The "Law of Stop" reveals missing interruptibility; agent safety relocates to action boundaries

---

1. Agentic RAI & Control (the publication's focus)

Lead judgment: Interruption and containment cannot be installed in model weights; they must be structured as external, legally grounded runtime boundaries.

The prevailing governance reflex, demanding a generic "stop button" or post-hoc human sign-off, collapses under the reality of distributed agentic systems. In The Law of Stop: Interruptibility, Injunctions, and the Governance of Agentic AI, Oren Perez investigates the institutional and technical machinery of halting automated systems across four paradigms (simple, sequenced, networked, and distributed):

• The Incident Reality: Coding 1,400 AI Incident Database events (1,213 retained after screening, with dual-model coding and author adjudication), Perez finds that roughly 80% of the retained incidents recorded no stop. Crucially, where a usable stop was absent, the missing element was legal and institutional rather than technical in 80% of cases, lacking clear jurisdictional authority, evidentiary thresholds, or operational mandates.
• Governance Vacuum: In Perez’s survey of 39 AI governance instruments, seven contain binding interruption provisions; none gives a complete account of coordination, preservation, and safe resumption. [1]

+-------------------------------------------------------------------------------+
|                       THE DUAL PARADOX OF AGENT STOP                          |
|                                                                               |
|   1. Structural Lag:   No stop occurred in 80% of the retained incidents.     |
|   2. Institutional Gap: Of cases without a usable stop, 80% lacked legal      |
|                        authority rather than technical means.                 |
|                                                                               |
|   Outcome: A "kill switch" without clear epistemic triggers, delegated       |
|            standing, and safe state unwind is merely symbolic compliance.      |
+-------------------------------------------------------------------------------+

The Limits of Reactive Oversight: Examining oversight from a philosophical perspective, Baum et al. (Anticipatory Human Oversight of Agentic AI) argue that reactive "human-in-the-loop" monitoring alone faces structural limits for multi-step agentic systems:

1. The Autonomy Paradox: Continuous intervention on individual action steps undermines the efficiency and autonomy that justified deploying agents.
2. The Horizon Gap: Intervening only on aggregate outcomes occurs too late; cumulative systemic harms only become legible after irreversible side effects have occurred.

Baum et al. argue that reactive oversight must be complemented by an anticipatory mode: human principals exercise meaningful control by formally defining the normative agenda (boundary constraints, allowed action topologies, and mandatory escalation triggers) before the agent executes, establishing strict moral and operational answerability. [2]

Action Alignment vs. Content Safety: This aligns precisely with the formal proof provided by Li & Zhao in Agent Safety Is Action Alignment. The authors show that porting chatbot content-safety techniques (RLHF/refusal fine-tuning) into agentic workloads is a foundational category error:

• Content harm is an intrinsic property of generated text; agentic harm is relational, defined strictly by the delta between the authority an action exercises and the authority granted by the principal.
• Safety-refusal training teaches models superficial lexical patterns, causing multi-step planning to collapse under benign edge cases while remaining thoroughly exploitable under slight variations.
• Action safety cannot reside in internal weights; it must be expressed as least privilege, verified and enforced outside the model at the typed action boundary. [3]

Recommended Acceptance Controls:

• Havoc Oracle Containment: Adopt the formal verification model of Moon & Varshney (Containment Verification), treating the underlying LLM as an unconstrained, non-deterministic oracle over the framework's typed action space, using mechanized verifiers (e.g., Dafny) to mathematically guarantee that framework boundaries cannot be bypassed regardless of model outputs. [4]
• Normative Pre-Specification: Apply Baum et al.'s anticipatory oversight: define permitted actions and escalation conditions before execution, retain human intervention when those conditions trigger, and refine the agenda through subsequent review.

---

2. Enterprise Governance & Safety

Enterprise agent architectures must bridge the "Emergence Gap" through multi-disciplinary control theory and runtime mediation.

Enterprise risk officers routinely treat autonomous agent fleets as deterministic microservices, expecting traditional CI/CD and DevSecOps pipelines to catch failures. Telukunta, Lilis, and Baron (The CASE Framework, arXiv:2608.10153) demonstrate why this approach fails:

• The Emergence Gap: Analyzing enterprise agent failures, the authors document that 51 of 62 coded agent incidents (82%) implicate multiple governance layers, including supervisory and operational weaknesses alongside single-agent failures.
• Tooling Vacuum: Evaluating the public documentation of 22 commercial and open-source agent governance tools, zero tools provided full coverage of Layer 2 (complex adaptive emergence), and all 35 enterprise deployments scored in the lowest maturity tier on publicly available evidence.
• The Four-Layer Discipline: The authors map governance to classical sciences:

1. Individual Agent: Classical Control Theory (setpoints, feedback, observation).
2. Agent Collectives: Complex Adaptive Systems (mitigating non-compositional emergence).
3. Human-Agent Teams: Supervisory Cybernetics (Ashby’s Law of Requisite Variety).
4. Enterprise Fleets: Engineering Operations (decision-quality error budgets). [6]

+-------------------------------------------------------------------------------+
|                       THE CASE MULTI-LAYER DISCIPLINE                         |
|                                                                               |
|   Layer 4: Fleet Scale      --> Engineering Ops    (Decision error budgets)   |
|   Layer 3: Human-Agent Team --> Cybernetics        (Requisite variety limits) |
|   Layer 2: Multi-Agent Hub  --> Complex Systems    (Emergence / cascade dams) |
|   Layer 1: Single Agent     --> Control Theory     (Setpoint action bounds)   |
+-------------------------------------------------------------------------------+

Runtime Enforcement Primitives: To instantiate Layer 1 and Layer 2 defenses mechanically, Oswal & Cadeddu (Five Primitives for Governing Autonomous AI Agents at Runtime) establish that enterprise governance cannot occur build-time. They formalize five mandatory runtime primitives:

1. Discovery: Dynamic registration of ephemeral agent instances.
2. Identity: Workload-level SPIFFE/cryptographic credentialing distinct from human user tokens.
3. Governance: In-line, fail-closed mediation checking tool calls against a strict per-tenant action vocabulary.
4. Attestation: Hash-linked, tamper-evident action ledgers independently verifiable without vendor participation.
5. Supply Chain: Continuous lineage tracking over dynamic prompt templates and tool schemas. [5]

The Incoherence Warning: Critically, Hägele et al. (The Hot Mess of AI, ICLR 2026) prove via bias-variance error decomposition that as frontier reasoning models tackle longer multi-step chains, failures become increasingly dominated by error-incoherence (high-variance random erratic actions) rather than systematic goal-directed scheming. Deployments do not face an omniscient adversary; they face an unpredictable, high-speed industrial hazard. Enterprise guardrails must be designed for containment against stochastic chaos rather than debating model intentionality. [9]

Recommended Enterprise Deployment Gate:

• Mandate fail-closed sidecar mediation on every tool dispatch; if the policy engine or attestation ledger stalls, the agent execution must immediately halt.
• Implement interaction dampening: limit synchronous agent-to-agent delegative depth to prevent uncontrolled informational cascades across enterprise databases.

---

3. Policy & Compute Governance

Compute export verification moves to near-term physical reality as regulatory consultation clocks wind down.

AI Chip Export Verification (Avellar & Grunewald): While compute policy debates often remain speculative, Avellar & Grunewald (Near-Term Verification Methods for AI Chip Exports, arXiv:2609.07637) formulate an actionable, near-term (12-month implementation horizon) verification manual for the U.S. Bureau of Industry and Security (BIS). Addressing severe staffing constraints, the framework divides compliance into three enforceable tiers:

• End-Location Verification: Ensuring advanced accelerator clusters remain within authorized geographical facilities via hardware-rooted cryptographic location telemetry, tamper-evident physical chassis sensors, and third-party facility audits.
• End-User Verification: Validating that legitimate corporate entities control workload dispatch, preventing shell-company leasing via verifiable customer-identity protocols across commercial Infrastructure-as-a-Service (IaaS) providers.
• End-Use Verification: Auditing compute workloads against prohibited national-security and frontier training applications using power-draw profiling, inter-chip communication bandwidth monitoring, and checkpoint hash audits. [7]

Policy implication: This work operationalizes export controls from blunt sales bans into active, verifiable compute-accounting regimes that enterprise cloud operators must integrate into their compliance roadmaps.

NIST Consultation Countdown (14 Days Remaining): The formal public comment period for NIST’s **AI 200-2 (TEVV-Athlon: A Framework for Evaluating AI Systems) closes on October 6, 2026**. Organizations with agentic deployments should submit evidence addressing the structural limitations of reactive human oversight and the necessity of action-boundary verification. Submissions must be directed to TEVV-Athlon@nist.gov referencing "NIST AI 200-2". [8]

EU AI Omnibus Tracking: Following the July 27, 2026 entry into force of Regulation (EU) 2026/1744, legal teams must maintain strict distinction between delayed compliance obligations (Annex III high-risk systems deferred to December 2, 2027; Annex I embedded products deferred to August 2, 2028) and immediately enforceable provisions. Mandatory transparency requirements, prohibitions on