Your Agent Has a Five-Constraint Budget

Back in May, we wrote about constraint decay: coding agents that aced a loose backend task and then fell apart when architecture, database, and ORM constraints piled up (constraint-decay-ai-coding-agents). Our conclusion then was measured but coarse - more constraints, worse results, and no amount of prompt elbow grease seemed to fix it. In July, we went further and argued the fix for research agents was an explicit constraint ledger that survives outside the chat transcript (deep-research-agents-need-constraint-ledgers).

That was a thesis in search of a curve. This month, the curve arrived, and it is worse than we argued - and the fix is more specific than we proposed. Here is the sentence to remember: the strongest model tested satisfies eight simultaneous constraints about 5.7 percent of the time. The same model satisfies each individual one of those constraints about 41 percent of the time. The failure is nearly multiplicative, it is measured with zero LLM judges, and it is not a capability problem in the sense we are used to. It is a budget problem. Your agent has a five-constraint budget, and the rest of this month's evidence says the constraints you care about most are also the ones most likely to die in transit - compaction, handoffs, and compliance gates.

The phase transition#

The instrument is Constraint Saturation Evaluation (CSE), a procedurally generated benchmark from a single author, with numbers so clean they deserve the attention (arXiv:2608.12426). CSE varies the number of simultaneous constraints k from 1 to 12, with 36 constraint types and every constraint scored by a deterministic, rule-based verifier - no LLM judges anywhere in the loop. In total: 15 models, 369,753 checks.

Three findings matter. First, the shape is a phase transition, not a slope. Per-constraint pass rate decays gradually and predictably, but meeting all k at once collapses. The ~41 percent per constraint at k=8 becomes 5.7 percent for all eight - and the failures are nearly independent, which is exactly why the collapse is multiplicative. If each constraint fails independently, eight constraints at 70 percent each is 5.7 percent all-eight; your busy prompt was never going to survive arithmetic.

Second, not all constraints weigh the same. Structural constraints - the ones that require sustained tracking, "keep the schema consistent with the migration file" - lose 2x more baseline capability per added constraint than lexical ones. The residual coupling that exists tracks shared output features: a wrong sentence count fails every constraint that reads it. Composition is not additive failure; it is correlated, compounding failure.

Third, the cliff is closer than you think. Reliable instruction following breaks below 50 percent probe-level success at 7 constraints for the strongest model in the set, and at 3 or fewer for 12 of the 15. Think about that for a second. Twelve of fifteen models - including presumably the ones your company runs - cannot hold three simultaneous requirements at better than a coin flip. A production prompt with "must return valid JSON, must respect the retention policy, must not call the billing endpoint" is already at the edge of the cliff for most of the market.

The loss schedule: constraints die in compaction and handoff, not just in your prompt#

The CSE curve is the front end of the story. The back end is where durable constraints - the "do not" rules that are supposed to govern a whole session - quietly stop existing.

COMPINT measured what context compaction does to session constraints: "do not delete any emails until I confirm" type instructions issued once, meant to bind the rest of the session (arXiv:2608.11242). Across multi-turn chat, agentic trajectories, and long-horizon research, current compactors retain only 17 percent of injected session constraints on average, and most compactors do worse than running the same task without compaction at all. The loss is systematic - retention varies sharply with compactor, prompt, context length, phrasing, and injection location - and it is invisible. Nothing errors. The constraint just stops being in force.

A week later, the handoff paper closed the loop at the other end of the context lifecycle (arXiv:2608.24569). In multi-role, multi-stage workflows, action-constraining state gets transformed into intermediate artifacts - summaries, plans, tickets, memories, handoff notes - and downstream components act on the artifact, not the source. Across 1,296 controlled synthetic episodes with correct upstream identification: direct handoff preserves every blocker, while normal handoff compression produces 100.0 percent deactivation of binding action-constraining state and 54.2 percent forbidden action. The artifact still mentions the condition. It just demotes it from "must be resolved before execution" to "may inform the next action." Semantic availability does not guarantee operational preservation - a sentence the paper earns.

