approval. The itinerary is only one part of the authorized action.
5
A typed intent representation
Free-form prompts are too unstable to carry meaning, evidence policy, procedure and authority. The target is a composable intermediate representation that binds stochastic search without requiring full formalization. Existing stacks provide pieces–JSON Schema for structure, workflow languages for procedure, Rego or Cedar for policy, provenance predicates for evidence–but do not type the four contracts as one object [12, 15, 24, 25]. The following fragment illustrates the target rather than prescribing a syntax. Listing 1: Illustrative typed intent object for the travel-rebooking example. task: objective: "rebook employee travel after meeting change" action_type: "travel_rebooking" semantic_contract: entities: [traveler_id, booking_id, destination] acceptance_criteria: - "arrival before meeting_start_time" - "same cabin unless approved" ambiguity_policy: missing_meeting_time: "ask" evidentiary_contract: admissible_sources: - "corporate_travel_policy:current_version" - "current_booking_record" - "airline_inventory_api:<15min" conflict_resolution: "policy overrides preference" procedural_contract: workflow: - retrieve_booking - check_policy - search_alternatives
6
- hold_fare_if_within_envelope rollback: "release_fare_hold" institutional_contract: autonomous_if: "domestic && fare_delta <= 200 && same_cabin" escalate_if: "international || fare_delta > 200 || visa_risk" audit: "retain_logs_365_days"
The value is not perfect formalization. It is that unresolved fields become visible rather than hidden inside latent model behavior. Compilation relocates ambiguity upward: the remaining ambiguity becomes an explicit decision about whether to ask, retrieve, simulate, escalate or abstain.
6
Delegation envelopes
Ratification need not collapse autonomy into perpetual human approval. Institutions already delegate authority by ratifying rules rather than every individual action. Agentic AI needs the same construct. Definition 5 (Deterministic delegation envelope). For contract tuple 𝐾𝑡 = (𝑆𝑡 , 𝐸 𝑡 , 𝑀𝑡 , 𝐼𝑡 ) and action space 𝐴𝑡 , the deterministic delegation envelope is 𝐷 𝑡 (𝐾𝑡 ) = {𝑎 ∈ 𝐴𝑡 : 𝜎𝑡 (𝑎) ∧ 𝜖 𝑡 (𝑎) ∧ 𝜋𝑡 (𝑎) ∧ 𝜄𝑡 (𝑎)}, where 𝜎𝑡 , 𝜖 𝑡 , 𝜋𝑡 , and 𝜄𝑡 are the semantic, evidentiary, procedural, and institutional predicates induced by the contracts. Inside 𝐷 𝑡 , autonomous action is authorized under the operative policy; at the boundary, the system must ask; outside it, the system must escalate or abstain. Many real envelopes are probabilistic because predicates are inferred from natural language, retrieved evidence, or model judgments. Risk changes the threshold. Definition 6 (Risk-sensitive probabilistic envelope). Let 𝑅(𝑎) be an action severity or materiality score, and let 𝛼(𝑅(𝑎)) be a nondecreasing authorization threshold. The probabilistic delegation envelope is n o 𝐷 𝑡𝛼 (𝐾𝑡 ) = 𝑎 ∈ 𝐴𝑡 : Pr 𝜎𝑡 (𝑎) ∧ 𝜖 𝑡 (𝑎) ∧ 𝜋𝑡 (𝑎) ∧ 𝜄𝑡 (𝑎) | ℎ𝑡 , 𝐾𝑡 ≥ 𝛼(𝑅(𝑎)) . 𝑡
A higher-severity action requires higher confidence that all four predicates hold. Examples are simple: draft but do not send; recommend but do not approve; isolate a host but do not delete data; place a fare hold but do not purchase; modify a branch but do not deploy to production. The point is not to minimize human involvement everywhere. It is to make the boundary of autonomous action explicit, auditable, and reusable.
