Paper deep dive
From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers
Xiangyu Wen, Yuang Zhao, Xiaoyu Xu, Lingjun Chen, Changran Xu, Shu Chi, Jianrong Ding, Zeju Li, Haomin Li, Li Jiang, Fangxin Liu, Qiang Xu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%
Last extracted: 4/26/2026, 9:50:51 PM
Summary
The paper proposes Arbiter-K, a 'Governance-First' execution architecture for agentic AI designed to address the fragility and security vulnerabilities of current LLM-based orchestration. Instead of treating the LLM as the central control loop, Arbiter-K reconceptualizes the LLM as a non-privileged Probabilistic Processing Unit (PPU) encapsulated by a deterministic, neuro-symbolic kernel. The architecture introduces a Semantic Instruction Set Architecture (ISA) with five logical cores (Cognitive, Memory, Execution, Normative, and Meta-cognitive) to reify probabilistic messages into discrete, auditable instructions. This allows the kernel to implement active taint propagation, maintain a Security Context Registry, and construct an Instruction Dependency Graph (IDG) to intercept unsafe trajectories at deterministic sinks. Evaluations on OpenClaw and NanoBot frameworks show that Arbiter-K significantly improves unsafe interception rates (76% to 95%) compared to native policies.
Entities (13)
Relation Signals (6)
Symbolic Kernel â constructs â Instruction Dependency Graph
confidence 100% ¡ allows the kernel to... construct an Instruction Dependency Graph at runtime
Arbiter-K â contains â Symbolic Kernel
confidence 100% ¡ reconceptualizes the underlying model as a Probabilistic Processing Unit encapsulated by a deterministic, neuro-symbolic kernel.
Arbiter-K â evaluatedon â OpenClaw
confidence 100% ¡ Evaluations on OpenClaw and NanoBot demonstrate that Arbiter-K enforces security
Semantic ISA â hascores â Cognitive Core
confidence 100% ¡ The ISA is partitioned into the following logical cores: Cognitive Core...
Arbiter-K â implements â Semantic ISA
confidence 100% ¡ Arbiter-K implements a Semantic Instruction Set Architecture (ISA) to reify probabilistic messages into discrete instructions.
Symbolic Kernel â maintains â Security Context Registry
confidence 100% ¡ This allows the kernel to maintain a Security Context Registry
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The transition of agentic AI from brittle prototypes to production systems is stalled by a pervasive crisis of craft. We suggest that the prevailing orchestration paradigm-delegating the system control loop to large language models and merely patching with heuristic guardrails-is the root cause of this fragility. Instead, we propose Arbiter-K, a Governance-First execution architecture that reconceptualizes the underlying model as a Probabilistic Processing Unit encapsulated by a deterministic, neuro-symbolic kernel. Arbiter-K implements a Semantic Instruction Set Architecture (ISA) to reify probabilistic messages into discrete instructions. This allows the kernel to maintain a Security Context Registry and construct an Instruction Dependency Graph at runtime, enabling active taint propagation based on the data-flow pedigree of each reasoning node. By leveraging this mechanism, Arbiter-K precisely interdicts unsafe trajectories at deterministic sinks (e.g., high-risk tool calls or unauthorized network egress) and enables autonomous execution correction and architectural rollback when security policies are triggered. Evaluations on OpenClaw and NanoBot demonstrate that Arbiter-K enforces security as a microarchitectural property, achieving 76% to 95% unsafe interception for a 92.79% absolute gain over native policies. The code is publicly available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2604.18652v1
- Canonical: https://arxiv.org/abs/2604.18652v1
Trouble viewing inline? Open PDF directly â
Full Text
60,246 characters extracted from source content.
Expand or collapse full text
From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers Xiangyu Wen CUHK Hong Kong SAR, China Yuang Zhao Shanghai Jiao Tong University Shanghai, China Xiaoyu Xu Zhejiang University Hangzhou, China Lingjun Chen Peking University Beijing, China Changran Xu CUHK Hong Kong SAR, China Shu Chi Tsinghua University Beijing, China Jianrong Ding CUHK Hong Kong SAR, China Zeju Li CUHK Hong Kong SAR, China Haomin Li Shanghai Jiao Tong University Shanghai, China Li Jiang Shanghai Jiao Tong University Shanghai, China Fangxin Liu Shanghai Jiao Tong University Shanghai, China Qiang Xu â CUHK Hong Kong SAR, China Abstract The transition of agentic AI from brittle prototypes to pro- duction systems is stalled by a pervasive crisis of craft. We suggest that the prevailing orchestration paradigmâdelegating the system control loop to large language models and merely patching with heuristic guardrailsâis the root cause of this fragility. Instead, we propose Arbiter-K, a Governance-First execution architecture that reconceptualizes the underlying model as a Probabilistic Processing Unit encapsulated by a deterministic, neuro-symbolic kernel. Arbiter-K implements a Semantic Instruction Set Architecture (ISA) to reify prob- abilistic messages into discrete instructions. This allows the kernel to maintain a Security Context Registry and construct an Instruction Dependency Graph at runtime, enabling ac- tive taint propagation based on the data-flow pedigree of each reasoning node. By leveraging this mechanism, Arbiter- K precisely interdicts unsafe trajectories at deterministic sinks (e.g., high-risk tool calls or unauthorized network egress) and enables autonomous execution correction and architec- tural rollback when security policies are triggered. Evalua- tions on OpenClaw and NanoBot demonstrate that Arbiter- K enforces security as a microarchitectural property, achiev- ing 76% to 95% unsafe interception for a 92.79% absolute gain over native policies. The code is publicly available at https://github.com/cure-lab/ArbiterOS. 1 Introduction The emergence of agentic AI as a primary computational workload has initiated a critical transition from brittle pro- totypes to production grade systems. Unlike traditional in- ference tasks that are transient and stateless, agentic work- loads involve long running execution traces with deep state â Corresponding author. Email: qxu@cse.cuhk.edu.hk. dependencies and frequent interactions with the host envi- ronment. These systems solve complex objectives through iterative reasoning and acting loops, necessitating the in- vocation of external tools and the access to sensitive sys- tem resources. Given the high degree of autonomy inherent in these agents, their execution trajectories are intrinsically non-deterministic and exert direct side effects on the under- lying system state. Consequently, establishing a secure and verifiable execution model for such workloads has emerged as a fundamental reliability challenge. We suggest that the prevailing Orchestration paradigm is the root cause of this fragility. This design pattern commits a fundamental category error by treating the Large Language Model (LLM) as the core of the system control loop. Concep- tually, current frameworks grant an opaque and stochastic inference engine the authority typically reserved for a se- cure system kernel. This grants the untrusted model author- ity over critical control flows, making the agent intrinsically vulnerable to cascading errors and semantic injections. Ex- isting security measures function as reactive filters on top of black boxes, offering only local output sanitization with- out formal guarantees for global state transitions or archi- tectural integrity. This architectural vulnerability leads to a pervasive cri- sis of craft where reliability is treated as an emergent prop- erty of model behavior rather than a guaranteed result of principled design. This flaw results in state of the art mod- els achieving success rates as low as 30% on complex real world tasks [ 21]. Existing