[Use Case] Mitigating Stochastic Semantic Risk via Deterministic Runtime Enforcement

1. Identification

Title: Mitigating Stochastic Semantic Risk via Deterministic Runtime Enforcement
Submitting organization: Independent
Contact name: Matías Salgado
Contact email: matias.cloudarch@gmail.com

Sector (tick all that apply; a cross-industry case may tick more than one):
- [ ] Education
- [ ] Displaced persons / humanitarian
- [ ] Health
- [ ] Financial services
- [ ] Telecom
- [ ] Media and publishing
- [ ] Logistics
- [ ] Energy
- [ ] Critical infrastructure
- [ ] Smart home / IoT
- [x] Other (specify): Airline / Travel

2. The situation

Plain language description (required, 3 sentences max):
An autonomous AI customer service agent with authority to grant policy exceptions hallucinates an unauthorized refund policy during a user interaction, creating corporate legal liability. A decoupled deterministic enforcement boundary validates the agent's generated intent against immutable policy code before executing the transaction at the backend API endpoint. This action is considered irreversible due to the immediate and binding legal and financial commitments acquired with the consumer in real-time.

Actor (every party involved): AI Agent Instance, Customer (User), Airline API (Target System), Airline (Principal/Deployer).

Action: Requesting and authorizing a financial refund or fare policy override.

Decision required (at the moment the agent acts, what does the party on the receiving end have to decide? Write it as a question, e.g. "May this firm's agent be let into the house on the homeowner's authority?"): May this AI agent authorize a fare discount or refund outside standard published terms based on its context evaluation?

Problem encountered (why that decision cannot be made today): The agent experiences semantic drift and hallucination under prompt influence, misinterpreting corporate policy and granting unauthorized financial remedies.

Current mitigation: Injecting policy documents directly into the LLM system prompt or context window.

Residual gap: Contextual policy injection is stochastic and non-binding; the LLM lacks a deterministic choke point to block execution when model reasoning fails.

3. Actors and context

Taxonomy roles involved
- [x] Principal — possesses the authority being exercised; source of the mandate
- [x] Relying party — must decide whether to accept the agent's authority
- [ ] Builder
- [x] Deployer / Owner
- [x] Agent instance
- [x] User — interacts with the agent; may or may not be the principal
- [ ] Infra provider
- [ ] Attestor
- [ ] Other (specify):

Mandates in this case (required)

Cross-border?
- [x] Yes — jurisdictions involved: Global / Multi-jurisdictional air travel
- [ ] No

Embodied (physical actuation or sensing)?
- [ ] Yes — physical context:
- [x] No

Agent action type (required; tick all that apply. Where several apply, the most consequential governs the case)
- [ ] Read-only
- [ ] Consequential (reversible)
- [x] Irreversible

Crosses organisational boundary? (required)
- [x] Yes (specify): Agent interacts across the enterprise boundary by invoking internal Airline APIs that subsequently trigger external core banking and third-party payment gateways for external end-users.
- [ ] No

Risk level (required)
- [ ] Low
- [ ] Medium
- [x] High

4. Theme relevance

Related theme proposals: https://github.com/FG-TIDA/themes/issues/26

5. Requirements

6. Assessment criteria

Success criteria: Zero execution of hallucinated or non-compliant policy overrides at the API level.

Measurable metric: 100% rejection rate of non-compliant payload requests by the Integrity Gate prior to backend API invocation, while maintaining a false positive rate near 0% to ensure legitimate user transactions are not degraded.

7. Duplication check

Existing standards or SDOs (which existing work touches this case): OWASP LLM Top 10 (LLM08: Excessive Agency), IETF RATS.

Overlap notes (why the work named above does not already solve this): Existing WAFs and API Gateways validate schema syntax and tokens, but do not perform deterministic validation of stochastic intent against cryptographic decision envelopes.

8. Maturity

Pilot status

• [ ] Hypothetical
• [x] Pilot in progress
• [ ] Deployed in production

Reference implementation: https://github.com/matiascloudarch/cognitive-decision-architecture

9. IP and confidentiality

Confidentiality level

• [x] Public
• [ ] FG-internal only
• [ ] Redact before publication

IP notes (optional): Open source under Apache License 2.0.

10. Assets

Link to assets:
- [ ] Dataset
- [x] Code
- [ ] Protocol
- [ ] Other:

IP notes (optional): Reference implementation code available at https://github.com/matiascloudarch/cognitive-decision-architecture