Agent Control Protocol (ACP) v1.30 — Admission Control for Agent Actions

Autonomous agents can produce harmful behavioral patterns from individually 
valid requests — a threat class that per-request policy evaluation cannot 
address.

We present ACP, a temporal admission control protocol that enforces behavioral 
properties over execution traces by combining static risk scoring with stateful 
signals (anomaly accumulation, cooldown) through a LedgerQuerier abstraction. 
ACP is not an anomaly detection system: it blocks execution based on 
deterministic, history-aware risk scoring, providing a hard enforcement 
boundary rather than an advisory signal.

Structural gap. Under a 500-request workload where every request is 
individually valid (RS=35), a stateless engine approves all 500; ACP limits 
autonomous execution to 2 out of 500 (0.4%), escalating after 3 actions and 
enforcing denial after 11.

ACP-RISK-3.0. We identify a state-mixing vulnerability in ACP-RISK-2.0 where 
agent-level rate aggregation produces cross-context false denials (Experiment 
7), and introduce ACP-RISK-3.0, which eliminates it by scoping anomaly signals 
to PatternKey(agentID, capability, resource) while preserving enforcement 
(Experiment 8).

Performance. Decision evaluation runs at 739–832 ns (p50); throughput reaches 
1,720,000 req/s at baseline. ACP's overhead is six orders of magnitude below 
the actions it governs.

Formal verification. Safety and liveness properties are model-checked via 
TLA+ (11 invariants + 4 temporal properties, 0 violations across 5,684,342 
states; two-agent model: 4.29 billion states, 0 violations) and validated by 
73 signed conformance test vectors. The TLA+ proof covers the evaluate-then-
mutate pipeline under serializable ledger (TA1) and atomic commit (TA2), 
showing that ACP is a formal refinement of the atomic decision boundary model 
of Paper 0.

Governance. We identify deviation collapse — a degenerate regime where 
enforcement never fires because upstream constraints eliminate DENIED conditions 
— and introduce BAR (Boundary Activation Rate), BAR-Monitor with ΔBAR trend 
detection (fires 3 batches before threshold collapse), and EvaluateCounterfactual 
for structural capacity verification.

Adversarial evaluation (14 experiments). We formalize the adversary as A=(K, 
S, B) and evaluate: knowledge-aware evasion (Exp 10), threshold sensitivity 
across 5 configurations (false-denial rate 0.00 all variants, Exp 11), 
multi-tool IPI with real LLM (DeepSeek-R1:8b, Exp 12), coordinated 
multi-agent behavior showing CW_approved=2N exact linearity and O(N) bound 
(Exp 13), and OPA capability comparison (Exp 14).

OPA comparison (Experiment 14). A controlled capability comparison — not a 
performance benchmark — against Open Policy Agent v1.15.2. Three scenarios 
establish the expressiveness boundary: single-request (all systems agree), 
frequency accumulation (ACP enforces; stateless and OPA approve all 10), 
cooldown enforcement (ACP enforces; OPA has no cooldown concept). The 
contribution is not that state is required — it is that enforcement must occur 
at a boundary where evaluation and state transition are jointly determined.

Deployment. Maturity model (Tier 1–3), PolicyConfig profiles for four threat 
levels (Low/Medium/High/Critical), and migration guide from ACP-RISK-2.0 to 
ACP-RISK-3.0.

Governance series. This paper is the published foundation of a four-paper 
series on formal agent governance. Each paper addresses a distinct layer of 
the governance stack:

  Paper 0 — Atomic Decision Boundaries: proves that enforcing admissibility 
  at execution time requires evaluation and state transition to be jointly 
  determined as a single indivisible LTS step. ACP is the concrete 
  instantiation of that structural requirement.

  Paper 1 — ACP (this paper): stateful per-action admission control enforced 
  atomically via Execution Tokens and a serializable LedgerQuerier. Implements 
  the atomic boundary of Paper 0 with TLA+-verified guarantees.

  Paper 2 — From Admission to Invariants (IML): identifies the structural 
  limit of enforcement-based governance (§17 of this paper) and proves that 
  behavioral drift within the compliant region A₀ is non-identifiable from 
  the enforcement signal alone. The Invariant Measurement Layer detects this 
  drift with provably finite delay.

  Paper 3 — Fair Atomic Governance: proves that atomic correctness does not 
  imply fair allocation. Sybil amplification, temporal domination, and 
  resource contention unfairness are consistent with full enforcement 
  correctness. Introduces the allocation layer and four mechanisms (M1–M4).

  Paper 4 — Irreducible Multi-Scale Governance: proves that the four-layer 
  architecture is structurally necessary under finite observability. No 
  composition of fewer than four layers can simultaneously guarantee strong 
  atomicity, bounded non-identifiability, actor-level fairness, and Sybil 
  robustness.

Specification and implementation: https://github.com/chelof100/acp-framework-en