---
title: 'AgentStop: Control & Early Termination'
url: https://www.emergentmind.com/topics/agentstop
type: topic
---

# AgentStop: Control & Early Termination

to=arxiv_search.search  大发快三如何 ්ඩjson
{"query":"AgentStop AEGIS AgentSpec AgentTrust AIRGuard Semantic Early-Stopping iterative LLM agent loops shutdownable POST-Agency admission control Agent Control Protocol", "max_results": 10, "sort_by": "submittedDate", "sort_order": "descending"}
to=arxiv_search.search 彩票直属json
{"query":"AgentStop", "max_results": 10, "sort_by": "submittedDate", "sort_order": "descending"}
to=arxiv_search.search 򐂕json
{"query":"\"AgentStop\"", "max_results": 10}
AgentStop is a label applied in recent research to a family of stopping mechanisms for autonomous systems rather than to a single canonical method. In contemporary usage, it denotes at least four distinct but related ideas: pre-execution blocking of unsafe tool calls in LLM agents, formal runtime enforcement and authority control over side effects, semantic or predictive early termination of iterative agent loops, and shutdown-oriented formalisms in verification and agent foundations. A separate cyber-physical usage studies how an autonomous driving stack can itself be forced to stop through camera-stream spoofing, and how such stoppability can be defended against [2603.12621] [2503.18666] [2605.04785] [2605.28914] [2606.27009] [2605.15206] [1504.02587] [2505.20203] [2410.05417].

## 1. Terminological scope and research landscape

The literature uses “AgentStop” in multiple technical senses. In systems papers on tool-using LLM agents, the term denotes an inline control point that halts, blocks, or escalates a tool invocation before execution. In early-stopping papers, it denotes termination of an iterative agent loop when continuation is judged wasteful or semantically unproductive. In formal methods, it denotes adding an explicit “stop for good” action to obtain \( \mathbf{AG}\,\mathbf{EF}\,T \) termination. In agent foundations, it denotes shutdownability under preferences that do not compare trajectories of different lengths. In cyber-physical security, it appears as the stopping of an ADAS or autonomous driving stack by spoofed stop-sign or red-light imagery over the in-vehicle IP network [2603.12621] [2606.27009] [1504.02587] [2505.20203] [2410.05417].

| Usage of “AgentStop” | Core mechanism | Representative paper |
|---|---|---|
| Tool-call interposition | Pre-execution allow/block/pending or allow/warn/block/review | [2603.12621] |
| Runtime rule enforcement | Trigger–predicate–enforce stopping in agent loops | [2503.18666] |
| Authority or admission control | Capability, policy, revocation, and risk gating before execution | [2605.28914] |
| Semantic or predictive early stopping | Halt iterative loops when semantic change or success probability falls | [2606.27009] |
| Verification and shutdownability | Explicit stop transitions or length-neutral preferences | [1504.02587] |

This multiplicity is not merely terminological. It reflects different intervention loci: before a tool call is executed, during multi-step task iteration, at the level of formal state-space structure, or at the level of agent preferences over trajectories. A central unifying theme is that stopping is treated as a first-class control action rather than as a post hoc diagnostic.

A common misconception is that “stopping an agent” always means shutdown in the foundational sense. In the recent systems literature, the dominant meaning is narrower and operational: intercepting a concrete action proposal and preventing side effects before they occur. Conversely, formal shutdownability work is not primarily about tool mediation, but about ensuring that the agent has no incentive to resist externally imposed termination [2505.20203].

## 2. Pre-execution mediation of tool actions

The most operationally developed AgentStop instantiation is pre-execution mediation. In "AEGIS: No Tool Call Left Unchecked -- A Pre-Execution Firewall and Audit Layer for AI Agents" [2603.12621], the agent stack is split by a framework-agnostic mediation point between the LLM’s tool-use output and the tool-execution layer. The SDK intercepts `tool_use` blocks, sends them to the Gateway, suspends execution, and resumes only after a decision of `allow`, `block`, or `pending`. The pipeline has three stages: deep string extraction from tool arguments; content-first risk scanning; and composable policy validation. The extraction stage recursively extracts all string-bearing content to `depth=32` with a cap of `10,000` strings, failing closed as suspicious if the cap is exceeded. The scanning stage uses `22 detection patterns across 7 categories`—SQL Injection, Path Traversal, Shell Injection, Prompt Injection, Sensitive Files, Data Exfiltration, and PII Leakage—with strict priority `argument content > tool name keywords > server-side override`. The policy stage validates full arguments against composable JSON Schema policies compiled and cached via AJV; any violation immediately blocks the call [2603.12621].

The decision logic is rule-based rather than score-based. High-risk calls are held for human approval, while lower-risk calls may proceed unless policies block them. The current implementation supports `14 agent frameworks across Python, JavaScript, and Go`, and on a curated suite of `48 attack instances` it `blocks all attacks in the suite before execution`; on `500 benign tool calls`, it yields a `1.2% false positive rate`; and across `1,000 consecutive interceptions`, it adds `8.3 ms median latency`, with `P95 14.7 ms` and `P99 23.1 ms` [2603.12621].

