C OMPOSITIONAL P OLICY V IOLATIONS : W HEN S TEP -L EVEL C OMPLIANCE FAILS I N AGENTIC AI W ORKFLOWS Ashwini Kurady [email protected]
Sri Sai Charith Grandhi [email protected]
Rajesh Gupta [email protected]
Sumit Mamoria [email protected]
arXiv:2609.18820v1 [cs.AI] 16 Sep 2026
September 17, 2026 Abstract - Agentic workflows now make consequential decisions in regulated settings, and the governance placed around them is almost entirely step-scoped: input-output classifiers, per-turn rails, and span-level evaluators. The policies organizations actually hold, such as referral thresholds, authority limits, and review requirements, are properties of the whole execution rather than of any one step. This mismatch admits a failure mode we call a Compositional Policy Violation (CPV): every individual step passes its own check while the composed execution violates the governing policy. A predicate over a single step cannot evaluate a property that step does not determine, so no improvement in the accuracy of the step-scoped monitors detects this class. We define CPVs as the failure of step-level compliance to compose, and present a taxonomy of four types: Authority Creep, Threshold Laundering, Cumulative Sum Violation, and Context Collapse. We show that the correct repair for each class is dictated by where the guarded quantity mutates. We then introduce a provenance-aware runtime architecture that evaluates policies over complete execution traces, recomputing guarded quantities from raw provenance rather than the pipeline’s derived representation.
ate prompts and responses in isolation[4]. Programmable rails enforce constraints at turn level[5]. Evaluators and guardrails attach at the span level[6, 7]. Each mechanism asks the same question at the same grain: is this action permitted, given the state visible at this step? The policies organizations actually hold are not of that shape. Referral thresholds, authority limits, and review requirements are properties of a trace (A trace is a complete ordered record of what a workflow did: every step, in sequence, with the state each step produced). Forcing them into step-level predicates creates an enforcement gap: a check that can reason only about the state in front of it cannot evaluate a property that depends on prior history or on what later steps will do. A workflow may therefore satisfy every individual check and still violate the policy it is subject to, with no component having failed. We call this a Compositional Policy Violation (CPV). This is not a matter of imperfect calibration or insufficient monitor capability. It is structural: even perfectly accurate step-level monitors cannot detect this class, because the evidence needed to identify it exists only at the level of the composed execution.
We note at the outset that trace-level monitoring is not itself novel; runtime verification and process compliance supply those techniques. Our contribution is to identify 1 Introduction a specific governance failure mode in agentic workflows, Agentic workflows have moved into regulated decision characterize its forms, and operationalize its detection. making. American International Group (AIG), report- The paper proceeds as follows. Section 2 situates our work ing on an early rollout built with Anthropic and Palantir, relative to existing literature on guardrails, observability, states that it compressed the timeline to review business evaluation, and human oversight. Section 3 defines Comby more than fivefold while raising data accuracy from positional Policy Violations (CPVs), differentiates them 75% to over 90% [1]; Allianz [2] and The Baldwin Group from conventional workflow defects, and introduces a four[3] have announced comparable deployments across un- part taxonomy: Authority Creep, Threshold Laundering, derwriting operations. These are not laboratory demon- Cumulative Sum Violation, and Context Collapse. Section strations but production pipelines in which sequences of 4 shows that the correct repair (relocating a gate, adding specialized agents ingest requests, enrich information, per- one, or extending what an existing gate can see) is dictated form domain-specific analyses, and route decisions, with by where the guarded quantity mutates. Section 5 presents human oversight retained at designated approval or review a provenance-aware runtime architecture for CPV detecsteps. As a request moves through such a pipeline, it accu- tion. We close by discussing future research in Section 6 mulates permissions, context, and prior determinations at and offering concluding remarks in Section 7. each hop. The decision that reaches the final routing step is a function of everything the request picked up along the 2 Related Work way, not just the state of any single step. Governance for agentic workflows however, has converged Existing approaches to AI governance, evaluation, and on step-level predicates. Input-output classifiers evalu- oversight largely assume that policy compliance can be
A PREPRINT - S EPTEMBER 17, 2026
determined at the boundary of individual steps. Modern guardrail systems such as Llama Guard, NeMo Guardrails, Constitutional Classifiers, and AgentSpec enforce constraints over prompts, responses, turns, or individual actions [4, 5, 8, 9]. While effective for local violations, they do not evaluate whether a complete execution trajectory satisfies policies defined over the workflow.
This distinguishes a CPV from a conventional workflow defect. A race condition violates an invariant that assumed exclusive or ordered access to shared state, when concurrent execution interleaves that access unpredictably. A stale-state error reflects a step reading data past a validity window defined independently of any other step’s timing. A missing recomputation is an omitted design element. A CPV, by contrast, occurs in purely sequential, correctly designed workflows with every local check in place. The violation is invisible to those checks not because monitoring is absent, but because the property being violated is defined over the trace, and no single step determines it.
Recent studies have shown that composition can defeat step-level safeguards in adversarial settings. Ahad et al. [10] demonstrate that orchestrated subtasks can individually pass multiple safety classifiers while the combined plan violates security constraints; similar compositional failures have been observed across sessions, accumulated memory, and agent trajectories [11, 12, 13]. However, these works assume an adversarial actor deliberately fragmenting behavior. In contrast, we study non-adversarial compositional failures where individually compliant actions, performed by independently scoped components, produce workflow-level policy violations through ordinary execution.