6.1
Qualified envelope properties
The delegation-envelope formalism supports testable properties, but each requires careful qualification. Proposition 1 (Monotonic tightening). Fix an action space 𝐴𝑡 . If every revised predicate is a logical strengthening of the previous one–𝜎𝑡′ ⇒ 𝜎𝑡 , 𝜖 𝑡′ ⇒ 𝜖 𝑡 , 𝜋𝑡′ ⇒ 𝜋𝑡 , and 𝜄′𝑡 ⇒ 𝜄𝑡 –then 𝐷 ′𝑡 ⊆ 𝐷 𝑡 . Proof sketch. If 𝑎 ∈ 𝐷 ′𝑡 , then 𝑎 satisfies all revised predicates. By implication, it satisfies all original predicates, so 𝑎 ∈ 𝐷 𝑡 . The result does not hold for revisions that add actions, add roles, add tools, or split a coarse action into safer sub-actions; those are envelope revisions, not monotone tightenings. □ 7
Proposition 2 (Composite actions require global sequence constraints). For a composite action sequence 𝛼 = (𝑎 1 , . . . , 𝑎 𝑘 ), component authorization is necessary but not sufficient. The induced sequence envelope is 𝐷 ∗𝑡 = {𝛼 : (
𝑘 Û
𝑎 𝑗 ∈ 𝐷 𝑡 , 𝑗 ) ∧ 𝐺 𝑡 (𝛼)},
𝑗=1
where 𝐺 𝑡 captures ordering constraints, separation of duties, cumulative risk, rollback dependencies and approval inheritance. Individually authorized steps can be jointly prohibited. For example, a user may be allowed to draft a payment instruction and separately approve a payment, while the institution prohibits the same principal from doing both in one workflow. Conversely, a supervisor-approved composite workflow may authorize steps that would not be authorized outside that workflow. Envelope stability is measurable only after defining a perturbation distribution: 𝜇(𝐷 (𝐾)△𝐷 (𝐾 + 𝛿)) 𝑆Δ (𝐷) = 1 − E 𝛿∼Δ . 𝜇(𝐷 (𝐾) ∪ 𝐷 (𝐾 + 𝛿)) Here Δ ranges over semantically preserving or minimally contrastive contract perturbations, △ is symmetric difference, and 𝜇 measures action space. An envelope that flips under paraphrase has low stability.
7
Misclosure: failure taxonomy and benchmark protocol
Answer quality and authorization quality are separable. This separation motivates a new failure class. Definition 7 (Misclosure). A misclosure failure occurs when a system’s candidate output would satisfy a plausible task-level competence checker but cannot be ratified, or is wrongly executed, because one or more semantic, evidentiary, procedural, or institutional contracts was absent, underspecified, incorrectly inferred, or violated. Misclosure is not the same as getting the answer wrong. It is also not the same as refusing too often. Table 2 separates adjacent failures. Failure type
Definition
Example
Undersearch
Contract is clear, but the candidate is wrong or weak. Candidate may be good, but not ratifiable under one or more contracts. Envelope is too narrow relative to policy and risk. Authority predicate is wrong or inferred from the wrong principal. Two contracts impose inconsistent requirements. A recurrent routine is collapsed into opaque behavior before its contract is stable.
Code patch fails declared tests despite clear requirements. Correct answer uses a stale policy document or executes without approval. Agent escalates a trivial reversible action that policy allows autonomously. Agent sends an email when only drafting was authorized. Evidence policy requires a source that the privacy policy forbids accessing. Agent silently reuses an outdated approval pattern.
Misclosure Overclosure Misdelegation Contract conflict Premature internalization
Table 2: Misclosure and neighboring failure modes. The taxonomy prevents answer error, authorization error, and over-escalation from being conflated.
