Petri-net agent supervisor consumed one-use approvals before tool effects

A model can ask repeatedly for an action, but the tool runtime need not reinterpret permission each time. The paper models privileges and one-shot approvals as state transitions, so a prompt cannot recreate a consumed authorization token. primary evidence illustrates how a deterministic harness can preserve constraints even when the agent’s reasoning changes.

This is a modeled research system, not certification of a deployed production agent. Its guarantees depend on the model of tools and the correctness of every effect-bearing transition.

Keep side-effect gates outside prompts, use one-use scope-bound approvals and instrument retries. Test irreversibility and abandoned partial effects before extending the formal claim to live services.

The harness places an executable policy state machine between model-generated requests and tool invocation. A one-use approval or budget is a consumed mark, not a textual sentence that the agent can quote again. The authors explicitly model tool outcomes as uncontrollable and prove safety only under four assumptions; they also show that a maximally permissive supervisor can create excessive replanning cost when a model repeatedly requests denied actions. A practical deployment would need an out-of-band acknowledgement for non-idempotent effects and an explicit retry budget; the paper is not evidence that those controls have been verified in a production release system.