通过历史感知的风控机制，防止智能体因累积行为产生危害。
Agent Control Protocol: Admission Control for Agent Actions
- 基于静态风险评分与状态信号的时序准入控制
- 500次有效请求中仅允许2次执行（0.4%），显著降低风险
- 适合需严格安全管控的自主系统部署场景
自主智能体即使每个请求单独合法，也可能因累积行为产生有害模式——传统逐请求策略无法应对。本文提出ACP，一种基于静态风险评分与状态信号（异常积累、冷却期）的时序准入控制协议，通过LedgerQuerier抽象实现历史感知决策。在500个独立合法请求（RS=35）的负载下，无状态引擎批准全部请求，而ACP将自主执行限制为2/500（0.4%），在第3次动作后升级，第11次后拒绝。发现ACP-RISK-2.0存在跨上下文误拒漏洞，提出ACP-RISK-3.0，将异常信号作用域限定于PatternKey( agentID, capability, resource)。决策耗时739–832纳秒（p50），吞吐量达172万请求/秒。安全性与活性通过TLA+形式化验证（11个不变式 + 4个时序属性，0次违反），覆盖42.9亿种状态。提出‘偏差坍塌’概念及边界激活率（BAR）检测机制；当敌手将BAR压制至0.00时，ΔBAR可提前发现。多个协作智能体独立积累风险，协调窗口CW_appr=2N且无偏差时，活动线性增长，避免超线性放大。ACP是6篇智能体治理系列论文的第一篇（P0-P6），涵盖原子决策边界、行为漂移检测、治理结构、运行时有效性等方向。
原文摘要 · Abstract (English)
Autonomous agents can produce harmful behavioral patterns from individually valid requests -- a threat class per-request policy evaluation cannot address, because stateless engines evaluate each request in isolation. We present ACP, a temporal admission control protocol enforcing behavioral properties over execution traces via static risk scoring combined with stateful signals (anomaly accumulation, cooldown) through a LedgerQuerier abstraction. ACP blocks execution based on deterministic, history-aware risk scoring -- not anomaly detection. Under a 500-request workload where every request is individually valid (RS=35), a stateless engine approves all 500; ACP limits autonomous execution to 2 out of 500 (0.4%), escalating after 3 actions and denying after 11. We identify a state-mixing vulnerability in ACP-RISK-2.0 (cross-context false denials) and introduce ACP-RISK-3.0, scoping anomaly signals to PatternKey(agentID, capability, resource). Decision evaluation: 739-832 ns (p50); throughput 1,720,000 req/s. Safety and liveness model-checked via TLA+ (11 invariants + 4 temporal properties, 0 violations) across 4,294,930,695 distinct states. We formalize deviation collapse -- enforcement active but never exercised due to upstream constraints -- and introduce Boundary Activation Rate (BAR) as its detection mechanism. An adversary suppressing BAR to 0.00 is detected via DeltaBAR before collapse (BAR_C=1.00). N coordinated agents accumulate risk independently; coordination window CW_appr=2N with zero deviation: activity scales linearly, preventing superlinear amplification. ACP is Paper 1 of a 6-paper Agent Governance Series: P0 -- atomic decision boundaries; P2 -- behavioral drift detection (IML); P3/4 -- governance structure, fair allocation, and irreducibility; P5 -- runtime execution validity (RAM, arXiv:2604.22898); P6 -- operationalization of RAM.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。