8
7.1
Benchmark construction
A misclosure benchmark should separate competence from authorization. Each task instance should contain: (i) a candidate answer or action with ordinary task-quality evaluation; (ii) a contract tuple defining semantic, evidentiary, procedural and institutional validity; (iii) perturbations that alter one contract while preserving surface plausibility; and (iv) a ratification oracle that determines whether action is allowed. Existing agent benchmarks provide useful seeds for task realism and tool interaction [28–32], but they do not isolate misclosure. Table 3 gives the perturbation protocol. Perturbation
Construction
Correct behavior
Failure if missed
Semantic
Replace the task description with a plausible variant that changes acceptance criteria while preserving surface wording. Age, corrupt, remove, or policy-disallow a relevant-looking source.
Ask, instantiate the schema, or solve under the revised criteria.
Solves the wrong problem.
Reject inadmissible source, retrieve current evidence, or disclose uncertainty. Use approved method, simulate first, or escalate if no method exists. Escalate, seek approval, draft only, or abstain.
Acts on stale or prohibited grounds. Uses an unsafe or unauditable workflow. Executes a correct answer without authority.
Evidentiary
Procedural
Disallow the canonical tool path and provide a sanctioned alternative.
Institutional
Assign a role lacking permission for execution while permitting analysis or drafting.
Table 3: Minimal misclosure benchmark protocol. Each perturbation targets one contract while preserving enough surface plausibility that additional search alone should not reliably fix the failure.
7.2
Experimental design
A pilot experiment could use three institutional domains: software change requests, travel or procurement workflows, and customer-support or compliance actions. For each episode, construct four contract perturbations. Compare a baseline tool-using model, the same model with more test-time compute, retrieval, typed contracts, typed contracts plus routing policy, and an oracle-contract condition. Primary outcomes are unauthorizedaction rate, time-to-authorized-action, contract compliance, escalation precision and recall, provenance completeness, and ratification burden. A mixed-effects model over task, domain, intervention and perturbation type could test whether closure interventions outperform additional search on high-closure-gap tasks. Hypothesis 2 (Misclosure separability). Perturbation benchmarks can induce failures that persist under additional search but disappear under targeted closure interventions. In such cases, the failure is misclosure rather than undersearch. Hypothesis 3 (Envelope prediction). Deployment success in open institutional tasks is better predicted by delegation-envelope size, stability, and compliance than by answer accuracy or pass@𝑘 alone.
8
Metrics for authorized action
Table 4 defines metrics needed to evaluate whether an agent is merely answer-generating or action-authorizing. 9
Table 4: Metrics for authorized action. Answer accuracy remains useful, but it is insufficient for open-world deployment. Metric
Operational definition
Time-to-authorized-action
Wall-clock from task declaration to first ratified action or action inside the envelope. Accounting weights 𝑊compile , 𝑊search , 𝑊escalate , 𝑊execute , and 𝑊wait over the event trace. Human-seconds per authorized action, summed over all ratification surfaces. Fraction of escalations in which human review changed the outcome or confirmed a required approval boundary. Fraction of episodes requiring escalation in which the system escalated before acting. Fraction of unauthorized actions executed without escalation. Fraction of episodes escalated despite being inside the envelope under the ratification oracle. Fraction of action-bearing claims with auditable, admissible sources. Fraction of executed actions whose semantic, evidentiary, procedural, and institutional predicates all hold. Fraction of reversible actions that can be reverted within a declared time bound. Cardinality or measure of 𝐷 𝑡 relative to the declared action space. Expected normalized symmetric difference of accepted-action sets under declared perturbation distribution Δ. Inter-rater variance over ratification decisions, reported for benchmark or field evaluations.
Contract-latency breakdown Ratification burden Escalation precision Escalation recall False-autonomy rate Over-escalation rate Provenance completeness Contract compliance Rollback success Envelope size Envelope stability Human-review disagreement
High answer accuracy with poor false autonomy, provenance or compliance remains answer generation rather than authorization. Escalating every episode is safe but unusable. The target is the Pareto frontier between autonomy, latency, burden and compliance.