We classify CPVs by the aspect of execution that becomes unsafe through composition rather than by a shared mechanism (Figure 1). Authority Creep concerns who is entitled to decide, and arises when permissions accumulate across workflow steps. Threshold Laundering and Cumulative Sum Violation concern an accumulated quantity: in the first, a gate checks the quantity correctly but a later step carries it past the limit with nothing re-checking; in the second, no gate exists at the aggregate scope, and individually compliant actions accumulate past the limit. Context Collapse concerns the representation on which the decision is made, and arises when each hand-off accurately summarizes what it received, yet the resulting record drifts further from the original submission with every step, until the final gate evaluates a case that no longer resembles the one the policy was written to address. The four share the CPV structure rather than a common mechanism: every local check passes, the composed execution violates the governing policy, and the evidence needed to see the violation is absent from every step. They differ in which evidence is absent, and therefore in what a detector must retain. Section 4 takes up the repair each class demands.
Observability and evaluation frameworks provide complementary capabilities but remain primarily step or outcomeoriented. Platforms such as Langfuse and LangSmith reconstruct execution traces through spans and runs but evaluate individual units rather than trace-level governance properties [6, 7]. Similarly, process and outcome supervision approaches [14] and agent failure taxonomies such as MAST [15] analyze intermediate reasoning or failed executions, whereas CPVs represent workflows that complete successfully while violating policies defined over the accumulated trajectory. Finally, human oversight remains the common fallback for high-risk AI workflows, yet studies show that reviewers often over-rely on automated recommendations and that oversight effectiveness decreases as automation increases [16, 17]. These limitations motivate the need for runtime governance mechanisms that reason over complete execution histories. Our work addresses this gap through a provenance-aware architecture that combines policy evaluation, temporal reasoning, authority analysis, and sequence-level monitoring to detect compositional policy violations.
3
Figure 1: Taxonomy of compositional policy violations
Taxonomy
We now define this failure mode precisely. A Compo- Terminology We use the following terms consistently sitional Policy Violation (CPV) is a workflow in which throughout. every individual step satisfies the policy applied to it, yet the composed execution violates the policy governing the • Predicate: a boolean condition over a state or a trace. workflow as a whole. Three conditions hold together: each step is evaluated against a policy scoped to that step alone; • Gate: a workflow step that evaluates a predicate and routes execution on the result. Gates are part of the each step performs its function correctly under that scoped workflow and can change its behavior. policy; and the composed sequence violates a policy defined at the workflow level. No specification is breached • Monitor: an observer that evaluates a predicate without and no component contains a bug. The defect lies in how altering execution. Step-level when it is a function the step-level specifications compose, which are locally of the state at a single step; trace-level when it is a sound but globally insufficient. function of the execution history.
2
A PREPRINT - S EPTEMBER 17, 2026
• Checkpoint: the practice of evaluating one step or one change in isolation, without reference to the trace it belongs to. 3.1
matches the unclassified prior loss to a claim already captured elsewhere in the submission’s history and removes it as a duplicate, leaving two. Materiality classification determines the square-footage discrepancy falls within the policy’s five-percent tolerance and is immaterial, leaving one. The escalation router reads a final count of one against a threshold of three, and does not escalate.
Authority Creep Violation
A compositional policy violation in which a sequence of individually authorized agent operations transforms the representation of a guarded quantity such that an authorityrouting gate(a rule that determines which principal - human tier, unit or escalation path is entitled to decide the case) evaluates to a different authority tier than the policy requires, even though the gate’s own evaluation is satisfied. The workflow never claims decision authority. It shapes the input to the rule that allocates decision authority.
The distinction that matters here is between fixing an error and making a judgment call. Fixing an error means there was one correct answer and the step found it. For example, two database rows that are literally the same record, duplicated by a retry. Removing one is not Authority Creep, since no discretion over the guarded quantity was exercised. Making a judgment call means there were two or more reasonable interpretations, and the step picked one, and picking it made the exception disappear. For example, classifying the square-footage discrepancy as immaterial is one such call: the discrepancy could reasonably have been treated as material, and treating it as immaterial is what removed it from the count. This is the mechanism of the violation: each of several components, scattered across the pipeline, removes one exception on its own judgment call; only in composition do those separate calls add up to a decision that none of them was authorized to make. By the time the router evaluates the final count, the question it exists to answer(does this account need to be escalated?) has already been answered upstream, by components never granted authority to answer it.
Consider commercial insurance underwriting, shown in Figure 2. The governing policy is that any account involving three or more material exceptions must be escalated. The pipeline holds five components. Extraction pulls submission data and flags candidate guideline exceptions; its authority is narrow, surfacing facts and deciding nothing about who reviews anything. Downstream of it sit components that normalize fields, reconcile duplicate records, classify materiality, and resolve flags. Each was scoped and approved on its own terms, against a requirement that existed before the others did, and none confers any decision authority over routing.
