Cognitive Admission Control: Risk-Conditioned Assurance for Consequential Actions in Agentic Distributed Systems
cs.DC · cs.AI · cs.SE
Quick verdict
Proposes CAC, a policy-relative admission layer for agent actions; careful, honest formal work, but evidence is synthetic local trials with no LLM agents.
Summary
The paper introduces Cognitive Admission Control (CAC), a policy-governed admission layer that sits between autonomous agents and the execution gateways for infrastructure they may mutate. A policy maps typed proposals and a six-coordinate risk vector to assurance obligations—predicates, acceptable evidence classes, scope, freshness, and witness-set constraints—which a deterministic evaluator discharges as satisfied, violated, or unknown; unresolved obligations trigger targeted evidence acquisition, and successful admission mints a single-use, freshness-bounded certificate with dispatch-time guards. The authors formalize the calculus, state conditional refinement and dispatch properties (including two elementary separation theorems), and evaluate a TypeScript prototype in 2,730 controlled local trials (13 synthetic failover scenarios x 7 controllers x 30 seeds) with independent effect observation. CAC completes 120 effects with zero modeled harm; a live-policy baseline matches completion but admits 30 harmful effects in a constructed correlated-witness scenario, as do guard, EFD, and typed-evidence ablations. A further 9,000 samples time the full local dispatch path (per-process medians 4.65–26.86 ms for 1–8 obligations). The evaluation is entirely local and in-process: no language models, no real databases or networks, and scenarios built around CAC's own mechanisms, so the safety result mostly confirms enforcement of authored policy. The paper is notably candid about all of this, including disclosing and discarding a flawed earlier 5,261-record evaluation batch.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Authorization and operational readiness are informationally distinct: no mechanism observing only identity/scope projections can establish readiness predicates, whereas CAC obligations can (Theorem 1).
- A deterministic ternary evaluator over typed, freshness-scoped evidence obligations soundly refines policy-relative admissibility and binds permits to single-use certificates with dispatch guards (Theorem 3, Properties 1-3).
- Physical safety is explicitly outside admission: it additionally requires evidence soundness, policy adequacy (Eq. 20), and preservation of relevant conditions through the effect (Section 5.2).
- In 2,730 controlled local trials, CAC completed 120 effects with zero modeled harm while a live-policy baseline admitted 30 harmful effects only in a constructed correlated-witness scenario blocked by structural-cut enforcement (Table 2, Section 9.2).
- Complete local dispatch with persistent replay protection costs single-digit to tens of milliseconds (per-process medians 4.65-26.86 ms for 1-8 obligations), with bounded witness search the dominant scaling term.
Strengths
Exceptional claim scoping and disclosure norms
Abstract, Sections 8.3, 9 and 12 repeatedly delimit guarantees as policy-relative and local; the paper explicitly disclaims production safety rates and utility advantage over the LivePolicy baseline, and quarantines its own flawed 5,261-record predecessor batch rather than pooling it.
Verification protocol above field norm
A privileged observer independent of controller verdicts labels harm from world snapshots (Section 8.1); a matched pre-dispatch hook injects drift/revocation for all seven controllers; frozen JSONL traces with SHA-256 manifests checked by an independent Python analyzer (Section 8.3); 133 tests plus an exhaustive 43,561-combination cross-check of the structural cut (Appendix A.5).
Carefully engineered admission semantics
Honest comparator and ablation design
Weaknesses
Benchmark circularity
No agent in the loop
Formal results are elementary
Utility tie with the baseline
Local-only cost and scale evidence
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper defines Cognitive Admission Control (CAC), a policy-governed admission layer between agent proposals and the gateways executing infrastructure mutations. Policies map typed proposals and a six-coordinate risk vector (Sec. 3.3) to assurance obligations - predicate, accepted evidence classes, scope, freshness horizon, witness-set constraints (Sec. 3.5); a deterministic evaluator returns SATISFIED/VIOLATED/UNKNOWN (Eq. 12), unknown triggers typed remediation (Sec. 4.4), and success mints a single-use certificate binding the witness manifest and dispatch guards, with lifetime bounded by the earliest supporting receipt (Eqs. 16-17). Claims are explicitly policy-relative: Theorem 1 (authority-readiness separation) and Theorem 2 (budget does not determine admission) are information-separation observations; Theorem 3 is a refinement property conditional on complete policy resolution and sound discharge; physical safety additionally requires evidence soundness and policy adequacy (Eq. 20), which the system cannot itself supply. Appendix A provides boundary counterexamples and a 43,561-combination exhaustive cross-check of the imported structural cut.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is Cognitive Admission Control (CAC)?
It is a proposed policy layer for agentic systems that sits between an autonomous agent's proposed action and the gateway that executes it. Before allowing a consequential action (such as failing over a database), a deterministic evaluator checks typed evidence obligations - specific predicates observed by acceptable sources within freshness limits, with quorum and separation constraints on witnesses - and classifies each as satisfied, violated, or unmet; unmet ones trigger targeted evidence requests, and passing actions receive a single-use certificate with dispatch-time guards.
Does this paper involve large language models?
No. Although CAC targets agentic systems, the prototype and all 2,730 experiments run without invoking any language-model API; proposers and comparators are scripted state machines. The paper explicitly states it does not compare language-model capabilities.
What were the main experimental results?
In 2,730 controlled local trials (13 scenarios x 7 controllers x 30 seeds), CAC completed 120 effects with zero modeled harm; a live-policy baseline completed the same 120 but admitted 30 harmful effects in a constructed correlated-witness scenario, as did guard, structural-cut, and typed-evidence ablation variants. A separate 9,000 measurements put full local dispatch-path per-process medians at roughly 4.65-26.86 ms for 1-8 obligations on an Apple M4 laptop.
Is the CAC prototype code publicly available?
The paper describes a TypeScript artifact with 133 passing tests, frozen JSONL traces, SHA-256 manifests, and named analysis scripts, but the provided text contains no public repository link or DOI, so availability cannot be confirmed from the paper alone.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 1 (deployment interface) is available only as caption text; layout not verifiable.
- No code repository URL or artifact DOI appears in the extracted text; code availability marked false means 'not stated', not 'denied'.
- Abstract tail is truncated mid-word in extraction ('establ...'); conclusions were drawn from the body text.
- Review is based solely on the provided text; the artifact, tests, and traces were not independently inspected.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.