Source note
SARC: A Governance-by-Architecture Framework for Agentic AI Systems
Summary
SARC turns regulatory and operational obligations for tool-using agents into runtime checks placed inside the agent loop. The paper’s main claim is architectural: constraints should block, monitor, audit, or escalate actions while the system runs.
Problem
- Tool-using agents can call APIs, sub-agents, and external services before prompt rules, dashboards, or post-hoc audits catch violations; in regulated deployments, that timing can allow an inadmissible action to execute.
- Regulatory duties such as human oversight, traceability, and post-market monitoring need executable checks because documentation alone cannot stop a bad tool call.
- Finite reward penalties cannot always replace hard constraints: the paper gives a two-state example where any finite penalty still lets a high-reward risky action remain optimal when violation probability is small enough.
Approach
- SARC specifies an agent as
<S,A,R,C>: state, action space, reward or objective, and constraints. - Each constraint records
src,class,pred,verif,resp, and an operating point. Classes are hard constraints, soft constraints, and escalation constraints. - The specification compiles checks into four runtime sites: Pre-Action Gate, Action-Time Monitor, Post-Action Auditor, and Escalation Router.
- A prototype checker tests finite SARC specifications and traces for specification-trace correspondence: which constraints applied, where they were evaluated, what result they produced, and what response followed.
- The multi-agent extension propagates constraints across agents, intersects delegated authority, and keeps attribution-preserving trace trees for cross-agent workflows.
Results
- In a synthetic procurement task over 50 seeds, SARC produced zero hard-constraint violations under exact predicates.
- The Post-Action Auditor throttling response reduced soft-window overages by 89.5% relative to the policy-as-code-only baseline.
- The evaluation compares SARC with 4 baselines: post-hoc audit, output filtering, workflow rules, and policy-as-code-only.
- The paper reports 95% confidence intervals for the synthetic evaluation, but the excerpt does not provide the interval values.
- Predicate-noise and enforcement-failure sweeps support the claim that residual hard violations under SARC scale with enforcement-stack error rather than environmental violation opportunity.
- The authors limit the result to controlled synthetic procurement runs and do not claim deployment-grade procurement performance.