Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales

AI agents often provide free-form rationales to justify their actions, but these explanations are frequently unfaithful to the model's internal reasoning and cannot be trusted for security. The authors ask: can we govern agent tool use by requiring structured, verifiable action claims that are checked against authoritative server state, rather than relying on the model's own prose?

To address this, the authors introduce Explanation-Bound Tool Execution (EBTE). Instead of treating model rationales as authoritative, EBTE forces agents to output a structured ToolInvocationExplanation object. This object contains typed fields—such as intent, tool identity, risk tier, and context dependencies—that are compared against independently held server facts (e.g., policy snapshots, intent certificates, and route records). The system uses a three-outcome decision lattice: 'Allow' (consistent with all facts), 'Review' (uncertain or incomplete), and 'Deny' (contradicts hard facts). This process acts as a secondary gate that cannot widen the agent's baseline authority.

The authors evaluated EBTE across 136 conformance scenarios, 224 hosted-model attempts, and various semantic checks. The results demonstrate that EBTE successfully identifies and denies hard contradictions (such as overbroad payloads or unauthorized tool use) while correctly routing ambiguous or incomplete claims to a review state. The system effectively separates the model's advisory prose from the enforceable security contract, ensuring that even if a model generates a plausible-sounding but malicious explanation, the server-side verification prevents unauthorized execution.

As AI agents gain the ability to perform sensitive administrative tasks, the 'governance gap' between what a model claims to be doing and what it is actually doing becomes a critical security vulnerability. EBTE provides a robust, auditable framework for enforcing least-privilege principles at the tool-execution boundary, moving security away from the unreliable interpretation of natural language and toward deterministic, server-verified contracts.