The Missing Primitive: The Execution Contract
Agent identity, runtime policy, sandboxes, and independent enforcement are rapidly becoming real infrastructure. The next challenge is binding them to the exact state transition an agent is allowed to perform.
Published in bi-weekly technical intelligence dispatches on LinkedIn covering autonomous control planes, sovereign execution, and distributed agent safety.
Calling an API endpoint is not permission to alter state. Argument syntax does not equal downstream safety.
As detailed in our analysis of runtime boundaries, stochastic model guardrails fail under pressure. Enforcement must live out-of-band.
Verifiable identity answers who the agent is. Authority belongs strictly to the state transition via an execution contract in KedgeFlow.
A foundational premise of agentic systems architecture is that tool authorization is not mutation authorization. Furthermore, as established in our foundational analysis The Control Plane Must Be Outside the Agent, the control plane must be topologically decoupled from the agent.
Over the past two weeks, the architecture has moved again. The most interesting developments across hyperscalers and enterprise security vendors are no longer just about putting a containment boundary around the agent. They are beginning to answer the hard operational questions that govern autonomous execution:
- Who is the agent?
- Who authorized it?
- Which tool can it invoke, and with what arguments?
- Where should policy execute?
- How should containment be enforced?
- What evidence should survive afterward?
These are critical pieces. But their assembly exposes a missing primitive. What binds identity, delegation, intent, current state, policy, execution, and evidence into one authority-bearing object?
I increasingly think the answer is an execution contract.
Not a standing role attached to an agent. Not a blanket permission to use a tool. Not a session-wide token. It is a mutation-specific contract describing exactly what this actor is allowed to change, under specific conditions, at a precise point in time, with expected consequences.
Figure 1: Architectural composition of the Execution Contract within a programmable agentic control plane (KedgeFlow). Structured inputs flow into the Control Plane, which parameterizes bounded execution environments under an independent enforcement plane while streaming cryptographic attestations into the evidence plane.
Principal, Agent Workload Identity, Delegation Chain, Proposed Intent, and Current Authoritative State.
Admitting policy, binding allowed effects, pre-state version, validity window, and invariants via KedgeFlow.
Ephemeral MicroVMs or isolated containers (AWS, Azure, GCP, K8s) executing only the admitted mutation.
Out-of-band monitoring: Observe, Attest, Enforce (quarantine/block), and Audit tamper-evident records.
Admission record, execution record, state evidence diff, and mathematical invariant verification.
Six industry signals pointing toward the execution contract
Over the past fourteen days, major technology vendors and standards bodies published concrete architectural implementations that collectively assemble the agent control plane.
DigiCert brings cryptographic identity to the execution boundary
On September 29, DigiCert announced support for NVIDIA's Open Agent Safety Platform. This integration combines NVIDIA OpenShell's externally enforced runtime boundary with DigiCert AI Trust Manager's model of cryptographically verifiable agent identity and authority.
DigiCert gives agents an “AI Passport”—a portable, cryptographically signed credential connecting the agent to an accountable owner. Policy-based “visas” then describe which systems, data, and actions that agent may access, and for how long.
This is a significant architectural step forward: we are moving beyond the traditional bearer-token model where simple possession of a token effectively becomes execution authority. In Post-Deterministic Distributed Systems (PDDS), this corresponds to establishing the epistemic root of identity before admission. However, an important systems distinction remains. A passport and visa can establish that Agent A has authority X until time T. Autonomous infrastructure eventually needs something far more precise:
Agent A, acting for Principal P, under Delegation D, may perform Mutation M against State S, within Constraints C, before T, provided Invariants I remain true.Identity is becoming verifiable. Authority is becoming portable. The next step is making that authority specific to the state transition.
IBM builds a control plane above cloud platforms: The OpenFlow analogy for KedgeFlow
On October 2, IBM described expanded third-party agent management in watsonx Orchestrate. Its AI Gateway can discover and import agents built on Amazon AgentCore, Microsoft Foundry, and Google Gemini Enterprise Agent Platform into a common control plane. IBM is also giving agents distinct identities tied to enterprise identity providers, supporting short-lived, task-scoped tokens.
