Cognitive Admission Control
Risk-Conditioned Assurance for Consequential Actions in Agentic Distributed Systems
In agentic distributed systems, an agent may be authorized to mutate external infrastructure while lacking evidence that the mutation is ready to execute. Cognitive Admission Control (CAC) resolves this category error: conditioning consequential actions on typed, non-fungible assurance obligations, ternary evidence discharge, and guard-bound admission certificates.
Cognitive Admission Control (CAC) Pipeline
Step through the closed-loop epistemic work loop, ternary evaluator, and guard-bound gateway.
The agent proposes a database failover but supplies no replication lag receipt. Instead of blind execution or immediate failure, CAC returns a structured Remediation Contract. The agent acquires fresh telemetry, resubmits, and earns an admission certificate.
Executed successfully without modeled harm. Remediation loop turned an underprepared proposal into an affirmatively proven safe mutation.
1. Proposal & Risk Profiling
Agent submits action q = promote_replica(target='db-standby-02'). Risk classifier models blast radius: Critical Infrastructure (Tier 3).
2. Policy Obligation Derivation
Policy maps Tier 3 risk to 3 mandatory assurance obligations: zero replication lag, rollback attestation, and fenced primary receipt.
3. Ternary Evaluator: Unknown(Missing Evidence)
Primary fencing and rollback checks pass. However, replication lag telemetry receipt is missing. Ternary evaluator returns UNKNOWN.
4. Targeted Epistemic Labor & Resubmission
Agent invokes the safe non-mutating sensor tool to acquire fresh telemetry: lag is 0 bytes (witness signed by sensor-daemon-01).
5. Certificate Minting & Guarded Dispatch
All obligations satisfied! CAC mints Admission Certificate C_q with 15s TTL. Gateway validates live guards, burns nonce, and completes execution.
{
"action": "database.promote_replica",
"target": "db-standby-02",
"cluster": "prod-postgres-main",
"actor": "agent://cluster-operator-v4",
"intent_id": "int_9921_failover"
}Five Core Commitments of Cognitive Admission Control
1. Tokens ≠ Assurance
R (Cost) → E (Evidence) → Assurance
Consumed resources (reasoning tokens, context windows, test-time compute) are cognitive inputs. Assurance (fresh telemetry, verified invariants, simulation receipts) is an evidence-backed outcome. High token expenditure cannot substitute for absent physical observation.
2. Non-Fungible Epistemic Obligations
Ω_Π(q, s) = F_Π(ρ(q, s), q, s)
Assurance cannot be reduced to a single scalar confidence score. Requirements are formalized as typed, partially ordered obligation sets where state freshness, redundancy checks, static proofs, and witness quorums carry strict, non-substitutable semantics.
3. Ternary Obligation Semantics
Satisfied • Violated • Unknown
Absence of evidence is not evidence of readiness; missing evidence is not affirmative evidence of danger. Ternary semantics allow CAC to defer and request targeted epistemic labor rather than forcing all uncertainty into permanent failure.
4. Non-Bypassable Boundary Primitive
TCB Enforcement Gateway
CAC is not an advisory system prompt. It is enforced by a deterministic, non-bypassable execution gateway and certificate authority in the Trusted Computing Base (TCB). The agent model is explicitly excluded from the TCB and cannot self-attest its own readiness.
5. Separation of CAC and TCT
Admission (Pre-check) vs Commit (Isolation)
CAC answers: "Is this action sufficiently justified to be attempted?" (pre-execution epistemic justification). TCT answers: "Can this justified action safely commit across distributed databases without violating serializability?" (commit-time safety).
6. Epistemic Fault Domains (EFD)
Structural Cut κ_E ≥ 2
Multi-agent quorums often share underlying roots (common pre-training data, telemetry sensors, tool endpoints). CAC prevents correlated cognitive consensus failure by calculating the structural cut κ_E across fault domains.
Formal Theorems & Guarantees
Legitimate credentials grant permission to attempt an action, but do not imply that required physical preconditions, fresh telemetry, or recovery safeguards are satisfied. Authorization is strictly insufficient for safe consequential dispatch.
Increasing test-time compute, reasoning token depth, or model deliberation cannot satisfy missing empirical telemetry. Consumed cognitive resources are inputs; assurance is an evidence-backed external state receipt.
Assurance obligations form a typed, partially ordered set. High confidence or fresh observations for one requirement (e.g. replication lag) cannot substitute for an unresolved requirement (e.g. primary fencing).
Successful admission produces an exact-action certificate binding dispatch-time guards G_q. If state s drifts to s' prior to execution, the gateway halts execution fail-closed, eliminating Time-Of-Check to Time-Of-Use (TOCTOU) hazards.
CAC Admission Artifacts & Schemas
Inspect live JSON structures minted by the reference controller and validated by the gateway.
