ZEON SYSTEMS RESEARCH · WORKING PAPER 006 · RA-153.1-2

WP006 v1.5.1 — State-of-the-Art Addendum

4 October 2026Window: 12 August → 4 October 2026Scientific companionWP006 v1.5 architecture unchanged

Status. This addendum complements WP006 v1.5’s literature review. It does not silently change the canonical architecture, R0→R6 contracts, specification v0.1 or RA-Bench v0.1. Any subsequent architectural change must be published as a distinct version.

Main finding. Research published after 12 August 2026 reveals closer precedents than those incorporated in WP006 v1.5, including CONTINUITY, IntentCap, Bounded Agents and a structured review of authorization architectures for tool-using agents. These works now preclude presenting assume/guarantee contracts, bounded delegation, runtime enforcement, instruction→effect integrity or agent authorization as novelties unique to RA-153.1-2.

1. What v1.5.1 Changes — and Does Not Change

v1.5.1 changes the scientific positioning, not the published architecture. RA-153.1-2’s candidate contribution must be stated more narrowly: explicit composition of six replaceable planes linked by typed artifacts, passage and non-passage outcomes, then subjected to a falsification protocol.

SEMANTIC ↓ CAPABILITY ↓ COGNITIVE ↓ NORMATIVE / AUTHORITY ↓ EXECUTIVE ↓ EVIDENTIARY R0 → R6 EXECUTE · ABSTAIN · REFUSE · ESCALATE RA-BENCH / FALSIFICATION

This composition remains an architectural hypothesis to compare. The addendum does not claim that no neighboring system possesses substantial parts of it, or that the decomposition is superior by construction.

2. New or Newly Decisive Work

Date	Work	Class	Proximity	What it establishes	Implication for RA-153.1-2
August 16, 2026	Bounded Agents: Delegation Security for Multi-Agent AI Systems	PREPRINT	Very strong	Principal chains, attenuating delegation, accumulated budgets/scopes and authorization enforcement outside the model.	A direct precedent for bounded mandates, delegation and scope control. RA cannot claim these mechanisms individually.
August 24, 2026	AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems	PREPRINT	High	Runtime reference monitor, flow/path policies, task-scoped capabilities and authority checks at delegation boundaries.	Confirms that specialized enforcement must remain replaceable in RA’s normative/execution planes.
August 24, 2026	AI Agents Push Humans Out of the Loop	POSITION PAPER / PREPRINT	High — Human Gate	Simply retaining a human in the loop does not ensure effective oversight; prolonged automation use may erode capabilities needed for judgment.	Human Gate must provide intelligible context, alternatives, consequences and real refusal power; ESCALATE alone is not a guarantee.
August 31, 2026	Learning What to Retain: Gated-Memory Routing for Efficient Collaboration in Multi-Agent LLM Systems	PREPRINT	Medium — cognition	Adaptive routing based on compact execution state, dynamic role/backbone selection and adaptive stopping.	A recent precedent for a dynamic cognitive plane; explicitly distinguish it from governance authority.
August 30, 2026	OAuth Profile for Delegated AI Agent Authorization (draft-mishra-oauth-agent-grants-02)	IETF INTERNET-DRAFT — WORK IN PROGRESS	Very strong — standardization	Authenticated human consent, resource-bound and sender-constrained tokens, attenuated delegation through OAuth Token Exchange, refresh-token rotation.	R4/R5 and RA mandates must compose with OAuth rather than reinvent identity/delegation primitives. This document has no normative IETF status.
September 4, 2026	CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls	PREPRINT	Critical	Assume/guarantee contracts, authenticated security context, signed grants, provenance, transition receipts, transformation witnesses, execution permits and instruction→effect integrity.	The closest precedent found for secure end-to-end composition. v1.5.1 removes any implication that inter-component contracts or instruction→effect continuity are unique to RA.
September 4, 2026	From Language Models to World-Acting Systems	REVIEW / PREPRINT	High — positioning	Separates model competence, system integration, persistence and safe authority; proposes justified delegation as a heuristic.	Strengthens RA’s positioning as governed, verifiable delegation rather than model architecture.
September 9, 2026	AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents	PREPRINT	Strong — evaluation	Evaluates complete traces across ten dimensions and attributes failures to specific stages: planner, memory, tools, security, execution integrity, etc.	RA-Bench must retain dimensional metrics and add explicit fault attribution by plane; avoid verdicts reduced to a single score.
September 13, 2026	LLM Agent Capabilities Should Follow Task Intent and Context Source (IntentCap)	PREPRINT	Critical	Task-scoped capabilities, multi-source authority composition, field ownership, monotonic narrowing and short leases validated by a deterministic checker.	A major precedent for intention→capability→authority. RA must show precisely what its semantic/capability/cognitive separation adds to IntentCap.
September 14, 2026	Authorization Architectures for Tool-Using AI Agents	STRUCTURED REVIEW / PREPRINT	Critical	Review of 89 sources; principal hierarchy, multi-hop delegation, runtime enforcement/JIT authorization, prompt injection as authorization bypass, provenance and non-repudiation.	Becomes a pivotal source for the precedence matrix; sharply narrows potential agent-authorization claims.
September 14, 2026	Delegating Authorization to Misaligned Agents: Coalitional Alignment and Safe Control	PREPRINT	High — oversight	Formalizes collective action review when permanent human approval is too costly, with safety conditions on a reviewer panel.	Human Gate must not be designed as the only possible external authority; collective review structures may be necessary.
September 16, 2026	Who Audits Whom, on What Substrate, with What Evidence?	PREPRINT	High — evidence/audit	Graded independence across principal, substrate and evidence; overall assurance is bounded by the weakest link.	R6/Trust Passage must distinguish self-reported evidence, attestable evidence and auditor/substrate independence.
September 18, 2026	NIST ARIA Evaluation Planning Manual	NIST — INSTITUTIONAL	High — TEVV	Holistic evaluation combining Model Testing, Red Teaming and User Testing.	RA-Bench must connect architectural tests, adversarial/red-team tests and human/contextual evaluation rather than treat the benchmark as sufficient evidence.
September 21, 2026	APEXA: Execution-Integrity Enforcement for Multi-Agent LLM Automation of Synchrotron Data Reduction	PREPRINT	Strong — execution/evidence	A deterministic guard refusing to present as results anything unsupported by actual execution; distinguishes transcript from physical consequence.	R6 must distinguish claims, commands, actual effects and effect evidence. A transcript never constitutes execution evidence.
September 29, 2026	NIST NCCoE — Software and AI Agent Identity and Authorization: summary of comments	NIST NCCoE — INSTITUTIONAL	Very strong — identity/authorization	More than 600 contributions; transition to a first DevSecOps use case for identifying, authenticating and authorizing agents.	RA must remain a composition layer with identity/authorization standards rather than substitute for them.

