[Paper Review] Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent Systems

Amjad Fatmi|arXiv (Cornell University)|Jan 25, 2026

Scientific Computing and Data Management0 citations

TL;DR

This paper introduces the Action Authorization Boundary (AAB), a mandatory execution-time enforcement layer that sits between agent reasoning and real-world execution to guarantee non-bypassable, deterministic, and replayable action authorization. It also defines Canonical Action Representation (CAR) and related architecture to securely govern autonomous actions.

ABSTRACT

Autonomous agent systems increasingly trigger real-world side effects: deploying infrastructure, modifying databases, moving money, and executing workflows. Yet most agent stacks provide no mandatory execution checkpoint where organizations can deterministically permit, deny, or defer an action before it changes reality. This paper introduces Faramesh, a protocol-agnostic execution control plane that enforces execution-time authorization for agent-driven actions via a non-bypassable Action Authorization Boundary (AAB). Faramesh canonicalizes agent intent into a Canonical Action Representation (CAR), evaluates actions deterministically against policy and state, and issues a decision artifact (PERMIT/DEFER/DENY) that executors must validate prior to execution. The system is designed to be framework- and model-agnostic, supports multi-agent and multi-tenant deployments, and remains independent of transport protocols (e.g., MCP). Faramesh further provides decision-centric, append-only provenance logging keyed by canonical action hashes, enabling auditability, verification, and deterministic replay without re-running agent reasoning. We show how these primitives yield enforceable, predictable governance for autonomous execution while avoiding hidden coupling to orchestration layers or observability-only approaches.

Motivation & Objective

• Argue that execution-time authorization is an architectural primitive missing from existing agent stacks.
• Propose the Action Authorization Boundary (AAB) as a non-bypassable enforcement layer at the execution boundary.
• Define Canonical Action Representation (CAR) to normalize proposals for deterministic authorization.
• Ensure fail-closed semantics and provide provenance-complete, immutable decision records.
• Show architecture variants for single-agent, multi-agent, and multi-tenant deployments with consistent authorization semantics.

Proposed method

• Introduce the AAB as a deterministic function B(A, P, S) -> {PERMIT, DEFER, DENY} between reasoning and execution.
• Define Canonical Action Representation (CAR) to normalize semantically equivalent actions across frameworks.
• Institute deterministic authorization semantics that yield identical outcomes for identical inputs.
• Enforce fail-closed behavior so failures lead to DENY or DEFER, not silent execution.
• Provide provenance-complete decision records bound to (A, P, S) for replay and auditability.
• Present reference architectures for single-agent, multi-agent, and multi-tenant deployments.

Experimental results

Research questions

• RQ1 Can execution-time authorization be made non-bypassable and deterministic across heterogeneous agent frameworks?
• RQ2 Does a canonical action representation enable consistent authorization across protocols and surfaces?
• RQ3 Can an architectural boundary guarantee fail-closed behavior and replayable decision records for autonomous actions?
• RQ4 What are the validation and auditability guarantees when enforcing AAB across different deployment models?

Key findings

• End-to-end decision latency is in single-digit milliseconds in the baseline micro-benchmark (T_canon, T_eval, T_record combine to ~2.24 ms p50 / 9.61 ms p95).
• Sustained throughput reaches 7,800 actions per minute on a single worker.
• Executor coverage against bypass attempts remains near 1.0 (0.9993 observed in normal operation).
• Bypass attempts with artifact-bound enforcement fail across multiple attack vectors (evidence-blocked in all tested cases).
• Exact-once execution and atomic ledger transitions ensure consistency across concurrent identical requests (no double-executions observed in 1,000,000 attempts).
• Deferred approval paths preserve consistent final artifacts across multiple waiters (p50=2.1 ms, p95=8.4 ms).