9
Controlled internalization and institutional shells
Intent compilation is not endless scaffolding. As agents and learned runtimes mature, recurrent structure will be internalized into weights, tools, memory or neural runtime primitives [7]. The open-world correction is that internalization should occur only after intent has first been externalized, ratified and monitored. Definition 8 (Controlled internalization). A routine is eligible for controlled internalization only if it occurs above a declared frequency threshold, has a stable contract representation, exceeds a contract-compliance threshold with confidence intervals, passes perturbation tests for envelope stability, is monitorable at runtime, and has rollback or containment for foreseeable failures. Mechanistic interpretability may help diagnose learned substructure, but behavioral stability under contract perturbation and monitorability against runtime policy also matter [33, 34]. What must be avoided is collapsing governance debt into opaque capability. Institutional shells should be runtime objects, not adjacent paperwork. Approval flows, audit trails, retention rules, privacy scopes, role bindings and reversible actuation should participate in runtime semantics. Current systems express fragments of this stack–OPA/Rego, Cedar, RBAC, XACML, Sigstore, runtime monitors and proof-carrying protocols [13, 20, 23–25, 35, 36]. Three gaps remain: type-level integration
10
with task semantics, proof-carrying action protocols, and runtime attestation that institutions can audit at deployment speed.
10
Relation to existing programs
Intent compilation is adjacent to requirements engineering, policy-as-code, runtime verification, program synthesis, HCI, AI governance and preference-based alignment. Its novelty is to treat the four contracts as one control surface traded against inference-time compute. Program
What it externalizes
What it often leaves implicit
Difference from intent compilation
Requirements engineering
Goals, constraints, acceptance criteria
Runtime authority, evidence admissibility, stochastic execution
Policy-as-code
Authorization predicates over requests
Task semantics, evidentiary admissibility, procedural validity
Runtime verification
Trace properties and monitors
Intent elicitation, evidence policy, authority ratification
Program synthesis
Executable artifacts from specifications or demonstrations General behavioral preferences and principles
Institutional legitimacy and action authority
Task success, tool success, answer quality
Admissibility, role permission, approval, provenance
Treats specification as a runtime control variable, not only a design-time artifact. Makes policy part of action semantics and integrates it with the other contracts. Includes pre-action closure and ratification surfaces, not only post hoc monitoring. Targets authorized action, not only executable code. Uses external ratified contracts rather than only learned preference structure. Evaluates misclosure separately from undersearch.
Constitutional AI and RLHF
Agent benchmarks
Task-specific, inspectable authority and evidence contracts
Table 5: Intent compilation in relation to adjacent programs. The distinction is a system-level integration and control claim rather than a claim that the component ideas are absent from prior work. The systems literature already contains partial instances. SWE-agent, OpenHands, Copilot Workspace, Aider, Devin, MetaGPT, ReAct, Reflexion, AutoGen and LangChain instantiate parts of this stack [18, 19, 37– 44]. Echo and Chiron, developed by the authors’ organization, are additional examples; they are included only to illustrate the architecture and are not independent evidence for the framework [45, 46].
11
Limitations and boundary conditions
Intent compilation does not eliminate ambiguity; it relocates ambiguity into inspectable artifacts. Several limits follow. Authorization is not ethical legitimacy: harmful policy can still authorize harmful action. The four-contract stack is operational, not exhaustive. Closure diagnostics can be miscalibrated or gamed, so benchmarks must evaluate false autonomy and over-escalation jointly. Some norms are tacit, contested or rapidly changing; the compiler should reveal missing authority rather than formalize it away. Compilation 11
also has costs: excessive contract burden can make a system unusable or shift labor to reviewers. Finally, this article reports no new empirical evaluation. The framework should be judged by whether future benchmarks and field studies show that it predicts and reduces misclosure failures.
12
Conclusion
Capability grows when learned systems internalize more computation. Governed deployability grows when institutions externalize more of the intent, evidence, procedure, and authority that bind action. Open-world agents require both. They should search aggressively when the world is sufficiently closed, ask or retrieve when closure is missing, and escalate or abstain when authority runs out. Intent compilation is the intermediate layer between human purpose and autonomous execution. It turns latent intent into four contracts, exposes closure gaps, defines delegation envelopes and makes misclosure measurable. The next phase of agentic AI should ask not only whether models can think longer, but whether systems can bind thought to inspectable, ratified, reusable and revocable conditions for action.