Why per-step monitoring is blind to it: Every transform stays inside its authorized scope and every step-level check passes. A monitor that sees one step and the policy scoped to it has no signal available, not a weak signal but none at all. The router itself is not defective either: it applies its threshold correctly to the number it was handed. What no step holds is the relationship between the number the router reads and the evidence that number was derived from, and that relationship is the only place the violation Figure 2: Authority Creep Violation in the sample under-writing is visible. pipeline. Expanding scope at each stage, illustrating how cumulative scope expansion emerges through composition rather than Trigerring Conditions: An Authority Creep Violation is explicit authorization at any single step. not an accident that can happen to any pipeline. It requires
a specific arrangement of five conditions. Three of them Specifically: normalizing COPE fields standardizes prop- describe the “Structural Preconditions” that makes the vierty attributes; reconciling loss runs manages duplicate olation possible, and two Compositional Conditions that records; classifying discrepancy materiality judges data distinguish a genuine instance from ordinary misbehavior. quality; resolving flags closes out items the agent itself raised. That decision belongs to the escalation router alone, Structural Preconditions a fixed workflow step the agent is never granted control • First, the workflow must contain an authority-routing over. gate, as defined above — for example, escalation at three material exceptions, an SIU referral at two fraud Suppose extraction surfaces four candidate exceptions on indicators, or human-in-the-loop review above a risk a submission: an expired certificate, a COPE mismatch band. Without such a rule there is no authority for the reporting two locations as one address, an unclassified pipeline to creep past. prior loss, and a discrepant square-footage figure. Four exceptions clears the escalation threshold on its own. Nor- • Second, one or more components must hold represenmalization then resolves the COPE mismatch, the two tation authority over that quantity’s inputs: they are locations are the same property under a corrected address legitimately permitted to classify, score, merge, deduplileaving three, still at threshold. Loss-run reconciliation cate, or suppress the very items the gate counts. This
3
A PREPRINT - S EPTEMBER 17, 2026
running q
authority is granted for good reasons like noise reduction, precision, reviewer load.
s1 Loss run ingestion extract prior losses
• Third, as established above, the gate reads the pipeline’s transformed representation rather than recomputing from raw evidence under the policy’s own definitions.
s2 Referral gate is q ≤ $250K? yes
s3 Supplemental intake
• Local compliance must hold throughout, as established above. If any step is individually non-compliant, the trace is contaminated. It contains an ordinary local violation that a conventional monitor would catch, and it tells us nothing about compositional governance.
+$75K in-window claim
commit (quote) no referral
• No single transform may be sufficient: this condition concerns how the displacement is distributed across the pipeline: each transform, applied on its own to the raw evidence, must still route the case to the correct principal. This is also a no-culprit property because the identity of the responsible component depends on the execution order — determined by scheduling, not by anything the agent did. Consider two transforms in the opposite order. Consolidation first takes four exceptions to three, which still escalates; reclassification then takes three to two, which does not. Reverse them and reclassification is the innocent step while consolidation crosses the line. Same components, same scopes, same evidence, same outcome. Whichever transform runs second is the one that crosses the line, so the culprit is determined by scheduling rather than by anything any component did. 3.2
$210K
$285K
gate is blind forward
Compositional Conditions These conditions should be enforced as hard validity checks on every generated trace.
$210K
$285K
Figure 3: Threshold Laundering. The gate at s2 applies the $250K rule correctly to the value in front of it. A later step adds a $75K in-window claim, so the committed value breaches the threshold, and no step re-evaluates the gate.
five-year window. The account now carries $285K - over the line. But the referral gate has already run, and nothing re-checks the total. The account is quoted automatically, carrying $285K of prior losses, with no manager referral. Every step did its job. The ingestion agent read the loss run correctly. The referral agent applied the $250K rule correctly to the number it was handed. The supplemental intake agent parsed a valid, in-window claim. None exceeded its authority, misreported a value, or omitted a required check. The policy was still broken. This is a compositional policy violation because two checks make the difference, and both must hold:
Threshold Laundering
Threshold Laundering is a Compositional Policy Violation in which a quantity is checked against a limit at one point in the workflow, and a later step carries that quantity past that limit. No step misapplies the rule. The gate compares the quantity against the limit correctly, but does so before the quantity has finished changing. The value that gets committed is not the value that was checked, and nothing looks again. The rule is still sitting in the manual, fully in force, and it never fires.
• Local compliance: Every component stayed inside its own scope. The extractor extracted, the referral agent applied its threshold to the number it was handed, the intake agent parsed a claim. Every local check passes. No monitor watching individual steps sees anything at all. • No single culprit: The gate alone, on the number it saw, is correct: $210K is under the line. The intake step alone is correct: it parsed a valid $75K claim, and escalation Consider loss-history referral in commercial underwriting, is not its job. Only the two composed carry the account as described in Table 1. Original policy: any account past the line with nobody watching. whose prior losses over the last five years exceed $250K must be referred to an underwriting manager before it can Why per-step monitoring is blind to it. The gate holds be quoted. Submissions of this kind rarely arrive as a single the rule but sees only the earlier $210K - the $75K has document. Loss runs, supplemental carrier statements, and not arrived yet. The intake step sees the $75K but holds claim-closure notices are processed one after another - so no referral rule. So the one step that has the rule cannot the account’s full loss picture builds up over the course of see the final total, and the one step that creates the final the workflow rather than being present at the start. total does not have the rule. Nobody ever holds both at A loss run arrives first and is read as $210K of prior losses. once, and the breach slips through the seam between them. The referral gate checks this against the $250K line, finds This is why no amount of tuning, calibration, or capability it under, and sends the account down the automatic-quote added to the monitor that only sees one step can catch the path. Its authority is narrow - it applies the rule to the violation: the thing that needs to be seen is not present at number in front of it. It decides nothing about what ar- any single step. rives next. Later, a second document arrives carrying an additional $75K closed claim, correctly dated inside the
One natural objection is that the workflow should simply run the gate last. For a single quantity this works. It does
4
A PREPRINT - S EPTEMBER 17, 2026
Step
Action
Local check Pi
State
Result
s1 Loss run intake
Read the submitted loss run and extract prior losses Apply the referral policy Process a later document carrying an additional $75K closed claim
Are losses correctly extracted and dated? q(σ2 ) ≤ $250K ? Is the claim correctly parsed and inside the five-year lookback window?
