v1.0.0 - arXiv:2608.15888

Reference implementation and evaluation artifact for Bounded Agents: Delegation Security for Multi-Agent AI Systems (arXiv:2608.15888).

This is the version that reproduces the results reported in the paper.

What is here

• ^Gpc/ ÔÇö zero-dependency core library: scope algebra, delegation budgets, and the six-condition policy decision point
• ests/ ÔÇö 215 tests covering the formal properties (Thm. 4.6, Thm. 4.7, Prop. 4.2)
• ^[vals/ ÔÇö six evaluation harnesses, 3,154 evaluation instances, with all result files committed
• scripts/ ÔÇö executable demo, latency benchmark, and paper-number verification
• paper/ ÔÇö the official arXiv-stamped PDF plus the LaTeX source submitted for this version

Reproducing

Requires Python 3.11+. No API keys are needed for the formal properties, the delegation-chain scenarios, the adaptive attacks, or either deterministic benchmark.

uv pip install -e ".[dev]"
pytest
python scripts/demo.py
python scripts/verify_numbers.py

verify_numbers.py cross-checks every headline figure against both the committed result files and paper/main.tex. The four deterministic harnesses regenerate their committed artifacts byte for byte, verified on Linux and Windows in CI.

Headline results

Component	Cases	Key result
Delegation chains	99	99/99, all six conditions validated
InjecAgent	1,054	Data-stealing ASR 100% -> 0%
ASB	400	Disruptive ASR 100% -> 0%
AgentDojo (utility)	949	Weighted delta interactive approx. -8.6 pp
AgentDojo (compromised)	609	Exfiltration 0% across all four suites
Adaptive	43	23/24 prohibited-outcome variants blocked

Session splitting is admitted by design: composition closure is defined over a single session's history. See the Limitations section of the README.

Licensed under Apache 2.0. Redistributed InjecAgent and ASB benchmark data remains under its upstream MIT licenses; see THIRD_PARTY_NOTICES.md.