Competing interests Both authors hold executive roles at Taller Technologies, where Echo and Chiron are developed. This manuscript cites two recent publications by the authors and mentions Echo and Chiron as illustrative architectural examples alongside external systems. It does not present new unpublished empirical findings about either system.
Author contributions Both authors contributed to the conception of the framework, development of the formal vocabulary, and writing and revision of the manuscript. Both authors approved the final text.
Data availability No new data were generated for this Perspective. Empirical claims are either framed as hypotheses, attributed to cited literature, or described as proposed benchmark protocols.
References [1] Herbert A. Simon. A behavioral model of rational choice. Quarterly Journal of Economics, 69(1): 99–118, 1955. [2] Shlomo Zilberstein. Using anytime algorithms in intelligent systems. AI Magazine, 17(3):73–83, 1996. [3] Richard L. Lewis, Andrew Howes, and Satinder Singh. Computational rationality: Linking mechanism and behavior through bounded utility maximization. Topics in Cognitive Science, 6(2):279–311, 2014. [4] Alessandro Achille and Stefano Soatto. Ai agents as universal task solvers: It’s all about time. arXiv preprint arXiv:2510.12066, 2025. doi: 10.48550/arXiv.2510.12066. [5] Charlie Snell, Jaehoon Lee, Kelvin Xu, and Aviral Kumar. Scaling llm test-time compute optimally can be more effective than scaling model parameters. arXiv preprint arXiv:2408.03314, 2024. 12
[6] David Ha and Jürgen Schmidhuber. World models. arXiv preprint arXiv:1803.10122, 2018. [7] Mingchen Zhuge, Changsheng Zhao, Haozhe Liu, Zijian Zhou, Shuming Liu, Wenyi Wang, Ernie Chang, Gael Le Lan, Junjie Fei, Wenxuan Zhang, Yasheng Sun, Zhipeng Cai, Zechun Liu, Yunyang Xiong, Yining Yang, Yuandong Tian, Yangyang Shi, Vikas Chandra, and Jürgen Schmidhuber. Neural computers. arXiv preprint arXiv:2604.06425, 2026. [8] Danijar Hafner, Jurgis Pasukonis, Jimmy Ba, and Timothy Lillicrap. Mastering diverse control tasks through world models. Nature, 640:647–653, 2025. doi: 10.1038/s41586-025-08744-2. [9] Axel van Lamsweerde. Requirements Engineering: From System Goals to UML Models to Software Specifications. Wiley, 2009. [10] Michael Jackson. Problem Frames: Analysing and Structuring Software Development Problems. Addison-Wesley, 2001. [11] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks. In Advances in Neural Information Processing Systems, 2020. [12] Luc Moreau, Paul Groth, James Cheney, Timothy Lebo, and Simon Miles. The rationale of prov. Journal of Web Semantics, 35:235–257, 2015. [13] Zachary Newman, John Speed Meyers, and Santiago Torres-Arias. Sigstore: Software signing for everybody. In ACM Conference on Computer and Communications Security, 2022. [14] Tadao Murata. Petri nets: Properties, analysis and applications. Proceedings of the IEEE, 77(4):541–580, 1989. [15] Wil M. P. van der Aalst and Arthur H. M. ter Hofstede. Yawl: Yet another workflow language. Information Systems, 30(4):245–275, 2005. [16] Martin Leucker and Christian Schallhart. A brief account of runtime verification. Journal of Logic and Algebraic Programming, 78(5):293–303, 2009. [17] Ezio Bartocci, Yliès Falcone, Adrian Francalanza, and Giles Reger. Introduction to runtime verification. In Lectures on Runtime Verification, pages 1–33. Springer, 2018. [18] John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. Swe-agent: Agent-computer interfaces enable automated software engineering. arXiv preprint arXiv:2405.15793, 2024. [19] Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, et al. Openhands: An open platform for ai software developers as generalist agents. arXiv preprint arXiv:2407.16741, 2024. [20] Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. Role-based access control models. IEEE Computer, 29(2):38–47, 1996. [21] Jack B. Dennis and Earl C. Van Horn. Programming semantics for multiprogrammed computations. Communications of the ACM, 9(3):143–155, 1966.