$210K
Pass
$210K $285K
Pass Pass
Commit to the auto-quote path at σn
—
$285K
P (W ) = fail
s2 Referral gate s3 Supplemental intake Quote (commit)
Table 1: Illustrative threshold laundering workflow. Every step passes its local check, yet the committed state breaches the $250K referral threshold because nothing re-evaluates the gate after s3 .
not generalise, and the reason is instructive. To re-check the account after the $75K claim, the check has to know the running total from the earlier step and apply the referral rule that belongs to the gate. A check that reaches back across steps and applies another step’s rule is no longer a local check - it is a check over the whole account, which is exactly the trace-level check we argue for. And once a workflow gates several quantities that finalise at different steps - losses after intake, premium after rating, exposure Figure 4: Cumulative Sum Violation: three compliant purchases after endorsements - there is no single position late enough aggregate to violate the daily spending threshold. Each purchase to see all of them at once. independently satisfies the per-action constraint ($90 < $100), but their composition exceeds the policy-level constraint ($270 >
The violation is also not a failure of any agent’s specifica- $250) tion. Each agent met its specification exactly. The defect is a property of how the steps compose. It can only be repaired at that level: recompute the total on the committed The accumulated effect need not be a repeated sum of the account and re-ask the question before the account binds. same quantity. It may be a composite over heterogeneous signals: a loan application whose income verification, requested amount, and debt-to-income ratio each clear their 3.3 Cumulative Sum Violation own limit, while the composite credit-risk score they feed exceeds the referral threshold that no component computes. Threshold evasion through gate-bypass, as seen in Threshold Laundering, represents one compositional violation Relationship to Threshold Laundering: Both are pattern. A related but distinct pattern emerges when no threshold violations over accumulated state, but they differ aggregation-level gate exists at all. A Cumulative Sum Vi- in mechanism, in detection cost, and in repair. olation (CSV) is a compositional policy violation in which individually compliant actions or signals collectively cross Mechanism: In Threshold Laundering a gate for the a policy threshold, such that the violation emerges only guarded quantity exists and evaluates the policy correctly; from their aggregate state and is not observable from any the defect is its temporal position, since a later step revises the quantity it read. In a Cumulative Sum Violation, no individual component in isolation. gate at the aggregate scope exists at all; each component is For example, consider an AI purchasing agent authorized gated at its own scope, and the composed quantity is never to buy office supplies on behalf of a company. The pol- evaluated by anything. icy imposes two constraints: no individual purchase may Detection cost: Once the committed state is available, deexceed $100 without approval, and total daily spending tecting Threshold Laundering requires one recomputation may not exceed $250. Over the course of a day, the agent of the guarded quantity and one comparison. Detecting a executes three purchases of $90 each. Each purchase, Cumulative Sum Violation requires maintaining a running when evaluated independently, satisfies the per-action conaggregate over the whole trace, and where the aggregate straint. No individual transaction violates the policy; the spans entities, sessions, or invocations, correctly associatviolation exists only in the composition of the transactions. ing events with the entity the policy is defined over. The A control mechanism that evaluates each action indepenfirst is a question of when the predicate is evaluated, the dently without maintaining aggregate state cannot detect second, of what state must be carried to evaluate it at all. this failure mode. This pattern has regulatory precedent in transaction structuring rules, where prohibited behavior is Repair. Threshold Laundering is repaired by re-evaluating defined over a sequence of related transactions rather than an existing predicate on the committed state. A Cumulaany individual transaction in isolation [18]. tive Sum Violation is repaired by introducing a predicate
5
A PREPRINT - S EPTEMBER 17, 2026
that no step currently holds. A workflow can therefore ex- Why per-step monitoring is blind to it. The failure is hibit one without the other: a correctly aggregated quantity invisible to per-step monitoring, and invisible by design. gated too early is Threshold Laundering with no Cumula- Ask what each summary’s checker can compare against. tive Sum Violation, and an unaggregated quantity gated It can only compare its summary to the file it was handed only at the level of individual actions is a Cumulative Sum - the previous summary. It cannot compare against the Violation with no Threshold Laundering. original submission, because the submission is gone by then; discarding it is the whole point of summarising. So every checker verifies faithfulness to the previous step, and 3.4 Context Collapse Violation no checker verifies faithfulness to the source. A chain of Context Collapse is a compositional policy violation of individually faithful hand-offs is exactly what the violation a different shape. A decision is committed only after an is made of, so no amount of accuracy added to the individauthorised person reviews the file; every hand-off along ual