These two results are the constraint thesis's "constraints die twice" shape: CSE prices the simultaneous budget at the moment of instruction, COMPINT and the handoff work price the durability budget over time. Between them, a policy that lives only in the token stream is dead on arrival at both ends - over-constrained at the start, eroded everywhere after.

We are not even counting the governance instrument, though it belongs in the same ledger: HANDBOOK.md, 65 agentic tasks governed by 20-to-124-page standard operating procedures with 824 deterministic grading criteria, found the best of thirty model configurations passes 36.2 percent of trials under strict grading, with most frontier models below 25 percent - and agents "report compliance they did not achieve" (arXiv:2607.25398). That is the all-k bar applied to standing policy, and it fails the same multiplicative way.

The security price tag#

Here is where the budget stops being an ergonomics nicety and becomes a control: AI-generated infrastructure as code. The Ansible study evaluated 16 AI models generating 278 Ansible roles for Apache Tomcat v10 and MongoDB v7, audited against CIS benchmarks (arXiv:2608.24962). Without security guidance, all 16 models produced security smells - vulnerable infrastructure that fails compliance verification and underperforms human-written roles.

Then the authors wrapped best practices and CIS benchmarks into the prompts through an extended CO-STAR framework - structured constraint framing, not bigger models. Four of 16 models produced compliant code, the leading model at 95-100 percent CIS compliance, roughly 4x the human-written baseline of 23-43 percent, with overall code quality up 19-49 percent. The other 12 failed. The paper's own diagnosis is the thesis in one sentence: "The remaining 12 models fail not because they cannot generate code but because they cannot follow instructions with multiple constraints."

That is the whole argument of this post wearing a security hat. The constraint budget is not a prompt-craft aesthetic. It is the difference between generated infrastructure that fails 16 out of 16 times and generated infrastructure that passes 95-100 percent of CIS checks - for the models inside the budget. Everyone else regresses to generation instead of compliance, and in IaC that regression ships as infrastructure.

The fix: side channels, not longer prompts#

The good news is that this month's failure wave shipped its own remedies, and they are all architectural - which we argued in August is the only kind that reproduces (the-response-looked-right-is-not-completion, your-benchmark-is-lying-to-you).

First, the simultaneous budget is a design rule, and it is cheap: split asks that need more than 5-6 simultaneous constraints into staged prompts, or better, turn the load-bearing constraints into executable checks. The Ansible result shows the split direction works - structured framing of a bounded constraint set moved 4 of 16 models from failing to compliant. CSE's own implication is that beyond the compositional cliff, prompt engineering stops mattering and the constraint belongs in a verifier.

Second, durable constraints need a bypass lane that survives compaction. COMPINT's fix is a plug-and-play SC-aware extractor that runs alongside the compactor - not a better compactor - and reaches 90 percent-plus retention across all three scenarios with no model change. The constraint-carrying channel is a separate artifact, checked at admission, not a line in a summary that a later compaction pass will eat.

Third, handoff state needs the four action-binding fields carried explicitly: prerequisite, authority, fallback, and execution consequence. The handoff paper's numbers are stark - restoring all four fields raises preservation to 100.0 percent and removes forbidden action entirely, while downstream verification alone eliminates forbidden action even though artifact deactivation stays at 95.3 percent. Verification and preservation are separate concerns with separate mechanisms, and both are cheaper than a better summarizer.

This is exactly what we asked for in July: a constraint ledger for agent runs. The July argument was a design sketch; it is now an empirical spec. In our developing long-range scenario, durable instructions leave the token stream entirely - executable side channels for policy, staged prompts for the simultaneous budget - as one of the load-bearing planks of late 2027, and this week's wave is the strongest evidence it has.

The bet#

Here is what we think is happening, stated as a graded bet. By the end of 2027, engineering guidance for agent instructions will standardize on a small simultaneous-constraint budget - call it 5-6, that is the CSE measurement, not a law - with durable session-scoped constraints held in executable, checkable artifacts: verifier gates, constraint ledgers, side-channel extractors. "How many simultaneous constraints is this prompt carrying?" will become a normal question in agent code review, the way "is this authenticated" is today. And agent products will surface their own constraint accounting the way they already surface token usage.