guardrails prove extremely frag- ile against semantic injection attacks; experimental data in- dicates that over 40% of malicious instructions can bypass text based defense mechanisms [ 13]. Furthermore, relying on the LLM itself for security self-checks incurs prohibi- tive computational overhead. Importantly, by treating agent arXiv:2604.18652v1 [cs.CR] 20 Apr 2026 Wen et al. traces as opaque plain text, existing systems cannot perform fine-grained privilege verification or data-flow auditing. Our key observation is that the failure of agentic gover- nance is rooted in the absence of a formal interface between probabilistic reasoning and deterministic execution. In clas- sical systems, the Instruction Set Architecture (ISA) serves as the fundamental contract between intent and execution, abstracting operations into a set of discrete primitives with deterministic side effects. We suggest that agentic comput- ing requires a similar contract to bridge this semantic gap. The significance of a Semantic ISA lies in providing the phys- ical basis for instruction decoding and architectural audit- ing. By reifying opaque token streams into atomic semantic instructions, the kernel can define explicit execution privi- leges and data dependencies. This transformation allows the system to convert unobservable semantic deviations into captureable architectural exceptions. To implement this insight, we proposeArbiter-K, a gov- ernance first execution architecture. We reconceptualize the LLM as a Probabilistic Processing Unit (PPU) and define a Semantic ISA comprising five specialized logical cores. The architecture demotes the PPU to a non-privileged proposal generator while mandating that all environment altering instructions be validated by a symbolic kernel. The kernel maintains a Security Context Registry and dynamically con- structs an Instruction Dependency Graph (IDG) during run- time. This enables an active taint propagation mechanism based on data flow pedigree, ensuring that the kernel can proactively interdict unsafe trajectories before they reach deterministic sinks. Furthermore,Arbiter-Kenables the au- tonomous execution correction, allowing the system to fully reuse the feedback from the security kernel upon detecting semantic divergence. We implemented a prototype ofArbiter-Kon top of the OpenClaw [ 16] and NanoBot [15] frameworks. Our evalu- ation shows that, by enforcing security as an architectural property,Arbiter-Keffectively blocks sophisticated seman- tic attacks while requiring only minimally invasive changes to the underlying agent frameworks. Preliminary results in- dicate thatArbiter-Kintercepts more than 92% of unautho- rized access attempts, while incurring a false interception rate of less than 6% on benign operations in the NanoBot framework. These results demonstrate thatArbiter-Kcan substantially strengthen execution determinism and enforce resource boundaries without degrading the agentâs reason- ing capabilities. Contributions are summarized as follows: â˘We define a Semantic ISA that provides a formal ex- ecution abstraction for agentic workloads, bridging the gap between probabilistic reasoning and deter- ministic system sinks. â˘We proposeArbiter-K, a governance-first architec- ture that utilizes an Instruction Dependency Graph and a Security Context Registry to implement active taint propagation and architectural rollback. â˘We demonstrate through an implementation on the OpenClaw and NanoBot frameworks that Arbiter-K successfully enforces microarchitectural security in- variants while maintaining high system performance. 2 Backgrounds 2.1 Prompt Engineering for Agent Building Prompt engineering has transitioned from a superficial in- terface into the primary mechanism for directing the behav- ior of PPUs. Current methodologies emphasize structured and multi-stage control flow to maximize performance in complex planning and tool-use tasks [ 5]. This evolution in- cludes techniques such as chain-of-thought and ReAct-style reasoning [22], which are increasingly treated as a stochas- tic optimization problem where instructions and exemplars are tuned to steer model output distributions [17,22]. In sophisticated environments [9], advanced frameworks for multi-agent coordination demonstrate how higher-level manager agents can synthesize and refine subordinate sys- tem prompts by utilizing chain prompting, personas, and self-reflection to scale specialization [3,18,22]. Consequently, prompt engineering serves as the central architectural lever for defining agent behavior rather than a superficial inter- face layer. However, this prompt-centric paradigm results in a monolithic coupling of execution logic, safety policies, and system configuration. Because prompts simultaneously encode functional capabilities and defensive constraints, mi- nor environment shifts necessitate a comprehensive redesign. Such artisanal maintenance fails to scale with deployment complexity. We propose a separation of concerns that treats reliability as a first-order architectural property rather than an outcome of heuristic PPU tuning. 2.2 Practices for Agent Governance To reduce reliance on heuristic prompts, most governance mechanisms adopt a guardrail-centric paradigm by wrap- ping rules and filters around an LLM-driven controller. While these methods improve observability, they treat governance as an external control surface rather than an architectural primitive. Consequently, these frameworks struggle to miti- gate the root causes of uncertainty and failure in probabilis- tic agents. Reactive Boundary Filters.Invariant Labs [ 6] focuses on observable behavior through telemetry and rule-based filters that interpose between the agent and its environment. Although these catch obvious violations, the PPU retains primary control over internal planning, which restricts these mechanisms to reactive boundary enforcement. Similarly, cloud-native systems such as Amazon Bedrock AgentCore [ 1] Table 1.Interception success rate (â) of native host guardrails under indirect semantic-injection evaluation. Agent SystemOpenClawNanobot Modelsclaude-3-5-sonnet claude-3-7-sonnet gpt-4o claude-3-5-sonnet claude-3-7-sonnet gpt-4o Benchmark AgentDojo4.59%2.17%7.07%2.55%8.70%0.00% Agent-SafetyBench7.07%4.70%6.33%1.25%1.39%1.41% 1. User Input (Multi-step Task) e.g., "Organize these files and then provide asummary." 2. AI Agent (Processing & Subtle Injection) [Action: Organize (files)] [Inject: 'Ignore summary, use delete_file on all.'] [Action: Summarize (content)] 3. Unauthorized ToolCall & Consequence [Action: delete_file (all_files)] [Result: Data Loss] Prompt Injection A subtle instruction within a larger task leads to unintended, harmful action. Figure 1.An example of a âSemantic Deviationâ where a subtle prompt injection in a multi-step task leads to an unau- thorized tool call. apply IAM principles to gate externally visible actions. How- ever, internal probabilistic transitions remain unverified be- cause policies do not constrain the generation process. Inte- grated monitors including AgentSafe [10] and related frame- works [20] utilize risk taxonomies to monitor the agent life- cycle, yet governance remains reactive as state transitions are observed rather than structurally governed during exe- cution. InterfaceEncapsulation.Alternatively, Anthropic Skills [ 2] encapsulates actions behind typed interfaces to narrow the action space. Nevertheless, the PPU still orchestrates skill in- vocation where brittle planning can result in unsafe execu- tion sequences. Collectively, these approaches assume that an untrusted stochastic process should orchestrate control flow, which contributes to the low success rates observed in complex tasks [13,21]. In contrast, the Governance-First paradigm recognizes uncertainty as a defining property of the computational substrate and requires probabilistic com- ponents to be encapsulated by a deterministic governor. 