Agent Reliability · Runtime Verification

When the agent says done,
check the state.

On a structured airline benchmark, 78% of a budget agent's failures were tasks the agent reported as complete. The tools agreed. The database disagreed. A set of four deterministic read-only checks before each tool call recovered most of those failures without touching the model, the prompt, or the reasoning chain.

Core concept
Silent wrong-state write: an agent completes a task, tools accept the action, but the resulting state violates a policy that no component in the loop was checking.

First surfaced in Tandemly Briefing — 2026-07-09.

scroll to explore

The tool said yes.
The state said no.

When an LLM agent calls a tool, most systems treat tool acceptance as task completion. Those are two different things, and a large fraction of agents failures live in the gap.

Most agent architectures treat tool calls as the terminal action in a task. The agent reasons, selects an action, and the tool executes it. If the tool doesn't return an error, the task is done. The agent moves on, logs a success, and the next task begins.

That assumption breaks in domains where the policies governing an action live outside the tool's own enforcement logic. An airline booking API might accept a seat change without checking whether that change violates a fare rule stored in a separate policy database. A customer account tool might complete a refund request without verifying that the ticket meets eligibility conditions the tool wasn't designed to enforce. The API returns success. The downstream system is in a state that shouldn't exist.

This is the failure mode Reddy, Challaram, and Basu call a silent wrong-state write: the agent considers itself done, the tool confirms the action, and the resulting state violates a constraint none of the components in the loop were tracking. The failure is invisible without a dedicated check, and the agent's self-report is useless for detecting it.

The question this paper asks

If the dominant failure mode in a structured agent benchmark is silent wrong-state writes, not reasoning errors or tool rejections, can adding deterministic read-only verification before each tool call recover those failures without modifying the model or prompt?

Four gates,
zero model changes.

The researchers built a deterministic pre-execution layer that intercepts agent tool calls before any state change occurs and verifies them against the policies the tools themselves don't enforce.

The benchmark is tau-squared bench (tau-bench), a structured evaluation for LLM agents performing customer service tasks in an airline domain. Tasks involve booking changes, seat modifications, refunds, and related actions. Each task has a defined correct end state that can be verified programmatically, which makes it possible to detect silent failures that the agent itself doesn't surface.

The researchers first characterized the failure distribution. For a budget agent on tau-bench's airline domain, they found that 78% of all failures were silent wrong-state writes: the agent finished the task, no tool raised an error, and the resulting state violated a business policy. That number is high enough to reframe where the optimization effort belongs. If most of the failures aren't reasoning failures, then improving reasoning isn't the lever.

The four gates map to the four policy categories they found most frequently violated. Each gate is deterministic and read-only: it queries current system state via the tool's own read API, applies a rule, and either clears the pending action or blocks it with a specific reason code.

1
Eligibility gate
Checks whether the customer and ticket qualify for the requested action at all: tier requirements, booking class rules, time-since-purchase constraints. Reads customer and ticket records before any write occurs.
2
Consistency gate
Verifies that the requested state doesn't contradict existing bookings or reservations. A seat change that creates a double-booking, a fare combination that violates itinerary rules. These are logical contradictions the write tool won't detect.
3
Limit gate
Confirms the action stays within allowed thresholds: refund amount caps, number of changes permitted per booking period, upgrade allotments. Reads accumulated state across sessions rather than just the current request.
4
Sequence gate
Enforces ordering constraints: actions that require prerequisites to have completed first. A check-in modification that's only valid after seat assignment has been confirmed, or a refund that can only be issued after cancellation is on record.
The architectural move

The gates are entirely outside the model's reasoning loop. The agent reasons the same way it always did. The gates intercept between the agent's tool selection and the actual tool execution. No prompt changes, no fine-tuning, no added reasoning steps. The verification is a separate layer that runs before state changes land.

The paper also ran negative controls: tasks where the tools themselves already enforced the same constraints the gates check. On those tasks, adding gates produced no improvement. This rules out the gates acting as a general-purpose accuracy boost and confirms they're filling a specific structural gap.

The agent thought
it was done.

The headline number isn't the performance gain. It's the 78%. Nearly four in five of a budget agent's failures were tasks the agent reported as complete, with no tool error to indicate otherwise.