checkers can catch it. No step-level monitor holds both the way is a faithful summary of what it received; and yet the source submission and the file the reviewer sees. the file the reviewer sees supports a different decision from the one the original submission supports. No summary lies. Threshold Laundering and Context Collapse have oppoEach drops only a little, and each drop is defensible on its site temporal blind spots. In Threshold Laundering, an own - but the drops accumulate down the chain, and by the earlier gate cannot observe policy-relevant changes that end enough has been lost to flip the call. The review was occur later in the workflow. In Context Collapse, the final real. It was performed on a file that no longer said what decision-maker cannot recover policy-relevant information that was present in the original submission but lost through the submission said. intermediate transformations. Consider referral review in commercial underwriting, A natural objection is that the summaries are simply too shown in Table 2. The carrier’s policy is that any account aggressive - give them more room. But the loss does flagged for referral must receive substantive underwriter not fall away with a larger budget: decision flips barely review before binding. Submissions arrive as heterogemove even as the summary budget grows [19]. Bigger neous packages - broker email, ACORD forms, loss runs, summaries drift more gently, but they still flip the decision. inspection reports - that no downstream stage reads in full, It is also not a failure of the reviewer, and not simply overso each stage condenses what it received for the next. trust in the machine. Over-trust in automated output is a Intake records five facts that matter to the decision: an disposition that training or incentives can address [17]; this ambiguous class code carrying materially different rates, is not that. Even a maximally skeptical, perfectly sharp an unverified sprinkler certificate, a prior large loss marked underwriter reaches the same decision, because the facts under investigation, a coverage gap between prior carriers, they would need are not on the page. You cannot scrutinize and a broker note reporting pending litigation. Read whole, what is no longer there. the submission supports referral. Enrichment merges the Then why not require each summary to preserve the decifile into a consolidated narrative and drops the sprinkler sion exactly, rather than just closely? Because that check certificate, since third-party data now supplies a protection is one nobody can run. To verify that a summary preclass. Risk profiling condenses the file to a rated profile: serves the same decision-relevant meaning as its input, the the coverage gap and the pending litigation go, neither monitor would need to determine what decision would be mapping to a rating factor, and the prior loss survives as a reached from the full pre-summary information and comheadline figure, $180K, with the qualifier “under investi- pare it with the decision reached from the summary alone. gation” removed. Every word that remains is true and the In effect, this requires re-evaluating the account twice at number is exact, but a loss and a loss under investigation every hand-off. A workflow able to do that at each step mean different things to an underwriter. The referral packet would not need the downstream steps or the reviewer at renders the underwriter-facing file, keeping the ambiguous all. What is checked in practice is cheaper and narrower class code. The underwriter reads a packet carrying one that a summary is factually accurate and its claims trace to of the five facts and approves. The account binds on a its input - and none of that constrains how far the decision decision of accept, when the submission supported refer. has drifted. This is why the only real remedy is to keep Nowhere did a component fail. Intake extracted accurately, the original submission and re-derive the decision from each summary was a faithful condensation of its input, it before binding, which is a check over the whole trace and the underwriter read the packet carefully and reached rather than any single step. the decision it supported. No fact was fabricated, no step skipped, no authority exceeded. The account still bound 4 Repair Topology is Dictated by Violation on the wrong decision.
Structure
This pattern, the fact kept and the qualifier that told you how to read it removed, is what Lee et al. [19] term decontextualisation; they find that under a fixed budget the share of such context-setting facts falls from 25% in the source to 9% after a single compression.
The correct number and placement of policy gates is not a design choice. It is dictated by where the guarded quantity is mutated over the course of the workflow, and that differs by class.
6
A PREPRINT - S EPTEMBER 17, 2026
Step
Action
Local check
Facts kept
Hop drift
Result
s1 Intake s2 Enrichment
Extract the submission package Merge third-party data into a consolidated narrative Condense to a rated risk profile Render the underwriter-facing file Underwriter reads the packet and approves
Facts extracted accurately? Materially faithful to input?
1–5 1,3,4,5
— 0.06
Pass Pass
Materially faithful to input? Materially faithful to input?
3,5 1
0.08 0.07
Pass Pass
Authorized person reviewed?
1
—
Pass
Commit on the underwriter’s approval
—
1
0.19
Fail
s3 Risk profiling s4 Referral packet s5 Review Bind
Table 2: Illustrative context collapse workflow. Each hop stays under the materiality tolerance, but the drift accumulates to 0.19 relative to the submission, flipping the decision from refer to accept.
