• Agent governance infrastructure reaches production maturity — Deontic runtime policies (AgenticRei), multi-principal memory governance (GateMem), and privilege-aware tool control form a complete enterprise governance stack beyond simple permit/prohibit
• Tool programs become first-class agent interface — ToolPro reduces end-to-end latency 53.4% by folding multi-step workflows into executable WebAssembly programs, extending the HyperTool lineage at ICML 2026
• Quality signaling enters multi-agent trust architecture — ASP introduces machine-readable certainty/grounding/stochasticity headers, enabling controllers to distinguish repairable from containment failures
METHOD: Formalizes agent governance beyond permit/prohibit — introduces obligations (mandatory post-action notifications), dispensations (conditional obligation waivers), meta-policy conflict resolution, and ontological reasoning over domain hierarchies. Policies expressed in OWL, evaluated at runtime by a logic engine entirely outside the LLM. Same pipeline governs tool invocations AND agent-to-agent messages. Composes with A2AS.
KEY RESULT: Current production engines (XACML, Rego, Cedar) cover only permit/prohibit — they cannot express "if you access PII, you MUST notify the CISO within 30 seconds" or "this obligation is waived when the data subject has explicitly consented." AgenticRei captures all of these.
🎓 SO WHAT FOR ANDY: This is THE governance primitive for APRA CPS 230 agent deployment. Banking agents that access customer data, execute trades, or modify risk models need obligation lifecycle management that survives model updates, prompt injection, and multi-agent coordination. The outside-LLM architecture means governance decisions are auditable and cannot be jailbroken.
METHOD: First benchmark for memory agents under multi-user governance. 4 domains (medical, office, education, household), long-form multi-party episodes, incremental memory injection, hidden checkpoints. Jointly evaluates utility, access control, and active forgetting.
KEY RESULT: No method simultaneously achieves strong utility, robust access control, and reliable forgetting. Long-context prompting yields best governance but at high token cost. Retrieval-based and external-memory methods reduce cost but leak unauthorized or deleted information.
🎓 SO WHAT FOR ANDY: Banking shared AI assistants — serving retail, wealth, and compliance teams from one agent — are a governance nightmare if memory can't be compartmentalized. GateMem proves the nightmare is real and provides the diagnostic tool. APRA CPS 230: "do you know what data each principal's queries can access from shared memory?"
METHOD: Replaces static REST endpoints with executable tool programs that compactly encode multi-step workflows (loops, conditionals, joins, retries). Constraint-guided construction, effect-aware replay for exactly-once semantics, profile-driven execution policy. MCP-style + WebAssembly sandboxing.
KEY RESULT: 53.4% end-to-end latency reduction, 96.1% client-side traffic reduction. Gains increase with network latency and workflow complexity. The interface abstraction drives the gain — not model scale.
🎓 SO WHAT FOR ANDY: HyperTool's successor — where HyperTool folded workflows into model-visible code blocks, ToolPro makes them executable at the service layer. Banking: reduce context consumption, eliminate round-trip latency for compliance checks, make multi-step regulatory workflows auditable as atomic programs.
Agent Governance Stack Maturation (arc #20 — NEW): AgenticRei (runtime deontic policies) + GateMem (memory governance) + Over-Privileged Tools (tool permission control) + ASP (trust signaling headers). Four papers converge: production agent governance requires infrastructure outside the LLM. Extends Production Agent Reliability Engineering (arc #12) from monitoring to enforcement.
Tool Interface Evolution: ToolPro continues HyperTool (Jun 12) → LedgerAgent (Jun 19) lineage. Each generation moves agent workflow logic from conversational turns into structured, verifiable, executable primitives. ICML 2026 acceptance signals academic validation.
The Great Shift, Day 19 (arc #2, Jun 4–22): Finding cracks → Building infrastructure → Proving things → Operating safely → Reading internal state → Auditing memory → Discovering auditor's tools crack → Building enforcement boundaries → Discovering infrastructure IS failure mode → Building smarter training → Governance stack with teeth.
World Models Lack a Persistent State Core (WRBench, 2606.20545): 9,600 videos, 23 models, 4 paradigms — ALL current world models behave like "tracking shots": objects freeze when unobserved, events never advance independently. Scale, cleaner imagery, and richer geometric priors don't fix it. Physical state kernel must become first-class design objective.
FP4 Shrinkage Bias (2606.20381): Geometric origin of FP4 training instability discovered — E2M1 asymmetric bins cause systematic negative rounding error amplified by RHT. Uniform 4-bit grids eliminate it. Tested on 1.5B dense, 7.9B MoE, 124B MoE. Hardware design implication: future accelerators should natively support uniform 4-bit grids.
Over-Privileged Tools (2606.20023) — Yang, Bu et al. Agents routinely select high-privilege tools when lower-privilege alternatives suffice. Privilege-aware post-training defense substantially reduces unnecessary escalation while preserving capabilities. Banking: least-privilege tool governance. 17/20
Argent Signaling Protocol (2606.19356) — Anantha Sharma. Machine-readable @C(certainty)/@G(grounding)/@S(stochasticity) headers on every LLM response. Multi-agent sidecar blocks 100% of ungrounded upstream outputs. Distinguishes repairable from containment failures. 17/20
ACUTE Confidence Protocol (2606.07822) — Subramani, Goyal et al., ICML 2026. Activation-based confidence estimation outperforms baselines on EURO metric. Tested on QA, tool-calling, summarization across 6 models. Banking: calibrated confidence for regulatory AI decisions. 17/20
ARGUS GPU Cluster Tracing (2606.20374) — Zhou, Zeng et al. 10,000+ GPU production tracing: <2% overhead, 3,700× compression, 6-month deployment. Diagnoses compute stragglers, link degradation, FlashAttention JIT stalls. OS/kernel adjacent. 16/20
Predictability as Privacy (2606.20546) — Lu, Sridharan. New privacy framework measuring incremental attacker gain beyond compromised data. Complementary to differential privacy. GMM-based asymptotic analysis + ERM perturbation scheme. 15/20
Agent Governance Stack: This week opens with four governance primitives arriving simultaneously — runtime enforcement + memory compartmentalization + tool permission + quality signaling = production-grade agent control plane.
The Great Shift, Day 19: From "finding cracks" (May 23–Jun 3) through "building infrastructure" (Jun 4–13) to "governance with enforcement" (Jun 19–22). Production reliability stack now spans 9 dimensions.
ICML 2026 Pipeline: ToolPro, ACUTE both accepted. Expect more ICML-quality work this week as conference deadline pipeline clears.