---
type: "post"
slug: "policy-algebra-for-trust-preserving-agent-execution"
title: "Policy Algebra for trust-preserving agent execution"
description: "A preprint argues capability is not reliability: an agent is reliably capable only when every action stayed admissible under identity, data, budget, approval and audit constraints."
retrieval_nugget: "A preprint argues capability is not reliability: an agent is reliably capable only when every action stayed admissible under identity, data, budget, approval and audit constraints."
published_at: "2026-09-01"
updated_at: "2026-09-12"
record_date: "2026-08-25"
date_kind: "discovered_at"
topics: ["agent-security","agents","ai"]
entities: ["arXiv"]
source_url: "https://arxiv.org/abs/2608.16402"
source_title: "A Policy Algebra for Trust-Preserving Agentic AI Execution"
source_domain: "arxiv.org"
source_terms: ["Policy","Algebra","trust-preserving","execution","capability"]
summary_word_count: 193
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:policy-algebra-for-trust-preserving-agent-execution"
status: "published"
source_urls: ["https://arxiv.org/abs/2608.16402"]
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:5809c6b33d5f7824c09e0960b26ac523d2c163d62c3b5f07145d5c8c5e70061d","reviewed_at":"2026-09-12T10:00:00Z","source_evidence_count":1,"verified_claim_count":2,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":2,"implication_count":1,"watch_condition_count":1,"related_record_count":3}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"A preprint published on 17 August makes a precise argument that most agent frameworks skip: they optimise capability — whether an agent can reason, retrieve, call tools, delegate and finish a goal — while enterprise execution needs a stronger property.","observed_facts":[{"text":"The paper defines reliable capability as a path property over action events rather than as a successful outcome.","source_urls":["https://arxiv.org/abs/2608.16402"]},{"text":"It proposes a policy algebra in which security profiles and runtime obligations compose through joins, intersections, budget narrowing and approval inheritance.","source_urls":["https://arxiv.org/abs/2608.16402"]}],"mechanism":"an agent is reliably capable only when it completes a task through action events that remain admissible under identity, profile, tool, data, memory, budget, artifact, approval and audit constraints","why_now":"A successful result is not reliable if it was produced through unauthorized data access, widened delegated authority, unapproved side effects, unrecoverable budget consumption, or incomplete evidence.","implications":["Composition is the useful part: it means two safe policies can be combined without hand-auditing the result."],"evidence_boundary":"This is a preprint abstract describing a formalism; no implementation, benchmark or deployment evidence is cited here.","watch_conditions":["The condition to watch is whether the algebra arrives as a checkable runtime artifact, because a policy calculus that cannot be evaluated against a real action log stays a vocabulary rather than a control."],"related_records":[{"url":"https://newruntime.com/posts/agent-security-moves-outside-the-model","relation":"Prior coverage of controls moving outside the model."},{"url":"https://newruntime.com/posts/minimum-integrity-stack-agent-leaderboard","relation":"Prior coverage of integrity requirements for agent claims."},{"url":"https://newruntime.com/topics/agent-security","relation":"Topic hub for agent authorization constraints."}]}
routes: {"html":"https://newruntime.com/posts/policy-algebra-for-trust-preserving-agent-execution/","markdown":"https://newruntime.com/posts/policy-algebra-for-trust-preserving-agent-execution.md","json":"https://newruntime.com/posts/policy-algebra-for-trust-preserving-agent-execution.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Policy Algebra for trust-preserving agent execution

## Retrieval answer

A preprint argues capability is not reliability: an agent is reliably capable only when every action stayed admissible under identity, data, budget, approval and audit constraints.

A preprint published on 17 August makes a precise argument that most agent frameworks skip: they optimise capability — whether an agent can reason, retrieve, call tools, delegate and finish a goal — while enterprise execution needs a stronger property. A successful result is not reliable if it was produced through unauthorized data access, widened delegated authority, unapproved side effects, unrecoverable budget consumption, or incomplete evidence.

The paper's move is to define reliable capability as a path property rather than an outcome: an agent is reliably capable only when it completes a task through action events that remain admissible under identity, profile, tool, data, memory, budget, artifact, approval and audit constraints. It then proposes a policy algebra defining the reliability envelope inside which capability may be exercised, with security profiles and runtime obligations composing through joins, intersections, budget narrowing and approval inheritance. Composition is the useful part: it means two safe policies can be combined without hand-auditing the result.

Treating the path rather than the answer as the object of review is the same correction behind [agent security moving outside the model](https://newruntime.com/posts/agent-security-moves-outside-the-model/) and behind [the minimum integrity stack for an agent leaderboard](https://newruntime.com/posts/minimum-integrity-stack-agent-leaderboard/). The [agent security hub](https://newruntime.com/topics/agent-security/) collects the constraint side of that work.

This is a preprint abstract describing a formalism; no implementation, benchmark or deployment evidence is cited here. The condition to watch is whether the algebra arrives as a checkable runtime artifact, because a policy calculus that cannot be evaluated against a real action log stays a vocabulary rather than a control.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Agents](https://newruntime.com/topics/agents.md): Explore the agents topic hub.
- topic hub: [Ai](https://newruntime.com/topics/ai.md): Explore the ai topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)