A preprint published on 17 August makes a precise argument that most agent frameworks skip: they optimise capability — whether an agent can reason, retrieve, call tools, delegate and finish a goal — while enterprise execution needs a stronger property. A successful result is not reliable if it was produced through unauthorized data access, widened delegated authority, unapproved side effects, unrecoverable budget consumption, or incomplete evidence.
The paper's move is to define reliable capability as a path property rather than an outcome: an agent is reliably capable only when it completes a task through action events that remain admissible under identity, profile, tool, data, memory, budget, artifact, approval and audit constraints. It then proposes a policy algebra defining the reliability envelope inside which capability may be exercised, with security profiles and runtime obligations composing through joins, intersections, budget narrowing and approval inheritance. Composition is the useful part: it means two safe policies can be combined without hand-auditing the result.
Treating the path rather than the answer as the object of review is the same correction behind agent security moving outside the model and behind the minimum integrity stack for an agent leaderboard. The agent security hub collects the constraint side of that work.
This is a preprint abstract describing a formalism; no implementation, benchmark or deployment evidence is cited here. The condition to watch is whether the algebra arrives as a checkable runtime artifact, because a policy calculus that cannot be evaluated against a real action log stays a vocabulary rather than a control.