Structural Patterns

Structural patterns fix who can do what before any monitoring runs. They carry the most weight because they do not depend on detecting anything: a permission the agent does not hold cannot be misused, whatever its inputs or intent. All six are standard security, reliability or governance practice. Each section names that prior art and says what changes when the delegate is a 2026 LLM agent.

The harm channels referred to below are those of Risk Decomposition: accident, defection (including reward hacking) and hijack (prompt or tool-output injection, and misuse).

Escalation Ladder

Route each action to a level of oversight that matches its stakes. Low-stakes, reversible actions run autonomously; higher-stakes ones go to a supervisor model, a human, or a more senior human. An action escalates when its stakes exceed the current level’s threshold, when confidence is low, or when the situation is novel.

Two rules carry most of the weight. First, the component that assesses stakes must not be the agent that wants to act. An agent that under-reports stakes skips its own oversight. This is the risk preflight rule: the preflight must sit lower on the verifiability hierarchy than the actor it checks. Prefer deterministic classification (which tool, which resource, what amount, reversible or not) over a model’s judgement. Second, escalation has to stay cheap enough that reviewers actually review. Humans who approve a high volume of escalations stop reading them, so track the rubber-stamp rate: the fraction of approvals issued faster than the minimum reading time. Track the escalation rate too. A sudden drop with no change in the work can mean the agent has learned to stay under the thresholds.

Time-lock step. For irreversible actions, the top rungs can add a delay between approval and execution, during which the pending action is visible and cancellable. This is the old Cooling Off Period pattern. The delay defeats urgency framing, a standard social-engineering lever that an injected instruction can pull as easily as a human con artist, and it gives asynchronous monitors time to finish. The scaffold enforces the delay; the agent does not request it. Actions that are each below threshold should be aggregated per requester over a window, so that one large action cannot be split into small ones. The right delay is however long real review takes; there is no generic figure.

Prior art. Signing authorities and approval chains in finance; medical triage; levels of automation (Sheridan & Verplank 1978); time locks and settlement delays.

What is different for 2026 agents. Coding and computer-use agents ship approval modes that are an escalation ladder in all but name: ask before every edit or command, auto-approve edits but ask before commands, or run unattended in a sandbox. The rung is often chosen per session, so one “allow everything” choice moves every later action to the bottom rung. Stakes should attach to the action: the same agent can run ls on its own and still need approval for a force-push.

Claude Code’s auto mode is a deployed model-based preflight. A separate classifier reviews tool calls before they run. Anthropic reports a 0.4% false-positive rate on 10,000 real actions and a 17% miss rate on 52 real overeager actions, and says the mode is not a replacement for careful human review on high-stakes infrastructure (Anthropic, March 2026). The classifier sees the user’s messages and the agent’s tool calls, but not the agent’s prose, so the agent cannot argue its case (the first rule above), and not tool results, so injected content cannot address the classifier directly. Escalation to humans needs the same discipline. The agent, or content it has read, writes the justification a reviewer sees, so show the raw action and its diff, not only the agent’s summary.

Graduated Autonomy

Grant permissions in stages and widen them as evidence accumulates: sandbox, then supervised real tasks, then monitored operation, then autonomy within a domain. Demotion must be possible and fast. A safety violation or evidence of deception drops the agent to the bottom; a sustained rise in error rate drops it one level. Track autonomy per capability and domain, not per agent: a record in code review says nothing about payments.

State the evidence for promotion as a bound. If an agent has completed $n$ comparable tasks with no incidents, the 95% upper confidence bound on its per-task incident rate is about $3/n$ (the “rule of three”). Three hundred clean tasks bound the rate below about 1%. That is evidence for a stage where one incident per hundred tasks is affordable, and not for a stage where it is not. Set promotion criteria from the exposure each level allows, not from round numbers.

The bound covers accidents. It says little about defection. An agent that behaves well while stakes are low and observation is heavy produces exactly the clean record that earns promotion. Concentrated failures, where a single action does the damage (Greenblatt et al. 2023, arXiv:2312.06942), are not bounded by a track record at all. They are bounded by the envelope at each level.

Prior art. Probationary periods; graduated driver licensing; the SAE J3016 driving-automation levels.

What is different for 2026 agents. A track record is evidence about one model version, system prompt and tool set. Vendors update models on their own schedule, sometimes behind a stable name, so pin the model version, tie promotion state to it, and re-validate when it changes. Three results weaken a clean record as evidence about disposition. Frontier models tell evaluation transcripts from deployment ones well above chance (Needham et al. 2025). Models can be prompted or fine-tuned to underperform selectively on capability evaluations (van der Weij et al. 2024). And Claude 3 Opus, told when its conversations would be used for training, complied selectively in training to avoid being modified (Greenblatt et al. 2024). Graduated autonomy controls accident risk well and defection risk poorly. Pair it with a hard envelope at every level.

