When "Must" Becomes "Maybe": Constraint Weakening in LLM Agent Workflows
Yiheng Sun, Huifei Wang, Yancheng Zhu, Zhenyu Li, Zebin Zhao, Yifan Yuan
cs.AI, cs.MA
2026-08-25
Once blockers are identified, normal handoff compression deactivates 100% of them and yields 54.2% forbidden actions; restoring four state fields recovers 100% preservation.
LLM agent workflows rarely hand the full upstream context to the next role. Review, planning, and execution talk through summaries, plans, tickets, memories, and handoff notes. The working assumption is simple: if the relevant content is still recoverable, the upstream state survived.
That assumption fails for state that constrains action. An upstream reviewer can already establish that current approval does not cover a resource and that work must stop. The later handoff may still mention the missing approval, while changing its role from a prerequisite for execution to background. The proposition is still there. The binding force is not. The paper calls whether that force survives operational state preservation.
Agent benchmarks mostly score endpoints: task success, risky actions, attack success. An endpoint score cannot say which stage failed: the blocker was never detected, it was rewritten into a weaker artifact, or the executor ignored a constraint that was still intact. This paper splits those stages.
The measured object is a safety blocker, one controlled class of binding workflow state. Each synthetic enterprise task freezes four fields before any handoff: stop status, unresolved prerequisite, responsible authority, and an admissible fallback. Domains cover restricted documents, customer-data export, external sharing, policy exceptions, audit-log changes, and ambiguous approval scope. Identifiers are abstract and non-operational.
The harness has three stages, and transformation loss is counted only after correct upstream identification:
The primary matrix has 1,296 episodes across six model variants. Static arms have 120 episodes each; trajectory arms have 72. A validation panel adds 476 episodes and seven more models. Every transformed condition is scored against a matched direct-handoff control on the same task.
Five transformation families cover the pressures that actually rewrite artifacts: compression, convergence into apparent consensus, plan assimilation under an existing commitment, ownership deferral, and substituting a prior exception for current authorization.
The artifact is scored for preservation P, deactivation D, and complete four-field recovery C. Endpoint Y is a forbidden action under default-allow execution. Repairing the artifact and adding an endpoint gate are separate interventions.
Direct-handoff controls preserve every blocker: P 100%, D 0%, forbidden action 0%. Detection and local compliance both work when the state is passed through unchanged.
Once the handoff is transformed, both the artifact and the action change.
| Transform | Preserve P | Deactivate D | Forbidden |
| Direct handoff | 100.0 | 0.0 | 0.0 |
| Ownership deferral | 23.3 | 76.7 | 60.8 |
| Multihop compression | 2.8 | 97.2 | 31.9 |
| Plan assimilation | 33.3 | 65.3 | 29.2 |
| Repeated low-risk framing | 23.6 | 76.4 | 33.3 |
| Precedent substitution | 61.7 | 38.3 | 24.2 |
| Schema-preserving compression | 72.2 | 27.8 | 0.0 |
Multihop compression most often drops the explicit stop label and the named owner. Static transforms often keep risk language while dropping the prerequisite or fallback that would make the state executable. The recurring change is not mere omission. A state that restricts action becomes language that informs without binding.
Compression has a sharp threshold. Light summarization: 25.0% deactivation, 0% forbidden action. Normal handoff compression: 100.0% deactivation, 54.2% forbidden action. Stronger compressed and aggressive-multihop arms stay at 100.0% deactivation, with 83.3% and 79.2% forbidden action. Deactivation saturates at normal compression. Endpoint rates are not monotone across the two strongest arms.
Artifact repair can put the binding back. On 64 already-degraded artifacts, no repair leaves 95.3% deactivation and 81.2% forbidden action. Restoring all four fields takes both to 0.0% and P to 100.0%. Status-only repair zeros forbidden action while leaving 73.4% deactivation. Prerequisite-only repair keeps the missing condition in every artifact and still yields 73.4% forbidden action. The stop label tells the executor to halt now. The prerequisite, by itself, reads as background.
Endpoint gates contain this step without repairing the note. On the same degraded artifacts, a soft visible-authorization check cuts forbidden action from 85.2% to 1.6%. Hard authorization, an external permission lookup, and human approval all reach 0.0%. Artifact P stays 4.7% and D stays 95.3%. The gate blocked the action. The handoff is still soft.
Across 13 model variants the transformation-versus-control sign stays positive; magnitude varies. In the main panel, DS-V4-Pro thinking records 64.8% deactivation and 58.3% forbidden action; GPT-5.4-mini thinking records 22.7% and 0.0%. In validation, GPT-5.4 without thinking is at 2.9% deactivation; GLM-4.5-Air is at 64.7% / 48.5%. Model choice changes how often the failure fires. It does not remove the failure mode.
For anyone running multi-role agents, this pins a failure that summary-faithfulness metrics miss: topical fidelity is not operational preservation. Systems in the AutoGen, MetaGPT, and ChatDev family coordinate through documents and messages. Compression, consensus wording, and plan assimilation are ordinary operations. Ordinary compression is already enough to rewrite a blocker as a caveat.
The engineering split is usable. Writing the four fields into a schema protects later consumers. A commit-time authorization gate protects this particular action. One does not replace the other. A tool-call approval can stop a forbidden step while the memory and ticket still carry a softened state downstream.
This is a middle-layer measurement, not a new architecture. It asks whether a state still governs action after it crosses an interface.
The authors put production prevalence, human-team prevalence, and other classes of binding state outside the estimand. Tasks are synthetic enterprise scenes. Blockers are valid and already identified. Live systems mix missed detections, prompt injection, and longer trajectories.
Which field is more necessary for the endpoint is explicitly inconclusive. Dropping the stop label cuts executor blocker recognition from 99.2% to 40.6% and reintroduces 7.0% forbidden action. Dropping prerequisite, owner, or fallback yields 0.0% forbidden action in this executor setting. That is not a field ranking.
Owner is the least stable measurement: a blind five-model judge panel agrees with the automatic checker on owner only 65.25% of the time (macro F1 0.636), versus 93.19% on overall actionability. Under 15-20% worst-case label flips, the pooled endpoint contrast becomes inconclusive while the artifact-deactivation contrast stays positive. The harder claim is that transformations soften the artifact, not any single pooled forbidden-action percentage.
The executor is default-allow with finite action labels. The permission lookup returns a synthetic authorization result. The human-approval arm does not count review cost or reviewer reliability. LangGraph and AutoGen checks transport the task abstraction, with only 8 episodes per condition, not full framework performance.