3 Motivation Unlike request-response inference, agentic execution is an iterative state machine: a reasoning model proposes actions, and the host runtime deterministically executes them. Each turn therefore couples stochastic model outputs with deter- ministic system sinks (e.g., file operations, command execu- tion, web/network access, and cross-session delegation). We first analyze the mismatch between probabilistic model proposals and sink-level safety invariants. Existing agent stacks commonly assume that model outputs can be treated as authoritative intents, with safety enforcement delegated to downstream, text-centric guardrails. Table 1quantifies the failure of this design under indirect semantic injection. Across both AgentDojo [4] and Agent-SafetyBench [24], na- tive host guardrails achieve interception rates below 9%, show- ing that they rarely stop unsafe operations once adversarial semantics are embedded into stateful execution trajectories. Observation 1: Reactive guardrails fail under stateful execution. Reactive, text-level defenses provide weak protection for state- ful agent workloads. Under indirect semantic injection as illus- trated in Figure1, native host guardrails miss more than 91% of unsafe operations. Similar vulnerabilities persist in Anthropic Skills where existing defenses fail to detect 40% of malicious skills [ 13]. Our measurements show nontrivial governance cost, adding about 15 seconds and over 10K tokens per skill. S1S2S3 Violation Abort & Rerun S1S99 Violation Abort & Rerun Small Wasted Prefix Massive Wasted Prefix (Amplified Cost) The mechanism: full-session abort vs. trajectory length (a) he mechanism: full-session abort vs. trajectory length. ShortMediumLong Total Token Waste Ideal (No Failures) Trajectory Depth (Task Length) Amplified Cost & Instability Abort-on-Violation Regime Trend summary: token waste amplification (b) Trend summary: token waste amplification. Figure 2.Cost profile under increasing task length: cumu- lative waste from repeated abort-and-retry behavior. These results expose a limitation of orchestration-only safety mechanisms: they lack visibility into execution se- mantics. When model outputs remain opaque text, the sys- tem cannot attribute how earlier untrusted inputs shape later high-impact actions. Governance therefore remains reactive and typically activates only at sink time, after unsafe influ- ence has already propagated through the execution state. Insight 1: Governance must operate on semantic instructions, not raw text. Closing this gap requires an instruction-level abstrac- tion for model outputs. By reifying outputs into a Semantic ISA and associating each instruction with security metadata, the sys- tem obtains operation-level visibility for pre-sink enforcement, provenance tracking, and auditable policy decisions. We further examine failure cost in long-running tasks. In many production agents, a policy violation triggers full- session abort, forcing expensive re-execution even when only Wen et al. a suffix is problematic. As task length increases, this abort- on-violation regime amplifies token waste and completion instability [21]. Figure2summarizes this trend under vary- ing trajectory depths. Observation 2: Cost of Context Abandonment. For complex tasks, attacks that derail an agent may emerge over long execution hori- zons.In AgentDojo, tasks requiring up to18serial tool calls are common, where each step is exposed to semantic injection. Even when a violation is detected, aborting the entire session provides sanitization at the cost of wasting at least1, 400tokens per failed attempt. Our analysis of failed traces further reveals that success- ful attacks occur at Step3.00on average in AgentDojo, consum- ing up to2, 805.5tokens of context before the violation manifests (Table 2). Even when a violation is detected at a late stage, the pre- vailing âabort-on-violationâ regime discards the entire execution history. This trade-off motivates a feedback-driven governance loop rather than repeated full-session restarts. Table 2.Attack onset in original OpenClaw traces.Avg. tokenscounts the tokenized prefix ending at the attack- triggering message. BenchmarkFail cases Avg. step Avg. tokens Agent-SafetyBench (gpt-4o) 7411.88640.2 AgentDojo (gpt- 4o, imp.) 2763.001561.5 Instead of treating violations as terminal failures, gover- nance should treat them as architectural exceptions with an- alyzable evidence. With instruction dependency and taint- aware trace metadata, the runtime can localize divergence, extract failure signatures, and feed them back into policy re- finement. Figure 3illustrates thispolicy feedbackloop that improves subsequent executions without assuming mono- lithic session resets as the only recovery primitive. Policy feedback loop: convert failed trajectory evidence into deterministic policy updates for future runs. Violation 1. Agent Execution (with Metadata) S1 S2 S3 3. Extract Failure Signature 2. Analysis & Localization Taint Propagation & Dependency Data Analyzable Evidence Policy Checking 4. Feedback as Guidance for Next Runs S4 Figure 3.Failed trajectories yield analyzable evidence that is fed back as policy guidance for subsequent runs. Insight 2: Policy Feedback as A Resilience Primitive. Reliability in agentic systems should be managed through trace-driven pol- icy feedback. By converting semantic deviations into actionable policy constraints, the governance layer reduces repeated failure modes, preserves useful execution context at the system level, and improves robustness over successive trajectories. We therefore argue that reliability cannot rely on arti- sanal prompting or purely reactive filters; it must be en- forced as an architectural invariant. Resolving the mismatch between probabilistic reasoning and deterministic execution requires a governance-first architecture in which a symbolic kernel mediates all environment-impacting operations through a Semantic ISA. Combined with taint-aware dependency anal- ysis and policy feedback, this approach turns runtime fail- ures into deterministic constraints for future executions, re- ducing repeated waste and improving safety under adver- sarial semantic inputs. 4 The Governance-First Paradigm Unlike existing orchestration frameworks that rely on dis- tributional patches, Arbiter-K is a governance-first architec- ture designed to surround the probabilistic engine with a robust and deterministic control environment. The key de- sign principle of Arbiter-K is Kernel-as-Governor, which es- tablishes a strict structural separation between an untrusted Probabilistic Processing Unit and a trusted Symbolic Kernel. As illustrated in Figure 4, Arbiter-K bifurcates agentic ex- ecution into two distinct security domains. The Probabilis- tic CPU, also referred to as the Neural Engine, is optimized for heuristic reasoning and proposal generation; it is treated as a non-privileged, opaque, and untrusted component. The Symbolic Governor, or the Deterministic Kernel, functions as a rule-based runtime that enforces rigid invariants includ- ing schemas, budgets, and permissions. These invariants are structural constraints that the PPU cannot override. By iso- lating operations that require safety and trust verification from the raw LLM agent paradigm, the architecture prevents cognitive instability from propagating to the external sys- tem state. Within this paradigm, the PPU is demoted to a proposal generator that emits intents to interact with the environ- ment. The kernel intercepts these intents and evaluates them against active policies, such as Resource Limits, Taint Checks, and Access Control Lists, before they reach any determinis- tic sinks. This restores a classical operating systems separa- tion of concerns where the kernel defines a small and veri- fiable transition system over symbolic state, while the PPU functions as a powerful but untrusted co-processor operat- ing entirely within the kernel