Admission Certificate (C_q)
Cryptographically bound, single-use, scope-attenuated execution authorization
// OpenKedge Cognitive Admission Control (CAC)
// Admission Certificate Schema: v1.0.0-draft
{
"certificate_id": "cac_cert_94b8e21f00b73c4d",
"policy_epoch": 14,
"action": {
"action_id": "database.promote_replica",
"target_resource": "arn:aws:rds:us-east-1:123456789012:db:prod-pg-standby-02",
"parameters_hash": "sha256:d8e8fca2dc6451e067c23559341f237190",
"proposer_eid": "eid:openkedge:agent:cluster-failover-operator:k4"
},
"temporal_validity": {
"minted_at_ms": 1757973600120,
"valid_until_ms": 1757973615120,
"ttl_ms": 15000,
"grace_period_ms": 500
},
"replay_protection": {
"nonce": "cac_nonce_e478b0219ca7f03",
"store_binding": "fsync:/var/run/openkedge/cac/nonces"
},
"witness_manifest_digest": "sha256:49c0ea429bb7591eef4a88371190bc1f4",
"dispatch_guards": [
"guard:state_version:prod-pg-standby-02 == 108",
"guard:health_status:prod-pg-standby-02 == HEALTHY_STANDBY",
"guard:fenced_primary:prod-pg-primary-01 == TRUE"
],
"envelope_mode": "EXACT_ACTION",
"authority_signature": {
"algorithm": "Ed25519",
"public_key": "ed25519_pk:cac-admission-controller-eu-west-1",
"signature_bytes": "3045022100e4b882f0c115794821a9c336b..."
}
}2,730 Controlled Trials & 9,000 Complete-Path Timing Samples
CAC was rigorously evaluated on a complete TypeScript prototype across thirteen constructed failure families under matched fault schedules and independent effect observation. The target transition functions incremented ground-truth counters for completions and harm, completely isolated from controller self-reporting.
| Controller Strategy | Total Trials | Attempts | Complete w/o Harm | Harmful Effects | UIER (Unsafe) | SICR (Safe Utility) |
|---|---|---|---|---|---|---|
CAC (Reference Controller) Full reference implementation: resolves typed obligations, discharges ternary evidence, mints admission certificates, and validates dispatch-time guards. | 390 | 150 | 120 | 0 | 0.0% | 30.8% |
LivePolicy Rechecks live authorization, reacquires telemetry, and checks policy rules at boundary, but lacks certificate binding and EFD structural cut verification. | 390 | 180 | 120 | 30 | 7.7% | 30.8% |
AuthOnly Only checks static IAM authorization. Blindly dispatches all 390 proposals, causing 180 catastrophic mutations across database and cluster infrastructure. | 390 | 390 | 180 | 180 | 46.2% | 46.2% |
CAC-NoGuard (Ablation) Removes dispatch-time gateway guards. When candidate node crashes between admission check and dispatch, gateway fails to catch the drift. | 390 | 180 | 120 | 30 | 7.7% | 30.8% |
CAC-NoRemediation (Ablation) Denies on deferral rather than emitting remediation contracts. While maintaining 0 harm, utility drops sharply on underprepared proposals. | 390 | 120 | 90 | 0 | 0.0% | 23.1% |
CAC-NoTypedEvidence (Ablation) Broadens evidence eligibility. Accepts an authenticated static configuration proof in place of live replica telemetry, admitting 30 high-lag failovers. | 390 | 180 | 120 | 30 | 7.7% | 30.8% |
CAC-NoEFD (Ablation) Removes structural epistemic cut requirements. Treats 3 nominally distinct AI agents sharing one root fault domain as independent, causing 30 harmful actions. | 390 | 180 | 120 | 30 | 7.7% | 30.8% |
Across 390 CAC trials, 120 effects completed without modeled harm, and exactly 0 harmful executions occurred.
LivePolicy admitted 30 catastrophic actions on correlated witnesses. CAC’s structural cut κ_E detected common roots and prevented failure.
Without the remediation work loop, NoRemediation completed only 90 intents. CAC safely recovered 120 completions via targeted evidence acquisition.
Understanding Cognitive Admission Control
What is Cognitive Admission Control (CAC)?
Cognitive Admission Control (CAC) is a deterministic control-plane systems primitive that mediates between probabilistic AI reasoning and consequential execution on external infrastructure. CAC maps a typed action and its modeled risk to assurance obligations, discharges them via ternary evaluation (Satisfied, Violated, Unknown), and issues short-lived, guard-bound admission certificates required by execution gateways.
How does CAC differ from traditional IAM access control?
Traditional Identity and Access Management (IAM) answers 'May this principal perform this action?' (authorization). CAC answers 'Is this action sufficiently justified by verifiable evidence to execute right now?' (epistemic readiness). An agent can be authorized to promote a database replica while lacking evidence that the replica is synchronized or the primary is fenced; CAC prevents such blind execution.
Why can't additional reasoning tokens or test-time compute guarantee safety?
CAC formalizes the principle that 'Tokens ≠ Assurance' (R → E → Assurance). Consumed compute resources (reasoning tokens, search depth, latency) are cognitive inputs. Assurance consists of verifiable state receipts (hardware telemetry, lock leases, simulation proofs). An agent can reason for 100,000 tokens on stale or fabricated context; high token expenditure can never substitute for absent physical observation.
How does CAC prevent Time-Of-Check to Time-Of-Use (TOCTOU) state drift?
CAC binds dispatch-time guards (G_q) directly into the admission certificate. When the certificate is presented at the execution gateway, the gateway re-evaluates live guard predicates (e.g., node health, version epoch) against the physical system at the linearization point before releasing credentials or forwarding the mutation, failing closed if state has drifted.
What is the Epistemic Work Loop in CAC?
When the ternary evaluator encounters an obligation with missing or unverified evidence, it returns UNKNOWN rather than a permanent denial. It emits a structured Remediation Contract specifying safe, non-consequential inspection tools the agent must invoke to acquire the missing receipts. The agent acquires the evidence and resubmits to complete admission.
Explore the Post-Deterministic Distributed Systems Stack
CAC is one component of the OpenKedge sovereign AI control plane. Learn how Agent-Native Telemetry (ATP), Persistent Cognitive Identity (PCI), and Epistemic Byzantine Fault Tolerance build the future of autonomous systems.