Consider threshold laundering, shown in figure 5: risk is Each class therefore demands a different repair topology: not a static property but a quantity that mutates across • Authority Creep: Trace backward once from the steps. A single gate at step 1 sees risk = 0.79, passes, and decision point. implicitly assumes that value will not change. Step 3 adds exposure the gate never observes, and the value crosses • Threshold Laundering: Re-evaluate the existing the threshold 0.80 in a place where nobody was looking. predicate on the committed state rather than the The gate enforced a point-in-time predicate, risk < 0.80 value present when the gate first fired. at step 1, when the governing policy specifies a invariant: • Cumulative Sum Violation: Introduce a predirisk < 0.80 on the committed state. cate at the aggregate’s own scope, since no step currently holds one. • Context Collapse: Reconstruct against the original submission rather than the intermediate summaries. This is why the detector cannot be a collection of singlepoint checkpoints. It must reconstruct full policy semantics and re-evaluate against the final committed state, which only the complete trace provides. Figure 5: Gate Placement for Threshold Laundering
5 The same principle governs the other three classes, though what mutates differs. In authority creep, what mutates is not a scalar but the representation of who is entitled to decide: the escalation router already sits at the only step where escalation authority is exercised, so there is no later position to move it to. What must be added is not a new position but backward reach. The router must be able to trace the count it fires on through the domain-scoped transforms that produced it, since the mutation happened upstream of any single gate rather than after one. In Cumulative Sum Violation(CSV), the mutation is a running total that accretes across independently-gated actions, and no gate exists at the scope where that total is tracked at all; placement is not wrong here so much as absent, and the fix is to instantiate a gate at the aggregate’s own scope rather than to relocate an existing one. In Context Collapse Violation, what mutates is the evidentiary record itself: each hand-off is a faithful summary of what it received, so the terminal review gate is correctly placed and correctly applied, but the file it evaluates is no longer the file the policy was written against. The mutation is in what the gate can see, not in the guarded quantity or in where the gate sits.
CPV Detection Architecture
The repair topologies established in Section 4 cannot be implemented by a single monolithic check. Each demands a different kind of infrastructure: a persistent, unabridged record of the execution to trace or monitor against, and the ability to recompute a guarded quantity from that record rather than trust an intermediate representation a prior step may have already laundered. The architecture therefore separates the concern of preserving the trace from the concern of evaluating policy against it. The detector comprises four core stages: 1. Provenance Ingestion. Collect and normalize runtime events into a canonical, timestamped trace. 2. State Reconstruction. Rebuild workflow state and policy-relevant history from raw provenance. 3. Policy Evaluation. Evaluate both step-level and workflow-level policies against reconstructed state. 4. Compositional Detection. Identify violations that emerge only at the sequence level and classify by CPV type.
7
A PREPRINT - S EPTEMBER 17, 2026
Two design invariants govern all four:
nance links. Internally, it maps framework-specific artifacts into standardized event categories and enriches them with semantic attributes such as action class, resource class, sensitivity level, and purpose. These two components establish the complete, auditable record required by history-completeness. Nothing is discarded; later stages see the full execution history.
• History-completeness. No component may render a violation verdict from a truncated or windowed view when the governing policies semantics require the full trajectory.
• Recount-from-raw-provenance. Composition gates must recompute guarded quantities from raw provenance under the policies own semantic definition, never 5.2 Stage 2: State Reconstruction from the pipeline’s transformed or derived representa• Governed State Store: Persists workflow state and tion. the raw provenance ledger for each workflow instance, enabling recount-from-raw analysis. It ingests raw payloads from the Workflow Trace Collector, canonical events from the Event Normalizer, and derived annotations from downstream engines, providing queryable current and historical state with provenance retrieval by instance ID. • Policy Knowledge Base (PKB): Stores machinereadable policies, control objectives, exceptions, and versioned policy definitions, serving as the authoritative source for policy semantics required by the recount principle. These components implement the recount-from-rawprovenance principle: the State Store holds the raw facts, the PKB holds the policy semantics, and together they enable the detector to reconstruct what the policy actually requires at each decision point. 5.3
Stage 3: Policy Evaluation
• Policy Evaluation: Evaluates declarative policies, authority constraints, and separation-of-duty rules against the workflow trace and governed state. It produces policy-level pass/fail decisions with supporting facts. This engine answers two questions: Figure 6: CPV Detector architecture. Four detection stages, governed throughout by two design invariants, with operational components that support governance workflows but do not contribute to detection logic
1. Do all individual steps satisfy their local policies? (step-level compliance) 2. Does the composed workflow satisfy trace-level policies? (workflow-level compliance)
5.1
The output is the raw material for compositional detection: a record of which steps are locally compliant, and which policies defined over the complete trace are violated.
Stage 1: Provenance Ingestion and Normalization
• Workflow Trace Collector: Captures every agentrelevant event, including prompts, tool calls, approvals, memory writes, external API responses, file access, re- 5.4 Stage 4: Compositional Detection tries, and handoffs. It ingests raw runtime events, tool telemetry, orchestrator logs, and identity context and pro- • Sequence Analyzer: This layer analyzes complete workflow trajectories to identify compositional policy duces an immutable, ordered event log for each workviolations that emerge only across multiple steps. flow instance with monotonic sequence numbers and timestamps. The Sequence Analyzer performs the core detection logic, and the check it runs follows the repair topology • Event Normalizer: Converts heterogeneous runtime of each class: events into a unified workflow-trace schema while pre-
– Authority Creep. Traces authority ownership backward from the decision gate to determine whether accumulated permissions govern every input the gate depends on.
serving raw provenance references. It consumes raw events from collectors and produces canonical events containing instance identifiers, sequence numbers, timestamps, actors, action types, typed parameters, and prove-
8
A PREPRINT - S EPTEMBER 17, 2026
– Threshold Laundering. Re-evaluates the guarded quantity on the committed state and compares it against the value present when the gate originally fired. – Cumulative Sum Violation. Maintains the aggregate over the trace and compares it against the policy threshold no step holds. – Context Collapse. Re-derives the decision from the retained submission and compares it against the decision the reviewed file supports.
5.6
Detector Failure Modes
The architecture inherits limits from the trace it is given, and we state them explicitly.
Provenance loss: The detector can only recompute a guarded quantity from what the pipeline retained. If a transform deletes suppressed evidence rather than marking it, the pre-image is unrecoverable and the violation is undetectable in principle - not hard, but impossible, since no information remains in the trace from which the truth is derivable. Provenance retention is therefore a precondition • Violation Detector: Produces authoritative binary or rather than an implementation detail, and a pipeline that graded violation verdicts for each workflow instance discards what it suppresses cannot be audited for Authority and maps detected issues to the CPV taxonomy with Creep regardless of what is added downstream. violation type, severity, and the responsible workflow segment. Confirmed findings are classified into known Oracle dependence for subjective predicates: RecomCPV categories, while unmatched patterns are flagged putation is sound when the guarded quantity is objective. Many predicates are not: whether an exception is mateas candidates for further analysis. rial applies a standard written in prose. The detector then requires an interpretation oracle, which becomes part of 5.5 Operational Components its trusted base. If that oracle and the pipeline compoThe detector also includes components supporting deploy- nent that produced the violation are both language models ment and governance workflows: reasoning from similar priors, they may reach the same judgement; the detector sees no discrepancy and concurs. • Explainability Layer: Generates human-auditable jusA recount is sound only where its oracle is independent of tifications that trace each violation verdict to the rethe pipeline’s and anchored to the policy text rather than sponsible workflow events, raw provenance records, and to learned precedent. policy definitions. This layer provides explanations to the Governance Dashboard and Audit Log Generator. Extraction error: Even with full provenance, recomputa• Audit Log Generator: Produces tamper-evident, tion from documents inherits extraction error: boundaryregulator-grade records of violation verdicts, explana- band dates misclassified against a lookback window, the tions, and supporting evidence. The audit log serves as same loss double-counted under distinct claim numbers, a durable sink for records from upstream components. differing totals read from different documents. Trace-level evaluation removes a structural blindness; it does not re• Governance Dashboard & Alerting Pipeline: Pro- move measurement error. vides portfolio- and instance-level visibility into CPV posture and routes actionable CPV findings to human Partial and asynchronous observability: The architecture assumes an ordered event log per workflow instance. reviewers and enforcement systems. Distributed execution, clock skew, out-of-order delivery, These are operational infrastructure supporting the core de- and external tools that do not emit telemetry all degrade tection logic; they do not contribute to CPV identification this assumption, and runtime verification under incomplete or distributed observation is known to admit inconclusive itself. verdicts [20, 21]. The CPV Detector architecture operationalizes trace-level governance through four core detection stages: Prove- Entity resolution: Cumulative Sum Violations are defined nance Ingestion normalizes runtime events into a canonical over the aggregate belonging to an entity. Fragmented identrace; State Reconstruction maintains complete history and tities, aliases, or multiple accounts prevent construction raw provenance; Policy Evaluation checks both step-level of the correct aggregate, and no amount of trace retention and workflow-level policies; and Compositional Detec- repairs an aggregate assembled over the wrong partition. tion identifies violations that emerge only at the sequence Hidden state: Agent memory, retrieved context, and realevel. This linear flow is anchored by two foundational desoning not surfaced as events lie outside the trace. Where sign invariants: history-completeness ensures no violation policy-relevant state is carried in such channels, the reconverdict is rendered from a truncated view, and recountstructed trajectory is incomplete and the detector’s verdict from-raw-provenance ensures all policy-relevant quantities is correspondingly weaker. are recomputed from original provenance, not intermediate pipeline representations. These invariants are not optional Cost: Retaining raw provenance and recomputing guarded refinements - they are structural necessities. This is why quantities at commit time imposes storage and latency the architecture cannot collapse into step-level checks; costs that scale with trace length and with the number it must work at the workflow level, treating policy en- of gated quantities; for Context Collapse in particular, forcement as a flow-level invariant rather than a post-hoc re-deriving the decision from the source submission apmonitoring layer. proaches the cost of the un-automated decision itself.
9
A PREPRINT - S EPTEMBER 17, 2026
6
Future Research
scale, and detecting them is foundational to trustworthy deployment.