3. Revised Precedence Matrix

RA Function	Precedents now identified	v1.5.1 Positioning
Semantic resolution	When to Reason; Context Kubernetes; earlier v1.5-corpus work.	Semantic understanding is not novel; RA must evaluate passage quality toward capability requirements.
Capability resolution	MCP/A2A ; MetaCogAgent ; IntentCap ; AgentFlow.	Candidate value lies in explicit need→capability→strategy→authority separation, not the existence of a capability resolver.
Cognitive strategy	Select-then-Solve ; Governed Reasoning ; Gated-Memory Routing.	Cognitive routing is distinct from governance; test this boundary by ablation.
Governance / policy enforcement	Formal Policy Enforcement ; AgentFlow ; CONTINUITY ; Authorization Architectures.	Reference monitors, policy enforcement and assume/guarantee are not RA novelties.
Authority / delegation	SAB/SEB ; Bounded Agents ; IntentCap ; OAuth delegated-agent profile ; NIST/NCCoE.	RA must compose with standard delegation/identity mechanisms, then add a verifiable mandate and non-passage structure.
Human Gate	Governed Reasoning ; AI Agents Push Humans Out of the Loop ; Coalitional Alignment.	ESCALATE restores authority but does not guarantee effective human judgment. Escalation’s cognitive quality becomes a test object.
Bounded execution	SAB/SEB ; Bounded Agents ; CONTINUITY ; APEXA.	RA claims neither brokerage nor pre-effect checks; it must demonstrate coherence from intention to that check.
Evidence / attestation	PCAA ; CAVA ; CONTINUITY ; APEXA ; Independence-Graded Audit.	R6 must remain an open evidence contract and distinguish traces, receipts, effects, attestations and audit independence.
Evaluation	NIST ARIA; TEVV-Athlon; AgentAudit; specialized benchmarks.	RA-Bench is not universal validation; it must publish dimensions, gates, fault attribution, red teaming, uncertainty and limits.
End-to-end composition	CONTINUITY is now a very close precedent; other works cover each remaining segment.	RA’s candidate contribution must be defined as a particular six-plane decomposition + R0→R6 + non-passage + falsification, to be compared experimentally.

4. Implications for Scientific Originality

Remove as a possible implication. RA-153.1-2 is not based on an absence of work on governance, authorization, delegation, enforcement, assume/guarantee contracts, execution integrity or portable evidence.

Revised candidate contribution. RA-153.1-2 proposes separating and composing six responsibilities—semantic, capability, cognitive, normative, execution and evidence—within one engineering framework, using R0→R6 artifacts, first-class non-passage outputs and architectural falsification. Any possible novelty concerns this composition and its boundaries, not individual building blocks.

This contribution is not declared original by assertion. It becomes a empirical and comparative question : does RA’s decomposition reduce fault classes or improve attribution, contestability, policy portability and mandate→effect verification relative to neighboring architectures?

5. Implications for R0→R6 Contracts

R0 / R1 — Intent and context

Explicitly introduce authority-source provenance and distinguish informational content, instruction and authority. IntentCap shows that not all contexts should be able to expand the same fields.