This demonstrates clear enterprise demand for a control plane that sits above heterogeneous agent runtimes:
This sharpens the OpenFlow analogy for autonomous computing—and points directly to the architectural necessity of KedgeFlow. In classic software-defined networking, OpenFlow revolutionized distributed networks by separating the control plane from proprietary forwarding hardware through a well-defined, programmable protocol. Network switches no longer made routing policy decisions locally; instead, a centralized OpenFlow controller distributed flow rules to the data plane.
In autonomous agent systems, the stochastic reasoning models are the “packet generators,” and cloud API endpoints are the “forwarding plane.” KedgeFlow serves as the programmable control plane. The controller does not need to be re-implemented inside every agent framework; an out-of-band KedgeFlow controller maintains the global view of state, policy, and capacity across AWS, Azure, and Google Cloud.
However, a control plane cannot govern heterogeneous runtimes with just a management dashboard. Just as OpenFlow required standardized flow-entry specifications, an agentic control plane requires a standard protocol object to communicate execution decisions to diverse execution runtimes. That protocol object is the Execution Contract.
Governance moves from documents into the runtime path
On October 5, Collibra announced its acquisition of trail ML to move AI governance from static policy determination toward continuous runtime control. trail ML contributes mechanisms that analyze evidence, assess controls, and block actions before execution when they violate policy.
Historically, governance systems (regulations, organizational compliance policies, risk matrices) and infrastructure admission systems (API gateways, Kubernetes admission controllers) lived in completely isolated organizational silos. Autonomous agents are forcing these layers together. Policies become useful to infrastructure only when they can be transformed into precise, machine-enforceable execution constraints—the central goal of Cognitive Admission Control (CAC).
RSA pushes authorization to tool-and-argument depth
On October 7, RSA announced RSA Agent ID, combining agent discovery, identity, and an AI/MCP Gateway. Crucially, RSA’s gateway enforces policy at tool-and-argument depth, generating an attributable record for every governed action. High-risk operations can require out-of-band approval from a named, authenticated human.
The progression here is significant. We have moved from “Agent may use MCP server” to “Agent may invoke Tool T with Arguments A under Authority P.”
But tool arguments describe the requested operation, not the full state transition. Argument-level policy can verify that an agent is allowed to call:
deploy_workload(cluster="prod-us-east", replicas=20)However, the actual downstream transition might exhaust regional capacity, violate placement invariants, or conflict with another racing deployment that was admitted milliseconds earlier. In Two-Phase Cognitive Commit (TCT), tool authorization must evolve into full mutation admission.
Microsoft makes policy-driven agent containment generally available
Also on October 7, Microsoft made Microsoft Execution Containers (MXC) generally available. MXC provides a policy-driven execution layer for agent workloads, answering the question: What resources may this workload touch?
Containment is becoming policy-driven, composable, runtime-enforced, and identity-aware. But as containment environments mature, the control plane still needs to answer: Which specific state transition is this workload authorized to produce?
Google moves semantic business policy into the network boundary
On October 9, Google Cloud published an implementation for governing autonomous agents using its Agent Gateway and Semantic Governance Policies (SGP). The gateway intercepts outbound tool calls, evaluating them against natural-language constraints (such as “Block any transfer exceeding USD 1,000”) before the operation reaches the backend.
Google’s SGP evaluates human-readable policy using LLM-based semantic judgment. Because semantic interpretation is inherently probabilistic, we must architecturally separate two distinct questions:
As analyzed in our study of Jev and the Agentic Control Plane, the more expressive policy becomes, the more vital independent verification becomes. Probabilistic judgment must remain evidence rather than self-authorizing execution authority.
The industry is assembling the control plane
When we synthesize these six industry signals, the emerging infrastructure stack is becoming surprisingly complete:
| Vendor / Substrate | Architectural Role | What It Governs | Key Limitation / Boundary |
|---|---|---|---|
| DigiCert | Cryptographic Identity & Visas | The Principal & Workload | Time-bounded, not state-bound |
| IBM | Cross-Cloud Management | Multi-Platform Inventory | Lacks universal execution protocol |
| Collibra | Policy-to-Runtime Engine | The Governance Rule | Needs infrastructure admission integration |
| RSA | Argument-Aware Gating | The Tool Invocation | Arguments describe call, not transition |
| Microsoft | Execution Containment (MXC) | The Environment / Sandbox | Requires state-mutation parameters |
| Google Cloud | Semantic Network Admission | The Semantic Intent | Probabilistic LLM judgment needs verification |
| NVIDIA | External Enforcement (OpenShell) | The Trust Boundary | Enforces boundaries, but who parameterizes? |
| KedgeFlow (OpenKedge) | Programmable Control Plane | The State Transition & Contract | Complete mutation admission & verification |
- • Identity systems govern the principal.
