Agent Control Protocol (ACP) v1.30 — Admission Control for Agent Actions

Autonomous agents can produce harmful behavioral patterns from individually valid requests — a threat class that per-request policy evaluation cannot address, because stateless engines evaluate each request in isolation and cannot enforce properties that depend on execution history.

We present ACP, a temporal admission control protocol that enforces behavioral properties over execution traces by combining static risk scoring with stateful signals (anomaly accumulation, cooldown) through a LedgerQuerier abstraction separating decision logic from state management.

ACP is not an anomaly detection system: it does not detect suspicious patterns and alert; it blocks execution based on deterministic, history-aware risk scoring, providing a hard enforcement boundary rather than an advisory signal.

Key results:

- Under a 500-request workload where every request is individually valid (RS=35), a stateless engine approves all 500 requests, while ACP limits autonomous execution to 2 out of 500 (0.4%), escalating after 3 actions and enforcing denial after 11.

- Decision evaluation runs at 739–832 ns (p50); throughput reaches 1,720,000 req/s (baseline) and 920,000 req/s at 10 concurrent workers.

- Safety and liveness properties are model-checked via TLA+ (11 invariants + 4 temporal properties, 0 violations); two-agent safety verified across 4,294,930,695 distinct states with zero violations.

- Runtime correctness validated by 73 signed conformance test vectors.

- We identify and formalize deviation collapse — a governance failure mode in which enforcement is active but never exercised — and introduce Boundary Activation Rate (BAR) as its detection mechanism.

- ACP-RISK-3.0 eliminates cross-context interference by scoping rate-based anomaly signals via PatternKey(agentID, capability, resource).

Specification and implementation: https://github.com/chelof100/acp-framework-en