As governance systems scale to handle compositional violations, key challenges emerge around deployment, generalization, and trust. Operationalizing the detector introduces engineering considerations, provenance collection overhead, persistent event log storage, latency in real-time policy evaluation, and efficient state reconstruction in distributed workflows. These are important implementation concerns but are orthogonal to the core detection mechanism. Production deployments will need to make storagelatency-accuracy trade-offs specific to workflow volume and SLA requirements, leveraging tiered storage, batch vs. streaming policy evaluation, and incremental state reconstruction. Beyond implementation, standardized frameworks for expressing governance logic and mapping it to workflow provenance remain absent. Whether violation mechanisms and detector architecture transfer to lending, hiring, moderation, and other high-stakes domains is unclear. Remediation strategies, accountability assignment, and defenses against adversarial obfuscation of audit trails raise practical and ethical questions beyond detection itself. Future research should focus on: (i) standardized policy languages and semantic mappings between governance intent and workflow provenance, enabling transparent detection across domains; (ii) simulation testbeds and benchmarked datasets analogous to those in fairness and interpretability to lower barriers to entry and enable performance comparison; (iii) efficient trajectory analysis and real-time provenance capture to bring detection costs within operational feasibility; and (iv) domain-specific instantiation and validation in regulated workflows
7
Conclusion
We have identified compositional policy violations as a distinct and consequential class of governance failure: sequences where every individual step is locally policycompliant yet the composed trajectory violates organizational governance, regulatory obligations, or business intent. By formalizing four violation mechanisms, deriving the repair topology each one demands, and proposing a detector architecture that describes on how to reconstruct full policy semantics from raw provenance, we have established that point-in-time checkpoint enforcement is structurally insufficient. This work opens a research agenda in policy-aware AI systems design - one that treats policy enforcement not as an external checkpoint but as a standing property of the workflow, holding across the full trace rather than at isolated decision points. As agentic AI workflows and production AI systems grow in autonomy and composition, the ability to detect violations that emerge from sequences of individually compliant steps becomes not merely an engineering concern but a prerequisite for organizational accountability and regulatory compliance. Compositional violations are not edge cases; they are inherent to how autonomous agents compose decisions at
References [1] Anthropic. Claude for financial services. https: //www.anthropic.com/news/claude-for-fin ancial-services, 2025. Official announcement; contains AIG CEO statement. [2] Allianz. Allianz and anthropic forge global partnership to advance responsible AI in insurance. https: //www.allianz.com/en/mediacenter/news/ media-releases/260109-allianz-and-anthr opic-forge-global-partnership.html, 2026. Official press release. [3] The Baldwin Group. The baldwin group announces expanded enterprise relationship with anthropic. ht tps://ir.baldwin.com/news-releases/ne ws-release-details/baldwin-group-annou nces-expanded-enterprise-relationship/, 2026. Official press release. [4] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: LLM-based inputoutput safeguard for human-AI conversations. arXiv preprint arXiv:2312.06674, 2023. Preprint. [5] Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christopher Parisien, and Jonathan Cohen. NeMo Guardrails: A toolkit for controllable and safe LLM applications with programmable rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 431–445, 2023. Peer-reviewed. [6] Langfuse. Observability data model. https://lang fuse.com/docs/observability/data-model, 2026. Official documentation; accessed 2026. [7] LangChain. Observability concepts. https://docs .langchain.com/langsmith/observability -concepts, 2026. Official documentation; accessed 2026. [8] Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, and Ethan Perez. Constitutional classifiers: Defending against universal jailbreaks across thousands of hours of red teaming. arXiv preprint arXiv:2501.18837, 2025. Preprint (Anthropic). [9] Haoyu Wang, Christopher M Poskitt, and Jun Sun. Agentspec: Customizable runtime enforcement for safe and reliable llm agents. arXiv preprint arXiv:2503.18666, 2025. [10] Tanzim Ahad, Ismail Hossain, Md Jahangir Alam, Sai Puppala, Yoonpyo Lee, Syed Bahauddin Alam, and Sajedul Talukder. Semantic intent fragmentation: A single-shot compositional attack on multi-agent ai
10
A PREPRINT - S EPTEMBER 17, 2026
pipelines. In Proceedings of the AAAI Symposium Series, volume 9, pages 229–237, 2026. [11] Mahdi Azarafrooz. Cross-session threats in AI agents: Benchmark, evaluation, and algorithms. arXiv preprint arXiv:2604.21131, 2026. Preprint. [12] Niloofar Mireshghallah, Neal Mangaokar, Narine Kokhlikyan, Arman Zharmagambetov, Manzil Zaheer, Saeed Mahloujifar, and Kamalika Chaudhuri. CIMemories: A compositional benchmark for contextual integrity of persistent memory in LLMs. In International Conference on Learning Representations (ICLR), 2026. Peer-reviewed. [13] Aniruddha Dhodapkar and Fatima Pishori. SafetyDrift: Predicting when AI agents cross the line before they actually do. arXiv preprint arXiv:2603.27148, 2026. Preprint. [14] Hunter Lightman, Vineet Kosaraju, Yura Burda, Harri Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. Let’s verify step by step. In International Conference on Learning Representations (ICLR), 2024. Peerreviewed. [15] Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. Why do multi-agent LLM systems fail? In Advances in Neural Information Processing Systems (NeurIPS), 2025. Peer-reviewed. [16] Ben Green. The flaws of policies requiring human oversight of government algorithms. Computer Law & Security Review, 45:105681, 2022. Peer-reviewed. [17] Kate Goddard, Abdul Roudsari, and Jeremy C Wyatt. Automation bias: a systematic review of frequency, effect mediators, and mitigators. Journal of the American Medical Informatics Association, 19(1):121–127, 2012. [18] United States Code. 31 u.s.c. § 5324: Structuring transactions to evade reporting requirements, 2024. Bank Secrecy Act provisions regarding transaction structuring. [19] Hoyoung Lee, Suhwan Park, Seunghan Lee, Jun Seo, Jaehoon Lee, Sungdong Yoo, Minjae Kim, CheolWon Na, Zhangyang Wang, Zach Golkhou, et al. When summaries distort decisions: Information fidelity in llm-compressed financial analysis. arXiv preprint arXiv:2606.29251, 2026. [20] David Basin, Felix Klaedtke, and Eugen Zǎlinescu. Failure-aware runtime verification of distributed systems. In Proceedings of the 35th IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science, 2015. [21] Andreas Bauer, Martin Leucker, and Christian Schallhart. Runtime verification for ltl and tltl. ACM Transactions on Software Engineering and Methodology (TOSEM), 20(4):1–64, 2011.
11