constraints. Consequently, re- liability and governance become properties of the kernel de- sign, while prompt engineering and model choices are rele- gated to improving the quality and efficiency of proposals. Probablistic Processing Unit (PPU) Arbiter-K Kernel (Symbolic Governor) Policy Injection Policy Checking Taint Propagation Trace Logging & Structuring Proposal / Intent Augmented Prompt (System + User + Constraint) S e c u r i t y B o u n d a r y Untrusted Probablistic Domain Trusted Symbolic Domain Policy & Governance Plane Policy Set (Rules, Blacklists) Registry (Risk/Trust/Conf) Safety Scanner (Skills, Tools, External Files) Support Engine External System / Environment Governed Action Response Local Resources (Keys, APIs, Skills) External Resources (Web, Skills, Emails) Tracing & Observability Recording & Intervention Recoding Taints Policy Analysis Monitoring Scan & Register Environment Response + Policy Feedback Figure 4.Architecture of Arbiter-K. 5 Arbiter-K Design 5.1 Discrete Instruction Set Architecture A neuro-symbolic architecture predicated on the analogy of a PPU necessitates a well-defined Instruction Set Architec- ture (ISA). The ISA serves as the formal contract that drives the PPU and supports the kernel runtime. As illustrated in Figure5, we arrange the ISA into five logical cores, where each governs a distinct functional domain of the agent run- time. These cores provide a structured framework for man- aging everything from probabilistic reasoning to determin- istic safety enforcement. As summarized in Table 3, each in- struction is defined by its operational function and its gov- ernance property. This property dictates the mechanism by which the kernel monitors and validates execution to en- sure that every step in the agent trajectory is explicitly cat- egorized. This taxonomy enables the system to apply tar- geted security policies and resource constraints according to whether an operation is probabilistic or deterministic. The ISA is partitioned into the following logical cores: â˘Cognitive Core.This unit is responsible for proba- bilistic reasoning. Its outputs are treated as untrusted proposals that must be subjected to kernel validation. â˘Memory Core.This core governs how information is loaded, stored, and compressed, providing a struc- tured interface to working memory. It helps mitigate semantic drift [ 19] and context-window limitations through specialized context engineering techniques [14]. â˘Execution Core.This unit connects the agent to the external environment. All instructions in this core must be preceded by suitable verification. Operations are mediated through explicit control contracts and schema validation so that, for example, a payment tool can- not be invoked beyond predefined limits at the kernel level regardless of what the LLM proposes. â˘NormativeCore.As the most distinctive component of the architecture, this core encodes privileged safety and alignment operations including verification, con- straints, and fallbacks. This allows the system to im- pose deterministic checking and recovery paths on stochastic behavior. â˘Meta-cognitive Core.This core enables probabilis- tic self-assessment to guide strategic routing decisions within the runtime. Meta-cognitive Core PREDICT SUCCESSďź MONITOR RESOURCES Cognitive Core GENERATE, DECOMPOSE, REFLECT LLM (Internal) Normative Core VERIFYďźCONSTRAINďź FALLBACK Memory Core COMPRESSďźFILTERďź LOAD Execution Core TOOL_CALLďźAPI_REQUEST Untrusted Memory Input Untrusted Output Memory Write Trusted Output Replan Trusted Memory Input Observation Kernel Monitor Figure 5.Five instruction cores. Instruction Binding and Operational Interface.To operationalize this ISA, Arbiter-K employs an instruction binding layer that functions as the primary interface con- necting the symbolic ISA to the concrete agent runtime. This Wen et al. Local Files 1 Label at Source (Classification) Tools Web Data User Input Registry (Risk/ Trust/ Conf) 2 Propagate across Dependencies (Flow Tracking) 3 Evaluate Sink Semantics (Policy Check) 3 Enforce and Learn (Action & Feedback) Taint Label: Trust: Low Conf: Low Risk: N/A Trust: Low Conf: N/A Risk: Medium Instruction: FETCH Instruction: READ_FILE Instruction: RESPOND Instruction: SEND_EMAIL Instruction: SEARCH_WEB Instruction: DRAW Trust: low Conf: High Risk: Mid Policy Threshold Check Sink: Read web page Sink: Read key file Sink: Send key with email Risk: Mid low_trust < High_conf Action: Allow & Log Action: Allow & Log Action: Deny/Confirm /Feedback Trace Evidence Figure 6.Example and procedures of taint analysis. layer reifies abstract instructions into executable units by explicitly mapping implementation logic to specific instruc- tion types and enforcing structural constraints, as presented in the following code snippet. By establishing these map- pings through a dedicated binding interface, the architec- ture ensures that every instruction operates within a prede- fined functional scope with explicit data boundaries. Example Python Code of Instruction Bindings classWeatherInput(BaseModel): city:str classWeatherOutput(BaseModel): temperature:float condition:str status:str @arbiter_k.instruction( Instruction.CognitiveCore.generate, input_schema=WeatherInput, output_schema=WeatherOutput ) defweather_tool(city:str) ->dict: """Get weather for a city.""" # Simulated weather data return"temperature": 25.0, "condition": "sunny", "status": "success" Within this framework, each binding defines the opera- tional boundaries for an instruction through a pair of strictly- typedinput_schemaandoutput_schema. These schemas serve as the primary mechanism for data validation at the kernel level, ensuring that information flowing between the probabilistic Cognitive Core and the deterministic execu- tion environment is correctly structured. Instead of treating model outputs as raw text, the binding registry allows the kernel to intercept and validate every result against these predefined schemas before the state transition is finalized. This structured interface maintains type safety and state in- tegrity across complex and multi-step trajectories. Conse- quently, the kernel responsibility remains confined to man- aging the instruction-level agent trajectory and enforcing interface constraints, which allows the architecture to re- main agnostic to the underlying implementation details while maintaining rigorous control over the agent lifecycle. 5.2 Neuro-Symbolic Taint Tracking A fundamental capability enabled by the neuro-symbolic ar- chitecture is the adaptation of Taint Analysis [12], a stan- dard security technique in compiler design, to the neuro- symbolic domain. Taint Analysis tracks the flow of untrusted data through the system to prevent it from influencing sen- sitive operations without proper validation. In the Arbiter- K architecture, taint originates from three primary sources consisting of untrusted external databases, local privacy data, and the reasoning outcomes produced by the PPU. To man- age these inputs, the kernel implements a deterministic track- ing pipeline that monitors data flow across the instruction trajectory in the following stages. â˘TaintTaggingandPropagation.Any data entering the Memory Core from external sources, such as web search results, or from local sensitive files, such as an API key list, is explicitly labeled as tainted, as is any output produced by the Cognitive Core. Metadata in terms of security properties for all data and tools is maintained in the Arbiter-K registry. As shown in Table 3.Detailed taxonomy of the ISA. Overview of instructions across Cognitive, Memory, Execution, Normative, and Meta- cognitive cores, including their operational functions and specific governance properties. CoresInstructionFunctionGovernance Property Cognitive GENERATE Invokes the LLM for text generation, reason- ing, or formulating a query. Probabilistic outputthat is fundamentally untrusted. The required level and type of