13
[22] Mark S. Miller. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. PhD thesis, Johns Hopkins University, 2006. [23] OASIS. extensible access control markup language (xacml) version 3.0. Technical report, OASIS Standard, 2013. [24] Tim Sandall and Timothy L. Hinrichs. Open policy agent: Policy-based control for cloud native environments. Technical report, Cloud Native Computing Foundation, 2021. [25] Amazon Web Services. Cedar: A new policy language. Technical report, Amazon Web Services, 2023. [26] Joshua A. Kroll, Joanna Huey, Solon Barocas, Edward W. Felten, Joel R. Reidenberg, David G. Robinson, and Harlan Yu. Accountable algorithms. University of Pennsylvania Law Review, 165:633–705, 2017. [27] Gillian K. Hadfield. Rules for a Flat World: Why Humans Invented Law and How to Reinvent It for a Complex Global Economy. Oxford University Press, 2017. [28] Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan. Swe-bench: Can language models resolve real-world github issues? In International Conference on Learning Representations, 2024. [29] Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan. 𝜏-bench: A benchmark for tool-agent-user interaction in real-world domains. arXiv preprint arXiv:2406.12045, 2024. [30] Grégoire Mialon, Clémentine Fourrier, Craig Swift, Thomas Wolf, Yann LeCun, and Thomas Scialom. Gaia: A benchmark for general ai assistants. arXiv preprint arXiv:2311.12983, 2023. [31] Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, et al. Agentbench: Evaluating llms as agents. arXiv preprint arXiv:2308.03688, 2023. [32] Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, et al. Holistic evaluation of language models. Transactions on Machine Learning Research, 2023. [33] Chris Olah, Nick Cammarata, Ludwig Schubert, Gabriel Goh, Michael Petrov, and Shan Carter. Zoom in: An introduction to circuits. Distill, 2020. [34] Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, et al. Toy models of superposition. Transformer Circuits Thread, 2022. [35] George C. Necula. Proof-carrying code. In ACM SIGPLAN Symposium on Principles of Programming Languages, pages 106–119, 1997. [36] Miles Brundage, Shahar Avin, Jack Wang, Haydn Belfield, Gretchen Krueger, Gillian Hadfield, et al. Toward trustworthy ai development: Mechanisms for supporting verifiable claims. arXiv preprint arXiv:2004.07213, 2020. [37] GitHub. Github copilot workspace: Ai-native developer environment. Product announcement, 2024. [38] Paul Gauthier. Aider: Ai pair programming in your terminal. Software documentation, 2024. [39] Cognition AI. Introducing devin, the first ai software engineer. Product announcement, 2024. 14
[40] Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, et al. Metagpt: Meta programming for a multi-agent collaborative framework. In International Conference on Learning Representations, 2024. [41] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models. In International Conference on Learning Representations, 2023. [42] Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning. In Advances in Neural Information Processing Systems, 2023. [43] Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, et al. Autogen: Enabling next-gen llm applications via multi-agent conversation. arXiv preprint arXiv:2308.08155, 2023. [44] Harrison Chase. Langchain: Building applications with llms through composability. Software documentation, 2022. [45] Maximiliano Armesto and Christophe Kolb. Orchestrating human-ai software delivery: A retrospective longitudinal field study of three software modernization programs. arXiv preprint arXiv:2603.20028, 2026. [46] Maximiliano Armesto and Christophe Kolb. Coupled control, structured memory, and verifiable action in agentic ai (scrat – stochastic control with retrieval and auditable trajectories): A comparative perspective from squirrel locomotion and scatter-hoarding. arXiv preprint arXiv:2604.03201, 2026.
15