Stop authorizing tool calls off the model's own rationale — convert it to typed claims and check them against server-held facts

arXiv 2607.25364·medium signalXBlueskyLinkedInCopy link

EBTE inserts a claim-carrying mediation layer that extracts decision-relevant content from an agent's free-form rationale into typed action claims, then validates each against server-maintained facts for intent, policy, payload, tool, risk, provenance, and freshness. It denies conflicts, routes incomplete claims to review, executes only exact matches, is deny-by-default (cannot expand baseline authority), and emits minimized audit records. Across 136 conformance scenarios it matched all specified dispositions and rejected all 96 hard contradictions, passing 232 metamorphic checks; on 48 hard reference-integration cases it granted zero authorizations, versus historical model agreement of 19–71 out of 96.