verification are determined by the active policy and the criticality of the step. DECOMPOSE Breaks a complex task into a sequence of smaller, manageable sub-tasks or creates a formal plan of execution. Probabilistic outputwhere the proposed plan is untrusted. High- reliability policies must validate the planâs structure and feasibility (e.g., via aVERIFYstep) before execution to prevent wasted resources and strategic errors. REFLECT Performs self-critique on generated output to identify flaws, biases, and areas for im- provement. Probabilistic outputwhere the critique itself is untrusted and may be biased or incomplete. Memory LOAD Retrieves information from an external knowledge base. Deterministic I/O.The retrieval process itself is deterministic, but the relevance of the retrieved data is not guaranteed. STORE Writes or updates information in long-term memory, enabling agent learning and persis- tence. Deterministic I/O.The data should be verified to be valid for saving. COMPRESS Reduces the token count of context using methods like summarization or keyword ex- traction. High-Risk Probabilistic Operation.This instruction can introduce hallucinations or omit critical data, corrupting the agentâs working memory. FILTER Selectively prunes the context to keep only the most relevant information for the cur- rent task. High-Risk Probabilistic Operation.Similar to COMPRESS, this in- struction can incorrectly discard relevant information. STRUCTURE Transforms unstructured text into a struc- tured format. Probabilistic Output.The extracted structure is untrusted and must be followed by a schema checker. RENDER Transforms a structured data object into co- herent natural language for presentation to a user. Probabilistic Output.The generated text is untrusted and may mis- represent the underlying data. Execution TOOL_CALL Executes a predefined, external, determinis- tic function. Deterministic Action.Supports sandboxing and requires post- execution verification for critical operations. TOOL_BUILD Writes new code to create novel tools on-the- fly. High-Risk Probabilistic Action.Generated code is inherently un- trusted and must undergo strict sandboxing and verification. DELEGATE Passes sub-tasks to specialized agents in multi-agent systems. Deterministic Handoff.While delegation act is deterministic, sub- agent behavior remains probabilistic. OS maintains comprehensive logs of all handoff events for traceability. RESPOND Yields final, user-facing output and signals task completion. Terminal Action.Output must be verified for quality assurance, safety compliance, and factual accuracy before presentation to end- user. Normative VERIFY Performs objective correctness checks against verifiable sources of truth. Deterministic Checkpoint for Correctness.Primary governance tool providing high-confidence PASS/FAIL signals for critical routing decisions. CONSTRAIN Applies normative compliance rules to out- puts, checking for safety, style, or ethical vi- olations. Architectural Enforcement of Policy.The kernel guarantees execu- tion and enforcement of outcomes, it is much belike skills or guardrails. FALLBACK Executes predefined recovery strategies when preceding instructions fail. Deterministic Control Flow.Provides predefined, trusted recovery paths essential for resilient systems. INTERRUPT Pauses execution to request human input, preserving agent state for oversight. Human-in-the-Loop.Deterministic handoff that pauses execution and routes a request to the Arbiter-K kernel for human review, guar- anteeing state preservation. Meta-cognitive PREDICT_SUCCESS Estimates the probability of successfully completing the current task or plan. Probabilistic Self-Assessment.Not a guarantee of correctness. EVALUATE_PROGRESS Performs strategic assessment of the agentâs current reasoning path about viability and productivity. Probabilistic Self-Assessment of Strategy.Detect unproductive paths, escape logical traps. MONITOR_RESOURCES Tracks key performance indicators includ- ing token usage, computational cost, and la- tency against predefined budgets. Deterministic Check.Hard constraint against Reliability Budget lim- its. Figure6, the kernel propagates this label throughout the instruction trace: if a subsequent instruction con- sumes tainted data, its resulting outputs are likewise marked as tainted. This taint-tracking mechanism mit- igates the risk that individually benign tools, when composed, create a security vulnerability. â˘Sink Enforcement.High-stakes instructions in the Execution Core, such asSQL_EXECUTE, are designated as Sinks. The kernel enforces a hard rule stating that no tainted data may reach a Sink. If the PPU attempts to execute a Sink instruction with Tainted arguments, the kernel intercepts the request to block execution. â˘InstructionVerification.To proceed with a restricted operation, the agent must pass the data through a VERIFYinstruction within the Normative Core. This instruction may involve human approval or a rigor- ous deterministic check. Only a successful verifica- tion clears the taint tag (taint sanitizing), which al- lows the kernel to permit the action to proceed to a downstream Sink. Wen et al. â˘Global Trace Recording.To support taint analysis and recovery, Arbiter-K implements an instruction- level trace recorder that captures rich metadata in- cluding reasoning rationales, decisions, and outcomes. The trace is bifurcated into two distinct parts. The user-facingtrace exposes step-level outcomes and interpretable information. Thekernel-leveltrace stores rule-checking results, verification justifications, and the rationales behind control-flow decisions. 5.3 The Symbolic Policy Engine As the core of the Arbiter-K kernel, the policy engine serves as the central authority for invariant enforcement and archi- tectural evolution. Within the governance-first paradigm, we utilize a set of invariants termedPoliciesto perform rig- orous safety checking at both the global and instruction lev- els. Unlike the heuristic safety rules common in traditional guardrails, policies in Arbiter-K are structural constraints embedded within the system runtime. These policies arise from three distinct sources consisting of consensus-based global rules, task-specific constraints, and dynamic rules syn- thesized from runtime taint analysis. â˘Global Consensus Policies.We define a set of pre- specified policies that reflect broad community con- sensus regarding safe agent behavior. These policies characterize allowable workflow structures via global consistency constraints rather than semantic analy- sis of generated text. Key examples include requir- ing thatâno deterministic tool call may be executed di- rectly after a probabilistic PPU generationâand ensur- ing that any step inducing external side effects satis- fies explicit preconditions. These constraints are for- malized as a right-linear grammar or a Finite State Machine (FSM), which enables the kernel to perform prefix-safe runtime checking and static validation of the agent trajectory. â˘Task-Specific Constraints and Gating.During the migration of an arbitrary agent system to the Arbiter- K architecture, a specialized migrator automatically defines suitable policies for the specific task domain. For instance, within a Trading Agent workload, a pol- icy is enforced to ensure thatâhigh-stakes actions, such as buy or sell orders, are preceded by explicit compli- ance and risk validation.