Stop Means Stop: New Paper Finds Agent Approval Gates and Cancellation Leak in Six Frameworks

Last updated: August 11, 2026

When your agent framework shows an approval prompt, the implied contract is simple: nothing gated happens until you say yes. A new paper on arXiv argues that contract is broken in every framework it tested.

"Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives" (arXiv 2607.14166) probes six widely used open-source LLM agent frameworks and finds the barrier semantics of their control primitives - human-in-the-loop approval gates, run cancellation, and execution timeouts - hold on none of them. A single-author study by Sajjad Khan, posted as v3 on August 8, it pairs the measurement with a mechanically verified external gate called SoundGate that blocks every measured violation.

What the probes found#

The paper distinguishes what framework documentation implies from what the runtime enforces. The implied contract: while a run is paused, cancelled, or timed out, no gated side effect executes. The measured reality: a recurring "sibling leak" in every framework that ships a pre-execution approval gate, which is five of the six, across four execution models and two language runtimes.

The sibling leak works like this. An approval gate suspends its own branch while the user decides. But a sibling effect in a parallel branch is not suspended with it. While the human is staring at the rejection prompt, the sibling's effect executes anyway, which defeats the rejection entirely.

The probes also confirmed three more failure classes:

• Replay double-execution: the same gated effect runs twice when a paused run is resumed or replayed
• Cancellation orphans: cancelling a run does not stop work that was already admitted elsewhere
• Timeout zombies: work keeps executing after the timeout fires

The hazard is reachable, not theoretical#

The paper's reachability numbers are the uncomfortable part. Frontier models emit the leak-triggering plan shape at rates up to 14 percent. When live models drove unmodified frameworks, 215 of 1,200 runs leaked, and the paper reports P(leak | emitted) = 1.00: once a model emitted the trigger shape, the leak happened every time.

The gap can also sit latent. On naturalistic tau-bench episodes, models tend to serialize writes, so the everyday failure is invisible until it is not. Injection induces the leak deterministically. A 13-incident public corpus of real-world agent incidents independently corroborates the replay and cancellation failures.

SoundGate: an external gate, not a framework patch#

The proposed repair is architectural. SoundGate is an environment-external Rust gate through which every side effect must be admitted, enforcing four properties under a stated complete-mediation contract: hold-until-decided, reject-cancels, dedup-on-replay, and fence-on-cancel. For network egress specifically, the contract is discharged by two kernel-enforced routes, which means the gate cannot be bypassed by the agent writing around it.

The admission core is mechanically verified with Verus, TLA+/TLC out to 7.5e7 states, TLAPS, and Loom on the deployed Rust. The gap between the verified model and the running code is bridged by differential conformance over 1.2e7 operations with zero divergences.

The performance numbers matter for real adoption: gated tau-bench episodes complete with zero refusals at about 1 ms per write, and durable admission sustains roughly 12,000 admissions per second. Under the stated contract, SoundGate blocks every measured violation on all six frameworks while releasing legitimate effects. It is on PyPI as pip install soundgate.

What this means for developers#

The paper connects to a pattern we have covered before: the approval prompt is only as good as the boundary it actually enforces. Our own approval fatigue analysis showed how repeated prompts stop protecting users; this paper shows the quieter failure where a single prompt does not protect the user at all, because a sibling branch executes while it is on screen.

Three practical takeaways:

• Do not assume the framework enforces what its docs promise. If the gate is implemented inside the agent loop, a parallel branch can sidestep it. The paper's differential probes are the model to copy: check what the runtime actually does, not what the API name implies.
• Replay is a security boundary, not an implementation detail. If your framework can double-execute a gated write on resume, idempotency keys at the effect layer are not optional. This mirrors the run-lifecycle advice in kill your agent runs early, applied to the resume path.
• Externalize the gate for anything destructive. The paper's key architectural claim is that the enforcement point must be outside the agent's own execution context. That is the same reasoning behind permission scopes in Claude Code and the agent security checklist for connecting tools to agents.

How this fits the research trend#

This paper sits alongside a growing body of work that treats agent runtime behavior as a systems problem rather than a model problem. AgentChaos showed fault injection at the HTTP layer degrades every system and that architecture, not model choice, decides robustness. The Agent4D benchmark measured runtime safety failures across agent scaffolds. Stop Means Stop supplies the control-primitive layer: even when the model behaves, the harness can leak.

The verified-gate angle is worth watching. Mechanically verified components with a stated complete-mediation contract are rare in the agent tooling space, and the differential-conformance bridge is exactly the kind of evidence that survives the "your benchmark is lying to you" critique. The cost profile (sub-millisecond per write) removes the usual performance excuse for shipping gates inside the loop.

FAQ#

What is the sibling leak in agent approval gates?#

An approval gate suspends its own branch while the user decides, but a side effect in a parallel sibling branch is not suspended with it. While the human is looking at the rejection prompt, the sibling's effect executes anyway, which defeats the rejection. The paper found it in every framework that ships a pre-execution approval gate, five of the six tested.

How often does the leak happen with real models?#

Frontier models emit the leak-triggering plan shape at rates up to 14 percent. When live models drove unmodified frameworks, 215 of 1,200 runs leaked, and once a model emitted the trigger shape the leak happened every time. On naturalistic tau-bench episodes models tend to serialize writes, so the gap can sit latent, while injection induces it deterministically.

What is SoundGate?#

SoundGate is an environment-external Rust gate through which every side effect must be admitted. It enforces hold-until-decided, reject-cancels, dedup-on-replay, and fence-on-cancel under a stated complete-mediation contract, and its admission core is mechanically verified. It runs at about 1 ms per write and, under that contract, blocks every measured violation on all six frameworks. It is published on PyPI.

How can developers protect against approval gate and cancellation failures?#

The post's takeaways: do not assume a framework enforces what its docs promise, and probe what the runtime actually does; treat replay as a security boundary and use idempotency keys at the effect layer so a resumed run cannot double-execute a gated write; and put the enforcement point for anything destructive outside the agent's own execution context.

Continue Reading#

• Approval Fatigue Is an Agent Security Bug - why repeated approval prompts stop protecting users
• Kill Your Agent Runs Early - run lifecycle discipline and why cancelling must actually cancel
• Agent4D: Runtime Safety as a Benchmark - measuring safety failures across agent scaffolds
• Agent Security Checklist Before Connecting Tools - what to check before an agent gets side effects
• Claude Code Permissions Settings Guide - how permission scopes and allowlists actually work
• The AutoGPT Playbook: Repo Gates for Agent PRs - how a 180k-star repo enforces template, test, and CLA gates against agent contributors

Sources#

• Paper abstract and versions: arXiv:2607.14166
• PDF: arXiv:2607.14166v3 PDF
• SoundGate on PyPI: pypi.org/project/soundgate