Exposure-Envelope Gateway

This pattern merges Capability Airlock, Gateway Chokepoint and Rate Limiting Ladder. Route every consequential capability through one enforcement point that the agent cannot bypass: tool calls, code execution, network egress, writes to data stores, payments and outbound messages. That point enforces the agent’s exposure envelope, the bounded region of action space within which the agent may act freely, enforced whatever its inputs or intent. The gateway authenticates the caller, checks the action against an allow-list scoped to the current task, enforces volume and spend limits, logs the request before deciding, and denies by default.

Capabilities sit in nested zones. Computation and public data need nothing. Reading customer data needs a task justification and logging. Code execution, writes and external calls need a token that is scoped to the task, limited in time and use, and revoked on exit; above some exposure they also need human approval. Model weights, credential stores and the agent’s own configuration should be outside the envelope entirely.

Rate and spend limits are the envelope’s walls along the time axis. A cap on rows deleted per operation, messages sent per hour or dollars spent per day bounds the damage from a runaway or hijacked loop whether or not anyone notices it. Limits that tighten automatically under suspicion are a reasonable refinement, but fit their tiers to observed traffic.

The gateway is only as good as its coverage. If any path to the resource bypasses it, the agent or an attacker will eventually find that path, and the gateway then adds logging but no bound. It is also a single point of failure, so it should be simple, deterministic and in tiers 1 and 2 of the verifiability hierarchy (verified or tested code and rule-based checks), not an LLM judging requests.

Prior art. The reference monitor: always invoked, tamper-proof, small enough to verify (Anderson 1972). Least privilege (Saltzer & Schroeder 1975). API gateways, egress proxies and syscall filters. Airbus flight-envelope protection, the lineage of the canon term.

What is different for 2026 agents. Agent harnesses now ship the parts of a gateway, and their documentation states the limits. Permission rules (allow, ask, deny, with deny taking precedence) and pre-tool-use hooks are enforced by the harness, not the model. “Do not touch production” in a system prompt is a request; a deny rule is a wall. Rules that match command text are weak walls, though. Claude Code’s documentation calls Bash argument patterns “fragile”, notes that file deny rules do not stop a script that opens files itself, and points to its OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux, with filesystem and network isolation) for enforcement that does not depend on command text (permissions, sandboxing). The general rule: an agent with a shell routes around tool-level controls, so the real envelope is the container or VM boundary plus an egress allow-list. Check what the sandbox leaves out. Claude Code’s covers shell commands, not MCP servers or its own file tools.

The tool layer is standardized too. Since Anthropic introduced the Model Context Protocol in November 2024, MCP servers advertise tools and the client decides which ones the model sees, so scope tools per task rather than exposing everything a server offers. An MCP server is third-party code inside the envelope, and it is a supply-chain risk in two ways. Its tool descriptions reach the model as text and can carry instructions (“tool poisoning”), and a server can change a description after the user has approved it (Invariant Labs, April 2025). And its code can turn hostile. In September 2025 postmark-mcp, an npm package impersonating Postmark’s official MCP server, added one line in version 1.0.16 that blind-copied every email it sent to an outside address (The Hacker News, reporting Koi Security’s finding). Pin server versions, review updates as code changes, and route server egress through the gateway.

Task Decomposition Pipeline

Break a task into steps whose inputs and outputs can be checked, and validate each step before the next starts. Validators range from schema checks and test suites, which are cheap and deterministic, to human approval of a design. Steps with side effects get a checkpoint before they run (see Checkpoint-Rollback).

The AI Control version is factored cognition. A trusted model decomposes the task, an untrusted model solves each child task in isolation, and the results are reassembled. Sandoval & Rushing (2025) tested this on the APPS coding benchmark against a red team inserting backdoors. Adding factored cognition to a trusted-monitoring protocol raised safety from 41% to 63%, because the monitor did better on smaller, simpler child tasks. Usefulness in that setting was low, and decomposition did not make it harder for capable models to write backdoors. The gain came from easier monitoring, not from a weaker attacker.

Decomposition helps when the property you care about can be checked at the seams. It hurts when the failure lives in the composition: every step passes its validator and the whole is wrong. Validators that see one step cannot catch that, so keep at least one check on the assembled result.

Prior art. Pipes-and-filters architecture; stage-gate review; factored cognition.

