AI Safety for AI Agents in Europe Part II: Hallucination-Proof, Non-Completable Execution Control for Tool Calls, Payments and Real-World Actions — Supporting EU AI Act Human Oversight, Record-Keeping and Robustness, with Technical Relevance to Claude, ChatGPT, Gemini, Copilot and European AI Platforms
Year: 2026
Type: article
Abstract: AI agents now send payments, write to databases, export personal data, change networks, deploy code and command machines. An agent can be fully authenticated, run an approved model and behave normally, yet still produce a hallucinated, unsupported, stale or prompt-injected output that becomes a real consequence. Sandboxes, gateways, allow-or-deny policy engines, classifiers and confirmation prompts decide whether an agent may act. None of them proves that this specific output is fit to become this specific effect. This disclosure describes a pre-execution enforcement architecture that closes that gap: Non-effective hold. Every effect-capable AI output is held as a non-effective proposed action (a Candidate Act). Isolated validation. An enforcement domain isolated from the agent checks the proposed action first. It can run in a trusted execution environment, a hardware security module or an equivalent protected boundary. The checks are: model and workflow integrity; runtime behaviour; output provenance; claim-level factual grounding; a permitted action envelope (blast radius); a dry-run consequence simulation; policy and revocation freshness. Receipt before release. A tamper-evident validation receipt is committed before any authority exists. Act-bound authority. A single-use, non-bearer authority is then released. It is bound to the hash of the act, the exact execution endpoint, the current policy and revocation state, and a nonce. Structural non-completability. In the strongest form, the endpoint holds only a fragment of the execution material. It cannot complete the act until the matching fragment arrives. Copied tokens, privileged software processes and bypass paths therefore fail. Escalated conditional release. Elevated-risk acts are not simply denied. They proceed under escalated conditional release: reduced scope; human approval bound to the exact action; canary or sandbox-first execution; two-phase commit and release tokens; paired rollback capabilities; decaying post-execution monitoring. Further claim coverage. The 29 claims also cover: ephemeral single-use execution environments; enforcement proxies for legacy APIs; anti-downgrade assurance levels; adversarial perturbation margins; privilege ceilings that narrow across multi-agent chains; fragmented or delegated actions; closure of break-glass, fallback and fail-open paths. Latency. Hot-path checks are stated at 1–25 ms, and at sub-millisecond to 3 ms on a DPU or SmartNIC, subject to implementation and benchmarking. EU relevance (AI-generated). This section was generated with AI assistance. It is not legal advice and does not state that any implementation satisfies EU law. Readers must cross-check it against the original PCT filings on WIPO PATENTSCOPE and the official legal texts before drawing any conclusion. Technical alignment with these provisions does not itself establish regulatory compliance. The mechanisms may support objectives associated with: EU AI Act, Article 9: risk management, through graduated and escalated release proportionate to consequence. EU AI Act, Article 12: automatic record-keeping, through receipts committed before any action. EU AI Act, Article 14: human oversight, through approval bound to the exact action rather than a generic click. EU AI Act, Article 15: accuracy, robustness and cybersecurity, through claim-level grounding, consequence simulation and resistance to manipulation. GDPR, Articles 22 and 25: safeguards for automated decisions and data protection by design, by holding personal-data exports and decisions until purpose, recipient and data class are verified. DORA and NIS2: ICT risk control and incident containment for AI-driven operations in finance and essential services, through fail-closed design and closure of break-glass paths. Cyber Resilience Act: secure-by-design products that embed AI agents. PSD2, PSD3 and the Payment Services Regulation: authorisation evidence for agent-initiated payments. eIDAS 2 and the European Digital Identity Wallet: agent mandates and approvals. Industry relevance (AI-generated). This section describes technical relevance only. It is not an endorsement, a validation, a criticism or a statement of infringement, and no company named is affiliated with the inventor. Readers must cross-check it against the original PCT filings and official company sources. These are potential integration scenarios, not confirmed company implementations or product commitments. The architecture could complement the agent-safety work of: Anthropic: Claude, Claude Code, Claude Cowork; OpenAI: ChatGPT agent, Codex, the Agentic Commerce Protocol; Google: Gemini, Agent Gateway, Model Armor, AP2; Microsoft: Copilot, Agent 365, Entra Agent ID; Amazon: Bedrock AgentCore Policy; NVIDIA: OpenShell, BlueField-4 Sentry. It does so by adding act-bound authority, a receipt before release, and endpoint-side verification. In Europe it is relevant to: AI developers: Mistral AI, Aleph Alpha. Enterprise software: SAP. Industrial control: Siemens, Schneider Electric, ABB. Security hardware: Thales, Infineon, NXP. Payments: Adyen, Worldline, SWIFT. Telecom: Ericsson, Nokia, Deutsche Telekom, Orange. Aerospace and space: Airbus, ESA. Standards and supervision: the EU AI Office, CEN-CENELEC JTC 21 and ENISA. This disclosure is based on PCT/IB2026/055760 (WO 2026/150383, filed 7 June 2026, published 16 July 2026). It is a companion filing in the family built on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026. The inventor is open to acquihire or strategic collaboration. Keywords: AI safety; agentic AI safety; trustworthy AI; EU AI Act; Article 9; Article 12; Article 14; Article 15; human oversight; record-keeping; robustness and cybersecurity; GDPR; data protection by design; DORA; NIS2; Cyber Resilience Act; PSD3; eIDAS 2; AI agent guardrails; hallucination prevention; prompt injection containment; tool-call authorization; action-level authorization; pre-execution enforcement; non-bearer capability; proof-of-possession; zero-trust execution; human-in-the-loop approval; dry run; blast radius; least privilege; confidential computing; TEE; HSM; DPU; threshold cryptography; two-phase commit; rollback; multi-agent delegation; TOCTOU; fail-closed; break-glass; AI agent payments; Claude; ChatGPT; Gemini; Copilot; AgentCore; Mistral AI
Author: Das, Sangam
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225641369
FWCI:
Cites:
Cited by:
Related to: