Boundary Quorum Protocol: a verifiable authorization standard for agent evaluations

The work here is credible, but not excellent. The post-hoc analysis of the single event and demonstration that the protocol works there is certainly some evidence, but seems to overfit to the narrow event in a post-hoc fashion. More consideration of the generalizability would be critical, and the reasoning for many of the asserted claims should be explained more clearly.

It seems quite unclear that the proposed protocol is functional. The paper asserts that "The gated crossings can be caught cheaply and verifiably," but the expense of the detection of the predicates, the costs, and the accuracy are not assessed out of sample, or even in-sample. The list of events found is ad-hoc, and it's unclear that there is a way to automatically detect them other than parsing logs, which is expensive and of unclear accuracy. The list is useful, but far from complete, and partially automatically enforceable, but with an unclear false-positive rate.

The effectiveness is also asserted, not argued for clearly. How does it know whether an identity or login is allowed or not? How does the verifier know if a read even has a side effect? (e.g. HTTP get requests are not actually read-only, and even when thy are, the remote server can take actions that create side effects.) How does the system reliably know if an transaction is high-impact, or prohibited?

The writing was also substandard and messy LLM-generated content; asking a model to reread and rewrite section by section would have improved this, but nothing substitutes for humans carefully reading and ensuring that the work is clear, or better, actually writing or rewriting. (Using the acronym BQP was annoying on top of everything else.)

I was surprised to see that a naive multi-reviewer vote fails against collusion and outages.

I'd assume it is the fix most teams would reach for first and your paper demonstrates it fails open under both.

I would recommend replacing the scripted reviewers in the adversarial test with the real model from your live loop, since right now your independence claim is only proven against a hand-coded adversary.

This paper addresses a foundational vulnerability in frontier model evaluations and autonomous agent deployments: the complete lack of independent authorization for high-risk boundary crossings during agent runs, as vividly illustrated by the July 2026 intrusion. The author introduces the Boundary Quorum Protocol (BQP) v0.1, a rigorous, risk-proportional authorization framework that gates agent tool execution using tiered risk levels (L0–L4), independence-constrained machine quorums, and non-delegable human gates. Calibrated against 44 documented events from the real incident, BQP is paired with a detection harness demonstrating early warning capabilities and the Evaluation Containment Attestation (ECA) v0.1 bundle for third-party verification. By proving that unsafe crossings can be intercepted with manageable operational overhead and verifiable audit trails, this work delivers a vital blueprint for auditable AI safety governance.