- • Gateways govern the invocation.
- • Sandboxes govern the environment.
- • Policy engines govern the rule.
- • Observability systems record the event.
The Missing Primitive: The Execution Contract
An execution contract is a mutation-specific representation of authority. Conceptually, it does not ask “Is this agent allowed to call this API?” Instead, it binds eleven distinct architectural dimensions into a single, verifiable, cryptographic protocol object within KedgeFlow:
“Authority no longer primarily belongs to the agent. Authority belongs to the transition. The agent merely exercises it.”
{
"$schema": "https://schemas.openkedge.io/v1/execution-contract.json",
"contract_id": "ect_01JB98M3R1V4X7ZQ28E9",
"admission_epoch": 1791763200,
"validity_window": {
"not_before": "2026-10-12T00:00:00Z",
"expires_at": "2026-10-12T00:00:30Z"
},
"principal": {
"id": "usr_sre_lead_74",
"org": "corp.infra.cloud",
"signature": "ed25519:7b3a98f1..."
},
"agent": {
"spiffe_id": "spiffe://prod.us-east/agent/remediator-v2",
"passport_id": "dcert:pass:9912048",
"attestation": "tpm20:pcr8-11:ok"
},
"delegation_chain": [
{ "delegator": "usr_sre_lead_74", "delegatee": "agent/remediator-v2", "scope": "scoped_cluster_remediation" }
],
"intent": {
"type": "SCALE_IN_REDUNDANT_PODS",
"target_system": "k8s:cluster/prod-us-east-core",
"params": { "namespace": "payments", "target_replicas": 12 }
},
"pre_state": {
"cluster_state_hash": "sha256:4d8e72bf89c1...",
"state_version": 1492041,
"observed_replicas": 24,
"active_traffic_qps": 8420
},
"allowed_effects": {
"max_delta_replicas": -12,
"max_downtime_seconds": 0,
"prohibited_actions": ["DROP_DATABASE", "DELETE_NAMESPACE", "UPDATE_SECRETS"]
},
"invariants": [
"traffic_error_rate_5xx <= 0.001",
"available_standby_replicas >= 8",
"p99_latency_ms <= 120"
],
"execution_boundary": {
"sandbox_runtime": "mxc.hyperv.isolated",
"egress_allowlist": ["api.internal.k8s:443"],
"credential_mode": "ephemeral_broker_token"
},
"evidence_requirements": {
"emit_mutation_receipt": true,
"post_state_diff_attestation": true,
"audit_sink": "tamper_proof_ledger"
}
}Why state belongs in the authorization decision
In traditional software systems, access control decisions are predominantly stateless:“Does Alice have role Admin on S3 bucket B?” If yes, the API call succeeds.
In autonomous multi-agent environments, this stateless paradigm causes catastrophic failure. A decision that was entirely safe thirty seconds ago can become acutely dangerous right now due to:
A regional cloud zone loses 40% of its available compute after a power event. An authorized scale-out now triggers cluster-wide throttling.
Agent A and Agent B simultaneously detect latency and attempt conflicting remediations against the same database cluster without coordinating state locks.
Between the time the LLM checks policy and the time the tool executes, the credentials or system invariants have mutated underneath it.
If a control plane authorizes an agent at session start and assumes that authority remains valid indefinitely, it embeds a massive time-of-check/time-of-use (TOCTOU) vulnerability into every autonomous loop.
Mutation-specific authority narrows that window to zero. In KedgeFlow, the execution contract carries the pre-state version, dependency hashes, and validity period. If state mutates in the intervening seconds, the execution engine rejects the contract as stale rather than blindly committing an obsolete decision. In accordance with Post-Deterministic Distributed Systems (PDDS), agent authorization evolves into optimistic concurrency control for distributed transaction processing.
