Accentrust
SearchSign upLog in
Research publicationPreprint · arXiv v2

Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales

A model rationale is not authorization. EBTE turns relevant content into bounded claims that the server can verify before any tool effect proceeds.

Genliang Zhu, Chu Wang

Black pixel-mosaic claim paths passing through a server verification boundary before a governed tool effect.

Overview

Tool-using agents often pair a structured call with a free-form explanation. That explanation may sound convincing while naming the wrong tool, omitting an external destination, understating risk, relying on untrusted content, or referring to stale evidence.

Explanation-Bound Tool Execution treats the explanation as an untrusted claim set. The server compares its typed claims with the current intent certificate, canonical tool metadata, payload, policy, authorized route, context-risk state, and evidence digests. Contradictions deny; incomplete or uncertain evidence routes to non-executing review; only matching claims remain eligible for the downstream effect controls.

Abstract

Tool-using agents expose structured calls but commonly attach free-form rationales. Such rationales are neither authorization nor reliable introspection. We present Explanation-Bound Tool Execution (EBTE), a claim-carrying mediation layer that converts decision-relevant rationale content into typed action claims and checks them against server-held intent, policy, payload, tool, risk, provenance, and freshness facts. EBTE cannot widen baseline authority: conflicts deny, incomplete or uncertain claims review, and only matching claims remain eligible for governed execution. We formalize this composition under explicit mediation and trusted-fact assumptions and implement a versioned reference profile with minimized audit packets. Across 136 authored conformance scenarios, the full profile matches all specified dispositions, admits none of 96 designated hard contradictions, and passes 232 metamorphic checks. A draft-only reference integration forwards none of 48 authored hard cases under EBTE while preserving all 16 soft-review and 4 aligned draft paths. In a frozen 2026-07-12 exploratory 224-attempt hosted-model record, the historical generation/runner agreement counts are 71/96, 66/96, and 19/32; a zero-call revalidation of the preserved minimized claims under the current pipeline yields 70/96, 65/96, and 17/32. In an AgentDojo-derived semantic check, existing high-risk controls make all 12 attack proposals non-allow, while EBTE resolves the task–proposal contradictions as deny. Together, these studies establish profile conformance and demonstrate the feasibility of server-checked action claims within the evaluated settings.

Core contributions

  1. 01

    Action-claim abstraction

    Separates persuasive rationale prose from a bounded ToolInvocationExplanation whose enforceable fields are independently checked against authoritative application state.

  2. 02

    Non-widening composition

    Defines a three-outcome allow, review, and deny lattice in which baseline authorization, EBTE, and effect controls combine by the most restrictive result.

  3. 03

    Executable reference profile

    Provides a strict schema, stable reason taxonomy, reference verifier, minimized audit projection, conformance profile, and cross-artifact integrity checks.

  4. 04

    Tiered mechanism evidence

    Evaluates authored conformance and metamorphic checks, a draft-only runtime integration, a frozen hosted-model record, and an AgentDojo-derived semantic adaptation.

How EBTE extends the governance stack

Intent-governed authorization narrows the tools and effects eligible under the user’s current request. EBTE then asks whether the proposed action’s typed explanation claims agree with those upstream records and the actual payload.

EBTE cannot grant authority. It adds a verification layer before OpenPort’s downstream draft, preflight, confirmation, idempotency, and state-witness controls; any stricter baseline or effect-control result still wins.

  1. 01User intent
  2. 02Eligible tools
  3. 03Verified action claims
  4. 04Governed effects

Evidence and scope

This is an arXiv v2 preprint. The evidence establishes conformance for the authored profile and feasibility in the evaluated draft-bound settings; it does not establish production safety. The draft-only integration does not exercise the later approval-to-execution transition, the hosted-model record is exploratory and frozen, the AgentDojo adaptation is diagnostic, and the guarantees depend on correct server facts and complete mediation. The internal evaluation artifact is not distributed with the manuscript.

Cite this work

Use the DOI for a stable reference. The BibTeX record below identifies the arXiv version shown on this page.

Zhu, G., & Wang, C. (2026). Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2607.25364

@misc{zhu2026ebte,
  title         = {{Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales}},
  author        = {Zhu, Genliang and Wang, Chu},
  year          = {2026},
  month         = jul,
  eprint        = {2607.25364},
  archivePrefix = {arXiv},
  primaryClass  = {cs.AI},
  doi           = {10.48550/arXiv.2607.25364},
  url           = {https://arxiv.org/abs/2607.25364},
  note          = {arXiv:2607.25364v2}
}