Silent failure share
78%
of failures were silent wrong-state writes on budget agent / tau-bench airline
gpt-4o-mini lift
+12.4
pp, 29.6% to 42.0%, P=0.0012
gpt-5.2 lift
+10.4
pp, 61.2% to 71.6%
Standard agent architecture
Tool acceptance = task completion. Agent reasons, selects action, tool executes. No error means success. Most failures look like reasoning failures from the outside, and the fix is better prompting or a smarter model.
What the data showed
Most failures were state failures. Tool accepted the action. Agent logged success. The resulting state violated a business rule no component was tracking. Better reasoning would not have fixed these.
Why the negative controls matter

On tasks where the tools already enforced the policies internally ("policy-permissive" tools in the paper's terminology), adding the four gates produced no meaningful improvement. This is a clean negative control: if gates were a general accuracy booster, they'd have helped on those tasks too. They didn't. The improvement on policy-permissive tasks was noise-level. This is evidence of a real causal structure, not an instrumentation artifact.

The statistical significance on gpt-4o-mini (P=0.0012) holds up under this reading. The gates are fixing something specific, not inflating the score globally.

Scope and limitations

tau-bench is a structured domain with measurable end states, which is what makes it possible to detect silent failures programmatically and define gates with precision. The paper doesn't claim this generalizes to open-ended tasks where "correct state" is ambiguous or where policies can't be expressed as deterministic rules. The gate definitions also require domain knowledge: someone has to identify which policies the tools aren't enforcing internally before the gates can be written.

Check what
the tool left behind.

The framing shift this paper asks for: stop treating tool acceptance as task completion and start treating it as one check in a chain. The other check is whether the resulting state is valid.

1
For agent builders
Audit your tool surface for policy gaps before building gates. For each write operation your agent performs, ask: does this tool enforce all the policies that should govern this action? If not, list the unenfirced rules. Those are your gate candidates. The audit itself is valuable even if you don't build gates yet; it tells you where your silent failure risk lives.
2
For teams evaluating agent performance
Run a silent-failure check before trusting your current accuracy numbers. Sample completed tasks, verify the resulting state against the policies the agent is supposed to follow, and measure what fraction the agent considered successful but left the system in a policy-violating state. The number may be higher than you expect, and it won't show up in standard task-completion metrics.
3
For teams already using runtime safety layers
Distinguish this approach from AgentTrust-style runtime interception. The gates here are state-validity checks: is the post-action state legal? AgentTrust and similar systems focus on the nature of the action itself: is this a malicious command, an injection, a policy-forbidden operation? These are complementary, not overlapping. A system can pass a safety check and still produce a silently wrong state.
4
On logging and trust
The paper's recommendation is to log gate fire rates and false-positive rates on benign traces before trusting the performance lift in production. A gate that fires 0% of the time might not be catching what it should. A gate that fires 20% of the time on normal workloads might be blocking legitimate actions. The fire rate is a diagnostic signal, not just a compliance metric.

Where to go
from here.

If you want to apply this pattern or go deeper on the research.

1
Read the paper
Reddy, V., Challaram, S.R., & Basu, A. (2026). Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents. arXiv:2607.07405.
2
Run the silent-failure audit on a production agent
Sample 50 to 100 completed tasks from a live agent. Verify the resulting state against each policy the agent is supposed to enforce. Record which tasks the agent rated as successful but left the system in an invalid state. This number is the baseline the gates are measured against.
3
Map your tool surface for policy gaps
For each write-capable tool in your agent's toolkit, list the policies that should govern its output and check whether the tool enforces them internally. Any policy that lives outside the tool is a gap where a gate could help. Sort by frequency: the most-called tools with the most external policies are the highest-leverage candidates.
4
Prototype one gate before building the suite
Pick the single highest-risk policy gap and add a read-only pre-execution check. Log the gate's fire rate over one week in a staging environment. Check for false positives on benign traces. Measure the task success delta on a held-out eval slice. Validate the pattern works for your domain before scaling to four gates.
5
Explore tau-bench for structured agent evaluation
The benchmark the paper uses (tau-bench and its airline domain) is publicly available for research use. Its structure of measurable end states and explicit policy rules makes it a useful reference for teams designing similar evaluations in their own domains. The design principle of a programmatically verifiable "correct state" is transferable even when the specific domain isn't.