R2 — Capability requirements

Test monotonic narrowing : a downstream stage may narrow an authorized capability, never silently expand it from a less authoritative source.

R3 — Cognitive strategy

Preserve separation from governance. Adaptive routing or collaboration memory can improve strategy without creating additional authority.

R4 — Decision / mandate

Align mandates with principal, audience/resource, sender binding, scope, delegation, expiry and revocation. Human Gate must provide not only an approval request but the material required for judgment.

R5 — Execution

Test security-context continuity at every boundary and scope preservation during retries, fallback and delegation. Actual execution must never be inferred from a transcript.

R6 — EvidenceBundle

Distinguish at least system claims, issued commands, observed effects, receipts, attestations and evidence/audit independence.

6. Implications for RA-Bench

v1.5.1 recommends extending future RA-Bench beyond the five v0.1 gates without retrospectively changing their results. Candidate extensions are:

Security-context continuity : loss, widening, rebinding or reinterpretation of security context between components;
Delegation monotonicity : downstream delegation cannot increase scope, budget or authority;
Authority-source integrity : an informational source cannot appropriate a field reserved for the principal or policy;
Human Gate quality : does escalation supply sufficient information and contestability for a genuine human decision?
Execution integrity : a result cannot be presented as executed without evidence of a corresponding effect;
Fault attribution : identify the responsible R0→R6 plane rather than merely reporting global failure;
Evidence independence : characterize who produces evidence, on what substrate and with what independence;
Comparative baselines : test RA against configurations inspired by CONTINUITY, Bounded Agents / IntentCap and specialized mechanisms, not only internal ablations.

Retained principle. A high average never compensates for an authority violation. New metrics remain secondary to non-compensatory safety gates.

7. Human Gate: Scope Correction

WP006 v1.5 correctly defines escalation as non-passage until external authority decides. Recent literature nevertheless requires distinguishing human presence and effectively exercisable human authority. A Human Gate interface should therefore preserve:

the exact question to resolve;
provenance of decisive material;
relevant options and consequences;
uncertainties and disagreements;
the right to refuse or defer;
the ability to challenge the AI’s framing;
decision traceability without turning the trace into automatic justification.

8. Scientific Position v1.5.1

Recommended formulation.

RA-153.1-2 claims neither the invention of agent governance nor bounded delegation, assume/guarantee contracts, runtime enforcement, contextual authorization or execution evidence. Its candidate contribution is explicit composition of six distinct planes—semantic, capability, cognitive, normative, execution and evidence—linked by typed R0→R6 artifacts and passage/non-passage outcomes, then subjected to falsification. This composition must be evaluated experimentally against neighboring architectures.

9. Version Decision

WP006 v1.5 remains unchanged. This document is published as v1.5.1 — State-of-the-Art Addendum. v1.6 will be justified only if comparison with these precedents changes invariants, R0→R6 contracts, Human Gate or RA-Bench.

10. Primary and Institutional Sources

Bounded Agents: Delegation Security for Multi-Agent AI Systems — August 16, 2026 — PREPRINT.
AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems — August 24, 2026 — PREPRINT.
AI Agents Push Humans Out of the Loop — August 24, 2026 — POSITION PAPER / PREPRINT.
Learning What to Retain: Gated-Memory Routing for Efficient Collaboration in Multi-Agent LLM Systems — August 31, 2026 — PREPRINT.
OAuth Profile for Delegated AI Agent Authorization (draft-mishra-oauth-agent-grants-02) — August 30, 2026 — IETF INTERNET-DRAFT — WORK IN PROGRESS.
CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls — September 4, 2026 — PREPRINT.
From Language Models to World-Acting Systems — September 4, 2026 — REVIEW / PREPRINT.
AgentAudit: An Open, Extensible Framework for Full-Lifecycle Trust Evaluation of AI Agents — September 9, 2026 — PREPRINT.
LLM Agent Capabilities Should Follow Task Intent and Context Source (IntentCap) — September 13, 2026 — PREPRINT.
Authorization Architectures for Tool-Using AI Agents — September 14, 2026 — STRUCTURED REVIEW / PREPRINT.
Delegating Authorization to Misaligned Agents: Coalitional Alignment and Safe Control — September 14, 2026 — PREPRINT.
Who Audits Whom, on What Substrate, with What Evidence? — September 16, 2026 — PREPRINT.
NIST ARIA Evaluation Planning Manual — September 18, 2026 — NIST — INSTITUTIONNEL.
APEXA: Execution-Integrity Enforcement for Multi-Agent LLM Automation of Synchrotron Data Reduction — September 21, 2026 — PREPRINT.
NIST NCCoE — Software and AI Agent Identity and Authorization: summary of comments — September 29, 2026 — NIST NCCoE — INSTITUTIONNEL.

Methodological note: this update is broad, targeted research into work likely to change RA-153.1-2’s positioning. It does not guarantee absolute exhaustiveness of all literature published during the period.