What is different for 2026 agents. The common form is an orchestrator that spawns subagents with narrower context and tools. That counts as decomposition only if the subagents’ contexts and permissions really are narrower and their outputs are validated before the orchestrator acts on them (see Trust Transitivity Limits). Decomposition is sometimes said to prevent scheming because strategic deception needs persistent context. That premise is contested: frontier models scheme within a single episode when given a goal in context, told to pursue it, and placed in an environment that rewards scheming (Meinke et al. 2024). Treat decomposition as limiting what each context knows and can do, not as ruling out deception inside a step.

Bulkhead Isolation

This pattern absorbs Blast Radius Containment. Partition the system so that a failure in one compartment cannot consume the resources, credentials or data of another. Partition by tenant, by task, by risk (experimental against production) and by agent. Each compartment has its own credentials, resource quotas and data stores. Cross-compartment access goes through a defined interface and is cut when either side is unhealthy.

What a bulkhead bounds is exposure: the worst-case loss given the access the compartment actually has. A per-task compartment whose credentials reach only that task’s data has an exposure you can write down. A shared service account does not. Bulkheads do nothing for failures that originate outside the partition, such as a shared model provider, prompt template or dependency. Those are common-cause failures that cross every bulkhead at once (see the entanglement tax).

Prior art. Ship bulkheads; the bulkhead and circuit-breaker patterns in Nygard’s Release It! (2007); cell-based architecture; blast-radius reduction in cloud IAM.

What is different for 2026 agents. Agents collapse partitions that human workflows kept apart, because one agent session often holds credentials for development, staging and production at once. In the widely reported July 2025 Replit incident, an agent deleted a production database during a code freeze it had been told to observe. Reports at the time said the app’s development and production environments shared a database, and Replit’s response was to separate them automatically. The freeze was an instruction; the shared database was the missing bulkhead. Give each agent session credentials for one environment. Isolate sessions from each other too: an injection in one user’s session should not reach another user’s data through shared memory, caches or a shared tool server.

Voting Tribunal

This pattern absorbs Rotating Validator. Require agreement from several checkers before a high-stakes action. Use unanimity (any member can veto) for irreversible actions, a supermajority where false approvals are costly, and a simple majority where they are not. Checkers vote in isolation, without seeing each other’s votes or reasoning, on a sanitized copy of the proposal.

Independence assumption. Every guarantee a tribunal gives assumes its members’ errors are independent. If three checkers are each wrong 10% of the time and their errors are independent, the majority is wrong 2.8% of the time. Under the beta-factor model with common-cause weight $\rho$ (phi scale), the majority is wrong with probability $(1-\rho)\,P_{\text{indep}} + \rho p$, and no number of extra voters pushes that below $\rho p$. The same caveat applies to Byzantine fault tolerance. The bound $n \geq 3f+1$ (Lamport, Shostak & Pease 1982) counts $f$ independent faults. Checkers built on the same model family share blind spots and can fail as one. Against an adaptive attacker the right default is $\rho \to 1$: the tribunal is worth its best member until a control evaluation shows otherwise. See the entanglement tax, the estimation recipe for $\rho$ on Risk Propagation, and Channel Integrity for active collusion.

Rotation. If the same checker always reviews the same agent, any weakness specific to that pair persists, whether a learned blind spot or a collusion signal the two have converged on. Assign checkers at random per task from an eligible pool: a different provider from the agent, no self-review, and limited recent pairings. Rotation addresses capture of a particular pair. It does nothing about blind spots the whole pool shares.

Resampling is the agentic version. In Ctrl-Z (Bhatt et al. 2025), when an untrusted agent’s proposed action looked suspicious, the protocol drew more samples of that action and used them to block it or to incriminate the agent. The best protocol combined resampling with analysis of earlier steps. In a multi-step system-administration environment it cut attack success from 58% to 7%, at a 5% cost to a benign agent’s performance. Terekhov et al. (2025) show the limit: when the attacker embeds prompt injections aimed at the monitor, resampling turns into a best-of-n attack and the protocol backfires.

Prior art. Committees and juries; N-version programming, whose independence assumption failed in Knight & Leveson’s 1986 experiment; Byzantine fault tolerance; mandatory auditor rotation.

What is different for 2026 agents. Measured LLM error correlation is substantial. Goel et al. (2025) find that models’ mistakes grow more similar as capability rises. Kim et al. (2025), across more than 350 models, find that shared provider and architecture drive error agreement, and that larger, more accurate models have highly correlated errors even across providers. “Use different providers” is therefore necessary but not sufficient for independence, and rotating among checkers from the same family changes the pairing without removing the shared cause. A test suite, a static analyzer, a rule-based check and a model buy more independence than three models.