The PDDS / OpenKedge Connection: KedgeFlow as the Programmable Control Plane
This direction connects directly to OpenKedge's research on Post-Deterministic Distributed Systems (PDDS), the KedgeFlow Protocol, and Sovereign Agentic Loops. In our published systems architecture, we explicitly decouple stochastic reasoning from deterministic execution.
KedgeFlow operationalizes the OpenFlow analogy: it provides an open, programmable control plane that ingests intents from arbitrary reasoning agents, validates them against distributed state and invariant predicates, and issues bounded, cryptographically signed execution grants:
The reasoning model formulates what it wishes to achieve based on prompt context and observed environmental telemetry (see Intent Specification).
Executing Cognitive Admission Control (CAC): evaluating authoritative state version, risk envelope, and invariants. Emits a signed, ephemeral contract object.
The isolated runtime (MicroVM / MXC) executes the transition strictly within the contract parameters, managed via Two-Phase Cognitive Commit (TCT).
Cryptographic attestation and tamper-evident audit records proving that post-execution state strictly complied with invariants (see IEEC Evidence Specification).
This provides the distributed system with an explicit, inspectable boundary object, rather than relying on implicit context fragmented across LLM context windows, ephemeral IAM logs, and asynchronous SIEM dashboards.
What remains unsolved
While the industry has made remarkably rapid progress across identity, containment, and gateway interceptors over the last two weeks, three defining architectural challenges remain unsolved for trustworthy autonomous infrastructure:
Infrastructure safety requires reasoning over distributed state and invariants under concurrency, not merely evaluating principal + tool + arguments. Current policy engines (OPA, Cedar) evaluate static rules against current input payloads; they do not model distributed state transitions, serializability, or concurrent leases. This is the focus of Cognitive Admission Control.
If an AI model interprets natural-language enterprise policy (as in Google's SGP), the semantic interpretation itself becomes part of the trusted computing base (TCB). How do we independently verify that probabilistic interpretation before it creates execution authority? We analyze this in our investigation of Jev and the Agentic Control Plane and Epistemic Fault Domains in PDDS.
Recording what an agent attempted is now standard practice across observability gateways. Proving mathematically that the resulting post-state remained inside the admitted contract invariants is not. Autonomous systems require closed-loop attestation: admission proves why an action was permitted, and verification proves that the system never violated safe invariants during or after execution. This is evaluated in our HardKnock Benchmark.
The overarching architectural law
The first generation of agent infrastructure focused on making agents capable of taking actions. The next generation is building boundaries around those actions.
Authority should be bound to the state transition through a mutation-specific execution contract. The next control plane must make the authority behind each consequential transition explicit, bounded, fresh, and provable.
The Agentic Control Plane
Join thousands of systems engineers, distributed systems researchers, and cloud security leaders following The Agentic Control Plane on LinkedIn. Every publication explores emerging architectural patterns, vendor signals, and mathematical primitives that make autonomous AI safe for production infrastructure.
Signals & Further Reading
- DigiCert & NVIDIA OpenShellVerifiable Identity for Agents & NVIDIA Open Agent Safety Platform (Sept 29, 2026).
- IBM watsonx OrchestrateExpanded Multi-Cloud Agent Management & AI Gateway Integration (Oct 2, 2026).
- Collibra & trail MLAcquisition for Automated Runtime AI Governance & Action Blocking (Oct 5, 2026).
- RSA Agent IDTool-and-Argument Depth Policy & Out-of-Band Approvals for Enterprise (Oct 7, 2026).
- Microsoft Execution ContainersGeneral Availability of Policy-Driven Agent Containment (Oct 7, 2026).
- Google Cloud Agent GatewaySemantic Governance Policies (SGP) at the Network Boundary (Oct 9, 2026).
- OpenKedge Research Papers & SpecificationsKedgeFlow Protocol (Specification), Post-Deterministic Distributed Systems (PDDS) (arXiv:2606.01722), Cognitive Admission Control (CAC) (arXiv:2609.16313), and Two-Phase Cognitive Commit (TCT) (arXiv:2609.16853).