The Missing Guardrail in Evidence-Producing Agentic Systems

Abstract

Agentic Engineering's Missing Guardrail: Prospective Commitment Control Agentic systems differ from the conversational models most people use daily in one respect that matters here: they act. A chatbot answers and stops. An agent plans across steps, calls tools, queries databases, executes code, and emits artifacts that other people rely on — results tables, evaluation reports, benchmark comparisons, compliance findings. When those artifacts become evidence, supporting claims made to reviewers, regulators, funders, or customers, the reliability question changes shape. It is no longer only whether the system generated something false. It is whether the claim the artifact supports was constrained before anyone knew which way it would come out. The four controls and the interval they leave open Commonly recommended controls for keeping autonomous agents reliable cluster into four: ground the agent in real sources of truth, give it tools that verify rather than generate, draw explicit scope boundaries, and keep a human in the approval path. These reduce important classes of model and action error, and any serious deployment should have all four. Note when each one binds. Grounding acts before generation. Tool verification acts during it. Scope boundaries act on both. Human approval acts at the moment output is handed over. All four bind at or before the instant a result comes into existence. The interval that follows — after a result exists, before a claim is made about it — is not structurally constrained by these controls. For most agentic applications that gap costs nothing. It matters for a narrower class: evidence-producing systems. Scientific and benchmarking pipelines. Compliance and assurance evaluations. Any system whose outputs support externally stated claims or consequential decisions. In that class, the interval is where the claim is actually made, and it is unguarded. The failure mode An agent runs an analysis. The result is unfavorable, or ambiguous, or just short of a threshold. Someone looks at it. A judgment call that was genuinely open beforehand now has a visible answer attached, and the judgment tilts. The threshold gets revisited, with real arguments. A run gets repeated with a defensible modification. A result registered as exploratory gets described as evidence. No step here is a hallucination. Every step may be grounded, tool-verified, in-scope, and human-approved. The conclusion is still unsupported, because the decision procedure was selected after its outcome was visible. None of this is a new observation. Undisclosed analytic flexibility inflating false-positive rates (Simmons, Nelson & Simonsohn, 2011), data-dependent decisions creating implicit multiple comparisons without any conscious fishing (Gelman & Loken, 2014), post hoc hypotheses presented as a priori ones (Kerr, 1998), and prospective specification as the response to all three (Nosek et al., 2018) are long established in empirical methodology. The phenomenon is old. What is new is the delivery vehicle, and the fact that the standard agentic control set contains nothing that addresses it. It is worth separating three things that are frequently conflated: Provenance records what happened. Auditability allows what happened to be inspected later. Commitment control restricts what may be changed, promoted, rerun, or claimed once an outcome becomes visible. Agentic systems are increasingly good at the first two. Neither prevents the third failure. A complete and honest log of a retrospectively reinterpreted analysis is a complete and honest log of a retrospectively reinterpreted analysis. Why agentic systems amplify it Two properties act directly on this failure mode. The marginal cost and friction of reruns collapse. The historical brake on outcome-driven reanalysis was effort: redoing a study meant weeks. When a pipeline re-executes with a modified parameter in ninety seconds, the number of analyses that could have been run expands sharply, and the ones reported stop being a meaningful sample of them. Justification is generated on demand, fluently. The training dynamics that make models sound confident about facts make them sound equally confident about methodological choices. Ask an agent to justify moving a threshold and a competent-sounding rationale is what the objective rewards. The agent is not lying; it is completing toward plausibility, and what is being made plausible is a decision that should have been fixed in advance. Human approval is the control usually invoked here, and in its ordinary form it does not close the gap. Outcome-aware approval by an interested operator is not an independent check: for any decision downstream of a visible result, the approver is the party with the stake in how that result reads. This is a claim about a configuration, not about human oversight generally. Review that is independent, blinded to the outcome, procedurally constrained, or separated from the interested party can provide meaningful protection. The default configuration — the operator who wanted the result approving the analysis that produced it — cannot. Prospective commitment control Prospective commitment control is the class of constraints that (i) fix methods, evidentiary roles, and release conditions before the relevant outcomes are visible; (ii) bind those decisions to a tamper-evident record; and (iii) are enforced structurally after execution, such that outcome-conditioned discretion, by agents and by operators alike, cannot alter what a completed attempt is permitted to establish. The contribution proposed here is not the underlying principle. It is a systems-level translation of prospective commitment principles into autonomous and human–agent pipelines: machine-enforceable evidentiary roles, sealed execution records, authorization boundaries, abstention as a terminal state, and controlled replacement runs. One principle governs the whole class and is easily misread. Commitment control does not prohibit revising a flawed method. It prohibits applying the revision retroactively to the evidentiary status of the completed attempt. A revised method begins a new, prospectively registered attempt. Likewise, an exploratory result may motivate a future confirmatory analysis; it may not be promoted to determinative evidence within the record that produced it. Operational primitives Prospective role assignment. Before outcomes are evaluated, register what each comparison is permitted to establish — determinative, sensitivity, diagnostic, exploratory — and bind the role to the frozen record. Roles may be demoted afterward, never promoted. Results-blind method finalization. Freeze the analysis specification while results remain sealed. If a method cannot be fully specified without seeing outcomes, that is information about the method. Sealed inputs. Hash-lock methods, data, and execution code together. The purpose is tamper-evidence against yourself, not resistance to adversaries: a changed input should become visible rather than silent. Atomic or fail-closed release of the determinative claim. The determinative analysis runs once, under explicit authorization, and either releases a complete determinative result or releases none. This constrains the claim, not the record: operational diagnostics, failure records, logs, and non-determinative partial evidence should still be preserved and exposed. They must be labeled non-determinative and must not silently become the surviving favorable portion of the result — a partial release that is allowed to stand as the finding is a selection effect wearing a crash report's clothing. Abstention as a first-class terminal state. When a gate fails, the system must be able to return "no determination" and stop. Where the only available outcomes are supported and not yet supported, every failure becomes an invitation to iterate. Controlled retries and replacement runs. Continuation of the same authorized run is preferred where technically possible. Retries are permitted where a retry policy was declared prospectively. Replacement runs require separate authorization and explicit lineage. The prohibition is narrow and specific: an undisclosed fresh attempt, selected after viewing partial or unfavorable results. Preservation of unfavorable results. Negative and reversed findings remain in the record at full strength, in the same place as everything else. An illustrative implementation In a hardware topology comparison, the analysis methodology had to clear a family-wise error rate gate before it could be used at all. The methods qualification failed by well under a thousandth, on one arm of one comparison. The gate had been locked before execution. There was a reasonable argument for the slightly looser value, and no mechanism to make it, because authorization to adjudicate was bound to the sealed specification. The pipeline returned a stop-for-methods-revision state and produced no determination. The headline results from that project were substantially unflattering to the architecture under test. They entered the record unchanged, and two methodological confounds identified along the way proved more valuable than the architecture claim would have been. That was possible because accepting the result was cheap. Prospective commitment is not primarily an honesty mechanism; it is a mechanism for making honesty inexpensive at the moment it would otherwise be costly. This is an operational demonstration that the mechanism binds under conditions where discretion would otherwise be exercised. It is not evidence that the framework generalizes across domains, and a single implementation cannot establish efficacy. Implications The asymmetry is the reason this control class does not appear by default. The four standard controls constrain the machine. The fifth constrains the operator. Grounding an agent improves the system and costs the builder nothing personally.