When AI Agents Commit: Cognitive Serializability Across Data, Evidence, Policy, and Authority
Autonomous agents derive database mutations from retrieved evidence, policies, and delegated authority that can drift while reasoning is in progress. Database isolation orders submitted SQL; agentic transaction processing verifies contract satisfaction. Neither establishes a common valid point for the mutation and its derivation inputs. TCT combines sealed envelopes, guard-first commit transactions, and co-committed receipts to eliminate the Epistemic-to-ACID gap.
TCT Research Key Facts
The Epistemic-to-ACID Gap
Why standard database serializability (ACID, SSI, 2PL) is insufficient when autonomous AI agents mutate state.
Classical database concurrency control treats transactions as self-contained programs. Once a transaction issues SQL writes, serializable engines ensure an equivalent sequential schedule. But autonomous AI agents do not submit static queries: they execute stochastic reasoning over diverse inputs:
- Database snapshots (
σ_D): Inventory counts, account balances, server states. - Retrieved evidence (
J_E): Vendor accreditations, legal documents, third-party API telemetry. - Active organizational policies (
Π_obs): Spending caps, risk rules, compliance thresholds. - Delegated authority tokens (
J_Aobs): Scoped approvals from supervisors or orchestrators.
Because LLM reasoning takes 500 ms to several seconds, these premises frequently change in flight. A vendor accreditation may be revoked, or a corporate spending cap reduced, while the agent is formulating its proposal.
Two Correctness Profiles: TCT-S vs. TCT-C
TCT recognizes that not all agentic operations require identical isolation semantics. It provides two formally distinct profiles.
TCT-S (Strict Profile)
Every mediated value exposed during reasoning must remain unchanged at a common logical commit event. If any database read, evidence token, or policy rule shifted, the gate strictly aborts the transaction.
- Ideal for financial ledger transfers, regulatory reporting, and legal actions.
- Sustains 1,418 txns/sec peak throughput; 100% anomaly prevention.
TCT-C (Compatible Profile)
When inputs drift, the gate re-evaluates the concrete effect against a simultaneously protected current dependency vector and policy using registered joint recertifiers Φ.
- Ideal for supply-chain allocation, resource reservation, and dynamic scheduling.
- Peak throughput of 1,842 txns/sec; recertifies safe drift without rerunning expensive LLMs.
TCT Commit Protocol Pipeline
TCT Guard-First Commit Protocol
Explore how TCT eliminates the Epistemic-to-ACID gap across database, evidence, policy, and authority boundaries.
Closed Derivation Capture
Trusted mediation captures input tokens and active policy
// Trusted Mediation Layer (Rust Proxy)
const token_vector = {
db_snapshot: { key: "inventory:item_4091", version: 104, hash: "0x8fa..." },
evidence: { type: "supplier_cert", issuer: "gov.iso9001", exp: 1758060000 },
policy: { rule_id: "procurement_max_single_order", epoch: 14, cap: 80 },
authority: { role: "purchasing_agent", scope: "ops.po_create", budget: 50000 }
};TCT Empirical Falsification & Benchmarks
Experimental Evaluation & Verification
Tested across 28 controlled perturbation histories, scaling up to 128 concurrent workers on a 16-core Intel Xeon Gold 6326 server.
Permitted 5 of 7 core semantic anomalies through. Zero external evidence or policy validation.
Protected declared DB state, but failed whenever external evidence, policies, or authority drifted.
0/28 anomalies permitted. Exact lock-point acyclicity and zero unjustified commits.
| ID | Anomaly Class | Injected Perturbation | ACID-Only | State Gate | TCT |
|---|---|---|---|---|---|
| H1 | Data Drift | Concurrent inventory decrement during LLM deliberation Stale stock read (insufficient quantity remaining) | FAIL (PASS) | BLOCKED | BLOCKED |
| H2 | Evidence Revocation | Vendor ISO certification revoked while agent formulates purchase order Mutating state under invalid compliance evidence | FAIL (PASS) | FAIL (PASS) | BLOCKED |
| H3 | Policy Epoch Drift | Spending policy reduced from $50k to $25k prior to commit Exceeding newly enforced institutional procurement cap | FAIL (PASS) | FAIL (PASS) | BLOCKED |
| H4 | Authority Expiration | Manager approval token expires or is revoked during reasoning delay Executing unauthorized state transition without valid grant | FAIL (PASS) | FAIL (PASS) | BLOCKED |
| H5 | Write Skew | Two agents concurrently allocate warehouse capacity across locations Over-allocation exceeding aggregate cluster limit | FAIL (PASS) | BLOCKED | BLOCKED |
| H6 | Envelope Tampering | Attacker or proxy corrupts parameters hash in payload Discrepancy between sealed proposal and executed mutation | FAIL (PASS) | FAIL (PASS) | BLOCKED |
| H7 | Compatible Drift | Order quantity 60 items; current stock drops from 100 to 80; cap is 90 Non-identical input state vector | FAIL (PASS) | BLOCKED | RECERTIFIED |
TCT Cryptographic Schemas & Artifacts
TCT Cryptographic Artifacts
Inspect the canonical sealed envelopes, typed dependency vectors, guard locks, and receipts that guarantee cognitive serializability.
// OpenKedge TCT (Taming Cognitive Transactions)
// Canonical Envelope Specification: v1.0.0-draft
{
"protocol_version": "tct-v1.0.0",
"envelope_id": "tct_env_8a410b9ef0321c7d",
"tenant_id": "saudi-telecom-sovereign-01",
"operation": {
"op_name": "procurement.order_batch",
"version": "1.2.0",
"specification_digest": "sha256:d947ca281fe0184a26189db4c80351f7b8..."
},
"dependency_vector_digest": "sha256:1a84f3c0919b7a44f280a9db582173ea41...",
"target_effect": {
"effect_class": "DATABASE_MUTATION",
"effect_digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427...",
"canonical_mutation": "UPDATE inventory SET quantity = quantity - 60 WHERE item_id = 4091"
},
"required_plan_digest": "sha256:7b92f4410a8802ce4a899bc10189fa...",
"durability_domain": "D_WAL_POSTGRESQL_REPLICATED",
"selected_profile": "TCT-S",
"envelope_hash": "sha256:4f83b10c92da025e1927cb803a1109dc088a29b209..."
}Sufficient Conditions & Soundness Theorems
Mathematical proof results from Section 6 of the paper establishing lock-point order, idempotency, and the boundary on zero-error admission.
Because local guards are acquired before any protected read and Mechanism B/C external reservations follow a single growing phase in canonical key order, no conflicting dependency cycle can form across local database rows or external authority grants.
Database atomicity binds the executed mutation, receipt ρ_i, and grant finalization outbox to the same WAL transaction. An idempotent outbox worker delivers the receipt to external issuers, transitioning reservations from Reserved to Consumed exactly once.
If every belief-activation path in Epistemic State Replication (ESR) requires a verified durable receipt ρ_i, an aborted or rejected agent mutation can never activate its tentative belief delta into world state.
Proves that the trusted capture and mediation boundary is mathematically necessary for zero-error safety: if external premises can drift without mediation visibility, no algorithm can guarantee soundness without deadlocking.
Four Commit-Spanning Validity Mechanisms
Heterogeneous external premises require tailored synchronization mechanisms. TCT unifies four mechanisms within a single growing phase:
Canonical key-ordered transactional locks (advisory and row-level) held in the local PostgreSQL transaction across validation and commit.
Post-seal signed grants with single-use nonces binding the envelope, effect, and durability target. Idempotent outbox finalizes to Consumed.
Third-party witness verification where external resource managers provide co-signing receipts evaluated atomically before effect execution.
Lightweight optimistic re-reads under held local guards, validating that self-stable or low-contention inputs have not drifted before WAL flush.
Cite the TCT Research Paper
@article{he2026tct,
title={When AI Agents Commit: Cognitive Serializability Across Data, Evidence, Policy, and Authority},
author={He, Jun and Yu, Deying},
journal={arXiv preprint arXiv:2609.20261},
year={2026}
}Frequently Asked Questions
What is the Epistemic-to-ACID Gap?
Autonomous agents derive concrete database mutations from prior reads, retrieved evidence, policies, beliefs, and delegated authority. Those premises often drift during the 500ms to several seconds required for LLM reasoning. Standard database isolation (like PostgreSQL SERIALIZABLE or 2PL) only orders submitted SQL statements; it has zero visibility into whether the reasoning premises used during deliberation remain valid at commit time. The Epistemic-to-ACID gap is this blind spot: transactions can be ACID-isolated while being semantically invalid, obsolete, or unauthorized.
What is TCT (Taming Cognitive Transactions)?
TCT is an admission-and-commit transaction protocol introduced in arXiv:2609.20261. It combines immutable versioned executable definitions, registry-derived authority plans, canonical sealed envelopes, guard-first commit transactions, post-seal envelope- and witness-bound grants, co-committed receipts, idempotent grant finalization, and receipt-driven epistemic reconciliation to bridge the Epistemic-to-ACID gap.
How does TCT-S (Strict) differ from TCT-C (Compatible)?
TCT-S enforces strict Cognitive Serializability: every single mediated value used in reasoning must remain unchanged at a common logical point. It strictly aborts if any evidence, policy, or read drifted. TCT-C enforces Effect-Compatible Cognitive Admission: when derivation inputs change, the concrete effect may still commit if a registered joint predicate Φ accepts the complete simultaneously held current dependency vector and current policy. In empirical trials, TCT-C recovered 92.8% of transactions under 20% input drift without safety violations.
What are the four commit-spanning validity mechanisms in TCT?
Mechanism A (Local Guard Fencing) uses canonical database row and advisory locks for local tables. Mechanism B (Pre-Commit External Lease) uses post-seal cryptographic grants binding the envelope, effect, and durability target. Mechanism C (Witness-Checked Co-Commit) validates state at commit via external atomic witnesses. Mechanism D (Optimistic Recertification) rechecks validity predicates at commit time. TCT composes these mechanisms to protect heterogeneous dependencies.
Why does TCT outperform native PostgreSQL SERIALIZABLE at high concurrency?
PostgreSQL SERIALIZABLE uses Serializable Snapshot Isolation (SSI) predicate locks (SIREAD locks). Under high concurrency (64 to 128 workers), SSI suffers severe false-positive lock contention and abort storms, crashing throughput down to 310 txns/sec. TCT uses guard-first 2PL with canonical key ordering at READ COMMITTED isolation, avoiding SSI thrashing and sustaining 1,610 txns/sec at 128 workers with zero deadlocks.
How does TCT connect to CAC (Cognitive Admission Control) and PDDS?
CAC and TCT operate at distinct lifecycle stages in Post-Deterministic Distributed Systems (PDDS). CAC operates pre-execution, answering: 'Is this action sufficiently justified to be attempted?' (epistemic readiness). TCT operates at commit time, answering: 'Can this justified action safely commit across distributed databases without violating serializability and premise validity?' (isolation and settlement).
Protect Your Infrastructure When AI Agents Commit
OpenKedge provides reference implementations and deployment architectures for sovereign AI infrastructure, banking systems, and critical national operations.