What proves us wrong, specifically: the models train their way out of the cliff (rubric-dropout shows partial training-side mitigation exists, so compositional robustness is not impossible); CSE fails to reproduce independently (it is one author, one benchmark wave, no replication yet); or a vendor ships a "handles unlimited constraints" claim that holds up under an independent all-k measurement. Watch the last one - it is the marketing move the market will attempt, and the phase transition says it cannot work with current training.

The counter-case deserves its steel. CSE is new and single-lab; benchmark constraint bars are harsher than most production asks; the 5-6 number is a snapshot of current models, not a law of nature; COMPINT is one lab and one language; and the Ansible result's stars (4 of 16 models responded to structured framing) is a capability-matched outcome, which means the budget is partly a model-eligibility rule. None of this argues the opposite conclusion - every objection is to the precision of the number, not to the shape of the curve. The curve is the thing that will survive replication.

What developers should do#

1. Count the constraints. Go read the prompts in your agent configs and count the simultaneous requirements. If you are past six - and most real prompts are past six in the first paragraph - split the ask into staged prompts or move the load-bearing requirements into checks. This is a ten-minute audit that CSE says is the difference between 41 percent and 5.7 percent.

2. Never let a "do not" rule live only in prose. Session-scoped constraints go in a side-channel artifact - a constraint ledger, a checkable file, an extractor lane - verifier-gated at admission and re-checked at handoff, because compaction will eat the prose version 83 percent of the time.

3. Carry the four fields across handoffs. When an agent's state moves to a subagent, a ticket, a plan, or a memory, the constraint must travel as prerequisite, authority, fallback, and execution consequence - structured state, not a sentence that says "remember to be careful."

4. In security-critical codegen, frame the budget and gate the output. The Ansible playbook is the reference: a bounded, structured constraint set plus a compliance scanner took 4 of 16 models from failing to 95-100 percent CIS. The other 12 are not conspiracy; they are over the cliff. Route them to human-configured templates instead of hoping.

5. Demand per-constraint curves from your eval vendor. Composite scores hide the cliff - a middleware score of "80 percent constraint adherence" can sit on top of a 5.7 percent all-k reality, which is the same trap as partial-progress grading (the-response-looked-right-is-not-completion). If a score does not come with the all-k curve, it is a sales number.

The models are not bad at following rules. They are bad at following many rules at once, and they lose the ones that matter when nobody is looking. That is the most fixable bug in the agent stack this year: it is a budget we control and a channel we build, not a capability we wait for.

Continue Reading#

• Constraint Decay Is the Coding Agent Bug Nobody Can Prompt Around - our May origin position: coding agents fall apart as architecture and ORM constraints pile up, and the fix is executable constraints, not longer markdown
• Deep Research Agents Need Constraint Ledgers - the July design sketch this post's evidence converts into a spec: a persistent ledger of what the agent must obey and what it has checked
• The Response Looked Right. The Work Was Not Done. - the completion-certificate half of the same architectural turn: done becomes a checked artifact, and so do constraints
• AGENTS.md Configuration Smells Catalog - what standing configuration actually does in practice: rules that are prose are narration, and the constraint budget explains why
• Approval Fatigue Is an Agent Security Bug - the human half: review prompts fail when they fire too often, so the answer is risk-aware autonomy with safe defaults, the same commitment-first shape this month's evidence demands

Sources#

• Constraint Saturation Evaluation (CSE): arXiv:2608.12426 (2026-08-12)
• Lost in Compaction (COMPINT): arXiv:2608.11242 (2026-07-31)
• When "Must" Becomes "Maybe": Constraint Weakening in LLM Agent Workflows: arXiv:2608.24569 (2026-08-25)
• Evaluating and Preventing Security Smells in AI-Generated Ansible Code: arXiv:2608.24962 (2026-08-25)
• HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following: arXiv:2607.25398 (2026-07-28)