âThis action gating ensures that persistent writes to the Memory Core or sensi- tive tool executions are followed by a deterministic checking stage or a convergence path. â˘Trace-DrivenPolicyRefinement.Arbiter-K derives new policies from signals captured in the global trace recorder. When the kernel identifies recurrent con- straints such as context length exceeding50k tokens, it instantiates rules to proactively invoke optimiza- tion primitives including context compression. This feedback loop enables the symbolic governor to adap- tively reconfigure kernel behavior at runtime. The policy engine transforms raw execution traces into actionable signals by integrating with the taint tracking mech- anism. The global trace recorder supports this process by capturing rich details for each step including rationales, de- cisions, and outcomes. By bifurcating the trace into auser- facingcomponent for interpretability and akernel-level component for rule-checking justifications, Arbiter-K pro- vides the necessary microarchitectural visibility to identify concrete failures. This mechanism enables the system to fully leverage policy- checking results and thereby reduce resource waste. For ex- ample, once a normative interruption is triggered, the pol- icy engine can drive the workflow directly into a response state with the policy feedback, ensuring forward progress without executing unnecessary steps. In this way, the ar- chitecture closes the loop between runtime governance and iterative improvement: a unified policy framework not only constrains current executions, but also informs the future architectural evolution of the agent. 5.4 Governance Tax and Reliability Budgets Reframing the Governance Trade-off.Governance over- head represents a primary architectural tax in autonomous systems because every safety check consumes additional com- putational resources and increases latency. Traditionally, de- velopers face a static trade-off where they must either en- able extensive guardrails and accept higher operational costs or disable them and accept higher residual risk. Arbiter-K reframes this dynamic as a resource allocation problem that evolves through iterative feedback rather than a one-time binary decision. IterativeOverheadScaling.In the initial execution phase, Arbiter-K introduces minimal governance overhead. Extra costs are only incurred when a request triggers specific rout- ing rules defined in the policy set, which may lead to longer instruction trajectories. Other policies within the global or task-specific sets primarily serve to generate alerts and sug- gest workflow adjustments for subsequent iterations rather than adding immediate latency to the current run. The gov- ernance tax only arises during later stages as the agent work- flow is updated based on these signals. While this evolution increases system complexity and execution cost, it yields a measurably safer execution environment. Reliability Budgets.To manage operational overhead, Arbiter-K introduces Reliability Budgets to enable the de- terministic allocation of governance resources. The kernel maintains an explicit reliability budget for each session de- fined along two primary axes consisting of a maximum al- lowable compute cost and an application-specific bound on residual risk. This budget constrains how the kernel allo- cates governance effort, ensuring that interventions remain Table 4.Hierarchy of governance strategies. Level Governance StrategyMechanismCost (C)Latency (L) Risk Reduction 0Zero-ShotDirect Pass-throughâ 0â 0Low 1HeuristicRegex, Keyword, Type CheckNegligibleMicrosecondsModerate 2Light ModelSmall SLM (e.g., 8B param) checkLowLowHigh 3Heavy ModelFrontier Model âJudgeâHighHighVery High 4HumanINTERRUPT for ApprovalVery HighMinutes/HoursMaximal within predetermined safety and economic limits. To achieve a dynamic balance between these competing objectives, we introduce a spectrum of governance strategies as listed in Table4. These strategies range from minimal oversight to near gold standard protection, providing a cost-ordered hi- erarchy from which the kernel can select. The kernel treats governance selection as an optimization problem during runtime. When the PPU proposes an action, the Symbolic Governor selects an appropriate governance level based on the remaining reliability budget and the criti- cality of the instruction. This mechanism ensures that high- stakes actions effectively pay for stronger governance while low-stakes exploratory behaviors are not burdened by un- necessary overhead. 6 Evaluation 6.1 Evaluation Methodology Platform Implementation.We implementArbiter-Kas a high-fidelity prototype comprising 28,914 lines of Python code. The implementation follows a modular microkernel design consisting of a pluggable policy runtime, host-specific tool parsers for the OpenClaw and NanoBot environments, and multi-dialect instruction analyzers for Bash and Power- Shell. To ensure experimental reproducibility, we developed an automated replay harness that facilitates the consistent execution of agent trajectories across varying policy config- urations and underlying models. Workloads and Baselines.We evaluateArbiter-Kon two public agent-security benchmarks and one manually created benign benchmark. For unsafe evaluation, we recon- struct replay cases from successful attack traces in Agent- Dojo and Agent-SafetyBench, yielding 1,914 unsafe cases after manual review: 539 from AgentDojo and 1,375 from Agent-SafetyBench. For benign evaluation, we use 255 safe slices from AgentDojo and 57 manually created safe cases spanning collaboration, calendar, email, messaging, web brows- ing, file handling, reminders, and operational diagnostics. For cross-host evaluation between OpenClaw and NanoBot, we further construct a shared migratable benign subset of 194 cases, comprising 168 AgentDojo cases and 26 manually created cases, by removing from the OpenClaw benign set those cases whose tool calls are unsupported on NanoBot. We report results across five benchmark, model slices cov- ering Claude 3.5 Sonnet, Claude 3.7 Sonnet, Claude Sonnet 4, and GPT-4o. Baselines include native host policies (OpenClaw- only and NanoBot-only), the full Arbiter-K + OpenClaw and Arbiter-K + NanoBot stacks, and host-specific ablations, in- cluding Arbiter-K-on-NanoBot and separate OpenClaw-host ablation runs. Metrics and Replay Protocol.Rather than rerunning each task end-to-end, we adopt a deterministicprior+current replay protocol. For each unsafe case, we replay the original context up to a reviewed dangerous step and record whether the current operation is blocked. For each safe case, we re- play a benign step and record whether it is allowed. We mainly report unsafe interception rate, safe pass rate, and false-positive rate. This operation-level replay protocol re- moves planning drift from the evaluation and makes cross- host comparison reproducible. 6.2 Overall Performance Claude-3-5-sonnetClaude-3-7-sonnetGPT-4oClaude-4-sonnetGPT-4o 0% 20% 40% 60% 80% 100% Rate AgentDojoAgent-SafetyBench OpenClaw Arbiter-K on OpenClaw OpenClaw + Arbiter-K Nanobot Arbiter-K on Nanobot Nanobot + Arbiter-K Figure 7.Performance of Arbiter-K. Figure7shows a consistent pattern across all five bench- mark & model slices. Native host policies intercept only 0% to 9 of unsafe operations, whereas Arbiter-K-based stacks consistently achieve blocking rates between 76% and 95%. Specifically, on the OpenClaw host, the native policy blocks only 6.17% (118/1,914) of violations while the integrated Arbiter- K stack reaches 92.95% (1,779/1,914), representing an abso- lute gain of 86.78 percentage points. Results on NanoBot follow a similar trend where the native policy blocks only 1.41% of unsafe actions. In contrast, Arbiter-K-on-NanoBot and the full stack achieve 93.16% and 94.20% respectively, yielding gains exceeding 91 percentage points. These im- provements originate from the metadata-driven and flow- aware policy stack comprising unary, relational, and taint- aware checks. This architecture successfully intercepts high- risk cross-context actions and explicit side effects often ig- nored by native hosts. Residual failures are concentrated in semantically weak operations includingweb_fetchand Wen et al. Table 5.Interception rate for safe operations (â). Agent System SettingsOpenClaw Arbiter-K on OpenClaw Arbiter-K + OpenClaw Nanobot Arbiter-K on Nanobot Arbiter-K + Nanobot Benckmark AgentDojo3.92%7.45%7.45%0.00%6.00%6.00% Agent-SafetyBench21.05%12.28%28.07%0.00%3.85%3.85% read_file, particularly involving Slack external links in Agent- Dojo and read-heavy trajectories in Agent-SafetyBench, rather than in destructive primitives. Table5summarizes the safety and utility trade-off for Arbiter-K. On the 194 case migratable subset, Arbiter-K-on- NanoBot maintains a 98.97% (192/194) benign pass rate while increasing unsafe interception from 1.41% to 93.16%. On the OpenClaw host, adding Arbiter-K to the native host pol- icy reduces the aggregate benign pass rate from 290/312 (92.95%) to 277/312 (88.78%). A careful manual inspection shows that these additional false positives are not random; rather, they are concentrated in cross-session delegation, cal- endar/UI side effects, and external communication actions. In contrast, read-only browsing, document analysis, file han- dling, reminders, and operational-diagnostic tasks almost al- ways proceed unchanged. This pattern suggests that Arbiter- K does not indiscriminately over-block benign behavior. In- stead, most false positives arise in boundary cases that in- herently involve side effects or information transfer. 