Intent-Bound Commit Certificates: A Formal Transaction Protocol for Safe Autonomous AI Tool Execution
Keywords:
Agentic artificial intelligence, Transaction safety, Idempotency, Formal verification, Access control, Distributed systemsAbstract
Autonomous artificial intelligence (AI) agents can initiate payments, modify records, and coordinate consequential application programming interfaces (APIs). Yet approved decisions may become unsafe when the external state changes, concurrent requests race, or acknowledgments disappear. This paper develops intent-bound commit certificates (IBCC), a transaction protocol that binds an action to authenticated authority, approved intent, canonical action identity, resource and policy versions, budget, expiry, and a stable idempotency key. A guarded state machine establishes conditional authorization, freshness, budget nonnegativity, and at-most-once effect application under explicit trust and atomicity assumptions. We distinguish this theorem from endpoint-level limitations and a retry indistinguishability result. The original deterministic synthetic testbench evaluates five enforcement configurations over 50,000 fault-injected episodes and six bounded two-client schedules; the full configuration records zero unsafe episodes and completes 37,758 eligible opportunities by construction of its modeled controls. To test implementation behavior independently of the abstract simulator, a new SQLite reference adapter was exercised in 12 integration tests, including eight-way duplicate-key and shared-budget races, tampering, policy changes, and fault-triggered rollback; all 12 tests passed, with one effect in the duplicate-key race and no budget overrun in the tested shared-budget race. The findings support a concrete single-database commit-boundary design, not a claim of production-wide or cross-service correctness.
References
1. Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K. R., & Cao, Y. (2023). ReAct: Synergizing reasoning and acting in language models. International Conference on Learning Representations. https://arxiv.org/abs/2210.03629
2. Schick, T., Dwivedi-Yu, J., Dessì, R., Raileanu, R., Lomeli, M., Hambro, E., Zettlemoyer, L., Cancedda, N., & Scialom, T. (2023). Toolformer: Language models can teach themselves to use tools. Advances in Neural Information Processing Systems, 36. https://arxiv.org/abs/2302.04761
3. Liu, X., Yu, H., Zhang, H., Xu, Y., Lei, X., Lai, H., Gu, Y., et al. (2024). AgentBench: Evaluating LLMs as agents. International Conference on Learning Representations.
4. Debenedetti, E., Zhang, J., Balunović, M., Beurer-Kellner, L., Fischer, M., & Tramèr, F. (2024). AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. Advances in Neural Information Processing Systems, 37. https://doi.org/10.52202/079017-2636
5. Zhan, Q., Liang, Z., Ying, Z., & Kang, D. (2024). InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. Findings of the Association for Computational Linguistics: ACL 2024, 10471–10506. https://doi.org/10.18653/v1/2024.findings-acl.624
6. Garcia-Molina, H., & Salem, K. (1987). Sagas. ACM SIGMOD Record, 16(3), 249–259.
https://doi.org/10.1145/38714.38742
7. Gray, J., & Lamport, L. (2006). Consensus on transaction commit. ACM Transactions on Database Systems, 31(1), 133–160. https://doi.org/10.1145/1132863.1132867
8. Featonby, M. (2021). Making retries safe with idempotent APIs. Amazon Builders’ Library. https://aws.amazon.com/builders-library/making-retries-safe-with-idempotent-APIs/
9. Abadi, D. J. (2012). Consistency tradeoffs in modern distributed database system design: CAP is only part of the story. Computer, 45(2), 37–42. https://doi.org/10.1109/MC.2012.33
10. TAN, K. H. (2026). Runtime assurance for enterprise agentic AI systems: A policy-gated control model with quantitative autonomy-risk scoring. World Journal of Advanced Research and Reviews, 31(1), 512–522. https://doi.org/10.30574/wjarr.2026.31.1.1872
11. Saltzer, J. H., & Schroeder, M. D. (1975). The protection of information in computer systems. Proceedings of the IEEE, 63(9), 1278–1308. https://doi.org/10.1109/PROC.1975.9939
12. Necula, G. C. (1997). Proof-carrying code. Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, 106–119.
https://doi.org/10.1145/263699.263712
13. Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0). NIST AI 100-1. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
14. Tan, K. H. (2026). The governance half-life of agentic artificial intelligence controls: A dynamic assurance framework for control decay, residual risk, and revalidation. International Journal of Web of Multidisciplinary Studies, 3(7), 217–229. https://doi.org/10.71366/ijwos03072654084
15. Tan, K. H. (2026). The coordination compression trap: A dynamic model of AI-enabled productivity, verification debt, and organisational resilience in global knowledge firms. Journal of Global Economics, Management and Business Research, 18(3), 256–278.
https://doi.org/10.56557/jgembr/2026/v18i310956
16. Tan, K. H. (2026). Governance-aware agentic AI for enterprise engineering systems: A design-science reference architecture and quantitative risk-control model. International Journal of Science Engineering and Technology, 14(3). https://doi.org/10.5281/zenodo.21264295
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Author(s)
This work is licensed under a Creative Commons Attribution 4.0 International License.
Articles published in the Journal of Advanced Multidisciplinary Studies (JAMS) are licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0), unless otherwise stated. Authors retain copyright of their work and grant JAMS the right of first publication.
