On this page
A model rationale is not authorization. EBTE turns relevant content into bounded claims that the server can verify before any tool effect proceeds.
Research status: Preprint. Original research date: 2026-07-28.
Authors: Genliang Zhu, Chu Wang.
Overview
Tool-using agents often pair a structured call with a free-form explanation. That explanation may sound convincing while naming the wrong tool, omitting an external destination, understating risk, relying on untrusted content, or referring to stale evidence.
Explanation-Bound Tool Execution treats the explanation as an untrusted claim set. The server compares its typed claims with the current intent certificate, canonical tool metadata, payload, policy, authorized route, context-risk state, and evidence digests. Contradictions deny; incomplete or uncertain evidence routes to non-executing review; only matching claims remain eligible for the downstream effect controls.
Core contributions
Action-claim abstraction
Separates persuasive rationale prose from a bounded ToolInvocationExplanation whose enforceable fields are independently checked against authoritative application state.
Non-widening composition
Defines a three-outcome allow, review, and deny lattice in which baseline authorization, EBTE, and effect controls combine by the most restrictive result.
Executable reference profile
Provides a strict schema, stable reason taxonomy, reference verifier, minimized audit projection, conformance profile, and cross-artifact integrity checks.
Tiered mechanism evidence
Evaluates authored conformance and metamorphic checks, a draft-only runtime integration, a frozen hosted-model record, and an AgentDojo-derived semantic adaptation.
Evidence and scope
This is an arXiv preprint. The evidence establishes conformance for the authored profile and feasibility in the evaluated draft-bound settings; it does not establish production safety. The draft-only integration does not exercise the later approval-to-execution transition, the hosted-model record is exploratory and frozen, the AgentDojo adaptation is diagnostic, and the guarantees depend on correct server facts and complete mediation. The internal evaluation artifact is not distributed with the manuscript.