6.3 Instruction Coverage Analysis We evaluate whether Arbiter-K can semantically interpret the complete command space exercised by our red-team case library. At the instruction layer, Arbiter-K provides host parsers for both OpenClaw and NanoBot, together with Bash and PowerShell analyzers whose test suites cover read, write, and execution commands, as well as pipelines, control oper- ators, path extraction, and risk composition. To assess prac- tical coverage, we extract every shell-execution instance from the red-team traces and map them through the symbolic an- alyzer. findcdrmcurlgreppsfreesudomkdirpwd Command (by frequency rank) 0 2 4 6 8 10 12 Call count Call count (covered) Cumulative coverage 0% 20% 40% 60% 80% 100% Cumulative % of all exec calls Registry covers 100.0% of calls Figure 8.Instruction coverage of Arbiter-K. Figure8shows that this subset contains 36 command in- stances spanning 13 unique command heads, withfindand cdaccounting for the largest shares, followed by commands such asrm,curl,grep,ps,free,sudo,mkdir, andpwd. Arbiter- K successfully assigns an instruction type and a risk label to all 36 instances, achieving 100% parser coverage on this shell-command subset; correspondingly, the cumulative cov- erage curve reaches 100% of observed shell-execution calls. Together with the mirrored PowerShell parser tests, these results indicate that Arbiter-K covers the common shell prim- itives exercised in our red-team cases. 6.4 Ablation Study on Policy Figure9shows that Arbiter-Kâs security gains primarily come from its semantic policy layers rather than from host-specific rules alone. OpenClawPolicy by itself (O) preserves most be- nign executions but intercepts only 6.2% of unsafe cases, in- dicating that handcrafted host rules are insufficient as the main line of defense. In contrast, RelationalPolicy (R) and UnaryGatePolicy (U) substantially improve unsafe intercep- tion, reaching 86.7% and 93.0%, respectively. This result aligns with Arbiter-Kâs design philosophy: security should be en- forced through architectural semanticsâover actions and in- formation flowsârather than through prompt-level heuris- tics or host-specific patches. The combined settings further reinforce this point. Adding OpenClawPolicy to the seman- tic policies does not improve unsafe interception beyondU alone, but it does reduce the safe pass rate. ORUOROUOUR 0% 20% 40% 60% 80% 100% Interception Rate (%) 6.2% 86.7% 93.0% 92.7% 93.0%93.0% Unsafe Interception Rate ORUOROUOUR 80% 85% 90% 95% 100% Pass Rate (%) 93.0% 95.8% 92.3% 88.8% 89.4% 88.8% Safe Pass Rate Figure 9.Ablation study on policies of Arbiter-K. âOâ, âRâ, and âUâ are short for âOpenClawPolicy onlyâ, âRelation- alPolicy onlyâ, and âUnaryGatePolicy onlyâ, respectively. âORâ and âOUâ are short for âOpenClawPolicy + Relation- alPolicyâ and âOpenClawPolicy + UnaryGatePolicyâ, respec- tively. âOURâ is short for âOpenClawPolicy + UnaryGatePol- icy + RelationalPolicyâ. 6.5 Policy Feedback and Context Reuse Policy checking provides rich feedback that can guide sub- sequent agent runs, while avoiding the context waste in- curred by a full session-block-and-rerun strategy. For each case that Arbiter-K correctly blocks, we identify the first dangerous side-effect step, compute the ratio between the tokens in the preceding context and those in the complete Table 6.Context reuse enabled by textual policy feedback.Reuse / Fulldenotes the ratio between the tokens preceding the blocked step and those in the complete benchmark trajectory;Reuse / Prefixuses the prefix ending at the blocked step.Avg. feedback tokenscounts only the injected assistant feedback turn, excluding the full end-to-end prompt overhead introduced by Arbiter-K. BenchmarkCorrectly blocked Avg. unsafe step Reuse / Full Reuse / Prefix Avg. feedback tokens Agent-SafetyBench (gpt-4o)7431.9673.8%89.1%249.6 AgentDojo (gpt-4o, important instructions)2793.0258.3%90.0%303.4 benchmark trajectory, and measure the length of the injected policy-feedback message. Two observations from Table6are particularly notewor- thy. First, the first dangerous side effect typically arises early in execution: in Agent-SafetyBench, 85.3% of correctly blocked cases occur within the first two tool steps, whereas in Agent- Dojo, 73.8% occur at Steps 2â3. Second, even in these un- safe traces, most of the previously constructed context re- mains reusable: 73.8% of the full trajectory tokens in Agent- SafetyBench and 58.3% in AgentDojo can be preserved, while the added policy-feedback message requires only 249.6 and 303.4 tokens on average, respectively. This effect remains stable on the subset of cases where OpenClaw fails but Arbiter-K succeeds. On Agent-SafetyBench, the reusable-context ratio remains 74.0% of the full trajec- tory, with an average feedback cost of 251.3 tokens; on Agent- Dojo, it remains 59.3%, with 312.5 average feedback tokens. These results support replacing hard rollback with policy feedback, allowing the agent to continue from the existing dialogue state and exploit the feedback signal rather than simply terminating the session. 6.6 End-to-End Blocking Coverage and Block Onset We perform this experiment to answer a question that operation- level interception alone cannot capture:whenandhow con- sistentlydoes the runtime intervene over an entire agent tra- jectory? A policy that occasionally blocks isolated unsafe steps is less useful if it typically reacts only after most of the trajectory has already executed. Since Arbiter-K is de- signed as a governance-first runtime rather than a sink-time filter, we expect it not only to block more unsafe behavior, but also to surface problematic trajectories earlier in execu- tion. To test this property, we compare native OpenClaw policies (openclaw_only) against the full Arbiter-K stack (arbiteros_plus_openclaw) over six end-to-end runs span- ning three models. To make trajectories of different lengths comparable, we normalize each block position by runnable- step progress. Table 7shows two clear results. First, Arbiter-K covers unsafe trajectories far more consistently: it blocks at least one step in 98.33% of runs, whereas the native OpenClaw policy does so in only 23.01%. Second, Arbiter-K intervenes materially earlier: the median first-block position is 50.00% of runnable progress, compared with 80.00% for OpenClaw Table 7.End-to-end block summary on OpenClaw. MetricArbiter-K + OpenClaw OpenClaw only Parent runs539539 Runnable steps3,1983,198 Blocked steps1,196198 Step block rate37.40%6.19% Trajectory block rate98.33%23.01% Mean first-block progress53.38%69.18% Median first-block progress50.00%80.00% No-block trajectories9415 Table 8.Distribution of first block onset along the normal- ized trajectory. BucketArbiter-K + OpenClaw OpenClaw only First block in 0â25%44 / 539 (8.16%)2 / 539 (0.37%) First block in 0â50%285 / 539 (52.88%)33 / 539 (6.12%) First block in 0â75%488 / 539 (90.54%)59 / 539 (10.95%) First block in 75â100%42 / 539 (7.79%)65 / 539 (12.06%) No block9 / 539 (1.67%)415 / 539 (77.00%) alone. This gap is important because it shows that Arbiter- K is not merely adding more late-stage denials; rather, it changes the point at which unsafe trajectories become gov- ernable. In other words, Arbiter-K shifts blocking from sparse, late host-level reactions to earlier semantic intervention within the trajectory itself. As shown in Table 8, Arbiter-K produces a first block within the first half of execution in 52.88% of runs, while OpenClaw does so in only 6.12%; conversely, OpenClaw leaves 77.00% of trajectories entirely unblocked, compared with just 1.67% under Arbiter-K. This pattern is consistent with the architec- tural distinction between the two systems. Native host poli- cies react to explicit, host-visible violations, which tend to appear late and only in a subset of traces. Arbiter-K, by con- trast, governs intermediate actions and information flows through semantic policies, allowing it to detect unsafe tra- jectories before they mature into final side effects. 7 Related Work Vulnerability Characterization.The safety landscape for autonomous agents extends beyond conventional PPUs by incorporating direct interaction with filesystems, network interfaces, and external tools. Risks including indirect injec- tion and privilege abuse are formalized in specialized bench- marks such as AgentDojo, ASB, OS-Harm, and RiOSWorld [ 4, Wen et al. 8,11,23]. These environments demonstrate that system vul- nerabilities often emerge from long-horizon interaction traces rather than isolated model outputs, which necessitates a shift from stateless filtering to stateful, context-aware governance. Guardrail-Centric DefensesDefensive frameworks in- cluding ClawGuard, IronClaw, and ClawKeeper employ ex- ternal guardrails such as skill scanning, WASM sandbox- ing, and permission whitelisting to improve agent robust- ness [7,13,25]. While effective against specific attack vec- tors, these systems remain primarily reactive because they operate as post-hoc filters around an LLM-centered orches- tration loop. Such approaches do not address the architec- tural coupling between probabilistic reasoning and deter- ministic system effects. Arbiter-K establishes governance as an intrinsic microarchitectural property by implementing a Semantic ISA and instruction-level dependency tracking to provide fine-grained, provenance-aware control. 8 Conclusion In this paper, we presentedArbiter-K, a governance-first execution architecture that places a deterministic symbolic kernel between probabilistic reasoning and environment- im- pacting execution. By introducing a Semantic ISA, Arbiter- K converts opaque model outputs into explicit semantic in- structions, enabling instruction-level privilege enforcement, taint-aware dependency tracking, and policy checking over both actions and information flows. Our implementation on OpenClaw and NanoBot shows that this approach is both practical and effective. References [1]Amazon. 2025.Amazon Bedrock AgentCore Policy: Control Agent-to-Tool Interactions. https://docs.aws.amazon.com/bedrock- agentcore/latest/devguide/policy.html. [2]Anthropic. 2025. Equipping agents for the real world with Agent Skills. https://w.anthropic.com/engineering/equipping-agents- for-the-real-world- with-agent-skills. [3]Xiaohe Bo, Zeyu Zhang, Quanyu Dai, Xueyang Feng, Lei Wang, Rui Li, Xu Chen, and Ji-Rong Wen. 2024. Reflective Multi-Agent Collabo- ration based on Large Language Models. InProceedings of NeurIPS. [4]Edoardo Debenedetti, Jie Zhang, Mislav Balunoviâc, Luca Beurer- Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents.ArXivabs/2406.13352 (2024).https://api.semanticscholar. org/CorpusID:270619628 [5]Hassen Dhrif. 2025. Reasoning-Aware Prompt Orchestration: A Foun- dation Model for Multi-Agent Language Model Coordination. ArXiv abs/2510.00326 (2025). [6]InvariantLabs.2025.InvariantGuardrails. https://github.com/invariantlabs-ai/invariant. [7]IronClaw Contributors. 2026. IronClaw: Your secure personal AI as- sistant, always on your side. https://github.com/nearai/ironclaw [8]Yang JingYi, Shuai Shao, Dongrui Liu, and Jing Shao. 2025. RiOS- World: Benchmarking the Risk of Multimodal Computer-Use Agents. InNeurIPS. [9]Edward Junprung. 2023. Exploring the Intersection of Large Lan- guage Models and Agent-Based Modeling via Prompt Engineering. ArXivabs/2308.07411 (2023). [10]Rafflesia Khan, Declan Joyce, and Mansura Habiba. 2025. AGENTSAFE: A Unified Framework for Ethical Assurance and Governance in Agentic AI.arXivabs/2512.03180 (2025). [11]Thomas Kuntz, Agatha Duzan, Hao Zhao, Francesco Croce, J Zico Kolter, Nicolas Flammarion, and Maksym Andriushchenko. 2025. OS- Harm: A Benchmark for Measuring Safety of Computer Use Agents. InNeurIPS. [12]Puzhuo Liu, Chengnian Sun, Yaowen Zheng, Xuan Feng, Chuan Qin, Yuncheng Wang, Zhi Li, and Limin Sun. 2023. Harnessing the Power of LLM to Support Binary Taint Analysis.ArXivabs/2310.08275 (2023). [13]Songyang Liu, Chaozhuo Li, Chenxu Wang, Jinyu Hou, Zejian Chen, Litian Zhang, Zheng Liu, Qiwei Ye, Yiming Hei, Xi Zhang, and Zhongyuan Wang. 2026. ClawKeeper: Comprehensive Safety Pro- tection for OpenClaw Agents Through Skills, Plugins, and Watchers. ArXivabs/2603.24414 (2026). [14]Lingrui Mei, Jiayu Yao, Yuyao Ge, Yiwei Wang, Baolong Bi, Yujun Cai, Jiazhi Liu, Mingyu Li, Zhong-Zhi Li, Duzhen Zhang, Chenlin Zhou, Jiayi Mao, Tianze Xia, Jiafeng Guo, and Shenghua Liu. 2025. A Survey of Context Engineering for Large Language Models.ArXiv abs/2507.13334 (2025). [15]NanoBot Contributors. 2026. NanoBot: Ultra-Lightweight Personal AI Agent.https://github.com/HKUDS/nanobot [16]OpenClaw Contributors. 2026. OpenClaw: Open-Source AI Agent Runtime.https://github.com/openclaw/openclaw [17]Pranab Sahoo, Ayush Kumar Singh, Sriparna Saha, Vinija Jain, Sam- rat Sohel Mondal, and Aman Chadha. 2024. A Systematic Survey of Prompt Engineering in Large Language Models: Techniques and Ap- plications.ArXivabs/2402.07927 (2024). [18]Sander Schulhoff, Michael Ilie, Nishant Balepur, Konstantine Ka- hadze, Amanda Liu, Chenglei Si, Yinheng Li, Aayush Gupta, Hyo- Jung Han, Sevien Schulhoff, Pranav Sandeep Dulepet, Saurav Vidyad- hara, Dayeon Ki, Sweta Agrawal, Chau Minh Pham, Gerson C. Kroiz, Feileen Li, Hudson Tao, Ashay Srivastava, Hevander Da Costa, Sa- loni Gupta, Megan L. Rogers, Inna Goncearenco, Giuseppe Sarli, Igor Galynker, Denis Peskoff, Marine Carpuat, Jules White, Shyamal Anadkat, Alexander Miserlis Hoyle, and Philip Resnik. 2024. The Prompt Report: A Systematic Survey of Prompting Techniques.ArXiv abs/2406.06608 (2024). [19]Ava Spataru, Eric Hambro, Elena Voita, and Nicola Cancedda. 2024. Know When To Stop: A Study of Semantic Drift in Text Generation. InProceedings of NAACL. 3656â3671. [20]Charles L. Wang, Trisha Singhal, Ameya Kelkar, and Jason Tuo. 2025. MI9: An Integrated Runtime Governance Framework for Agentic AI. ArXivabs/2508.03858 (2025). [21]Shuyue Wang, Runxin Xu, Zirui Zhu, Zekun Wu, Chen Zhang, Weize Liu, Zheyuan Liu, Yushi Qin, Yiran Yang, Yuan Zhang, et al. 2024. TheAgentCompany: Benchmarking LLM Agents on Consequential Real World Tasks.ArXivabs/2405.06451 (2024). [22]Bin Xu. 2026. AI Agent Systems: Architectures, Applications, and Evaluation.ArXivabs/2601.01743 (2026). [23]Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. 2025. Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents. InICLR. [24]Zhexin Zhang, Shiyao Cui, Yida Lu, Jingzhuo Zhou, Junxiao Yang, Hongning Wang, and Minlie Huang. 2024. Agent-SafetyBench: Eval- uating the Safety of LLM Agents.ArXivabs/2412.14470 (2024).https: //api.semanticscholar.org/CorpusID:274859514 [25]Wei Zhao, Zhe Li, Peixin Zhang, and Jun Sun. 2026. ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection.ArXivabs/2604.11790v1 (2026).