Researchers have described a formal framework for controlling which tools a large language model agent can call, designed to block unauthorized actions even when an attacker manipulates the prompt.
In a preprint submitted October 22, Chao Gu and colleagues model the execution harness—the interface between an LLM and its environment—as a Petri net, a mathematical system in which marks represent capabilities, approvals and budgets. A tool call can fire only if all required marks are present, so a request whose preconditions are unmet or already consumed is refused regardless of its wording. The authors frame this as a supervisory control problem and apply the conventional maximally permissive supervisor to enforce safety constraints.
The paper introduces the concept of a “replanning closed loop,” in which the agent may propose a new action after the supervisor refuses one. Each retry costs an inference call. The authors show that in this loop the conventional supervisor can be “arbitrarily more intrusive”—refusing safe actions unnecessarily—compared to a stricter supervisor that blocks fewer legitimate proposals. For a given proposer model, they characterize the maximally permissive least-intrusive supervisor as a value-threshold refinement of the conventional one.
Applying the framework to an autonomous release agent, the authors report that synthesis identified a deployment step the supervisor can refuse after a rollout has started. The paper states that safety transfers to the running system under four assumptions and that under precise conditions the refinement orders two concurrent actions by at most one monitor place.
The 17-page preprint is an extended version of a paper the authors have submitted for publication. The arXiv record is https://arxiv.org/abs/2610.31376.