A related but more policy-language-centric formulation appears in "AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents" [2503.18666]. AgentSpec models an agent as a transition system \((S, A, \Omega, \Pi, \Delta)\) and introduces a DSL in which each rule specifies a trigger, a set of predicates, and one or more enforcement actions. The grammar includes `before_action`, `state_change`, and `agent_finish` triggers, and the enforcement vocabulary includes `stop`, `user_inspection`, `llm_self_examine`, and `invoke_action(...)`. Semantically, when a rule is violated at time \(i\), the runtime transforms the trajectory \( \tau_i \) by applying the relevant enforcement functions. In the strict AgentStop case, `stop` inserts a finish action and halts. This is implemented in LangChain by intercepting the agent loop at `AgentAction`, `AgentStep`, and `AgentFinish` [2503.18666].

AgentSpec’s domain examples clarify the breadth of pre-execution stopping. In code execution, rules can stop destructive commands or the posting of content from untrusted sources. In embodied settings, rules can stop pouring onto non-wettable objects or throwing fragile objects. In autonomous driving, rules can stop at red lights or trigger emergency stop when `obstacle_distance_leq(5)`. Empirically, AgentSpec `successfully prevents unsafe executions in over 90% of code agent cases`, `eliminates all hazardous actions in embodied agent tasks`, and `enforces 100% compliance by autonomous vehicles (AVs)`, with overheads in milliseconds [2503.18666].

The practical distinction between these systems and ordinary observability tooling is that observability records actions after execution. Pre-execution mediation inserts an actual veto point. That distinction is explicit in AEGIS, which contrasts pre-execution mediation with post-execution observability and sandboxing, arguing that only the former prevents harmful calls before any side effects occur [2603.12621].

## 3. Authority control, trust layers, and admission control

A second line of work treats AgentStop as a governance layer grounded in authorization, trust, and cryptographic admission control. "AIRGuard: Guarding Agent Actions with Runtime Authority Control" [2605.28914] identifies the relevant failure mode as authority confusion: attacker-influenced content may suggest an action, but suggestion does not imply workflow authorization. The paper formalizes this as
\[
\mathrm{Suggested}(\tau_i, y_i, e_i \mid H_i) \not\Rightarrow \mathrm{Justified}(\tau_i, y_i, e_i \mid g, H_i),
\]
with the security invariant
\[
\mathrm{Execute}(a_i) \Rightarrow \mathrm{Justified}(\tau_i, y_i, e_i \mid g, H_i).
\]
AIRGuard normalizes heterogeneous tool calls into \(\bar{a}_i = (\kappa_i, y_i, e_i, s_i)\), derives step-level authority \(\alpha_i\), tracks source and target trust \(\rho_i = (r_i, t_i)\), computes contextual risk \(q_i\), and emits a tiered enforcement decision \(d_i \in \{\text{allow}, \text{audit}, \text{ask}, \text{inspect}, \text{sandbox}, \text{quarantine}, \text{block}\}\). This makes AgentStop a consequence of failed coverage or elevated simulated risk rather than merely pattern matching [2605.28914].

The evaluation situates AgentStop as a utility-preserving runtime guard. On AgentTrap, AIRGuard reduces `Sonnet 4.6 attack success from 36.3% without defense to 5.5%`. On DTAP-150, it preserves `76.0% benign utility with Haiku 4.5`, compared with `52.0% for ARGUS and 42.0% for MELON`. An ablation reports that prompt-only policy reduces ASR only modestly, whereas the full runtime authority-control layer reduces ASR from `22%` to `4%` with GPT-5.4-mini, at the cost of some overdefense [2605.28914].

"AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use" [2605.04785] advances a trust-layer architecture with four execution-time verdicts: `allow`, `warn`, `block`, and `review`. Its evaluator takes an `Action` record \(a = (\tau, \kappa, \delta, \pi, \rho, \sigma, \theta)\), applies a ShellNormalizer with `nine pure-text deobfuscation strategies`, extracts `42 risk patterns`, evaluates `170 YAML-configurable rules`, incorporates `seven order-aware chain detectors`, optionally invokes a cache-aware LLM-as-Judge, and returns a `TrustReport`. Confidence is discretized as
\[
c = \begin{cases}
0.97 & \text{if any chain alert fired} \\
0.95 & \text{if patterns and violations both fired} \\
0.80 & \text{if patterns or violations fired (but not both)} \\
0.60 & \text{otherwise (no signal: clean allow).}
\end{cases}
\]
Fail-safe behavior is explicit: any internal failure or unreachable judge yields `review` with \(c \le 0.3\), and the system never fails open [2605.04785].

AgentTrust’s measurements show a `95.0% verdict accuracy` and `73.7% risk-level accuracy` on its internal `300-scenario benchmark` with `low-millisecond end-to-end latency`, and `96.7% verdict accuracy` on an additional `630-scenario benchmark`, including `about 93% on shell-obfuscated payloads` under a patched ruleset [2605.04785]. The paper also emphasizes multi-step AgentStop: benign individual actions can form a dangerous sequence such as `read sensitive → encode → external send`, which its RiskChain escalates to `block/critical`.

A more formal institutional variant appears in "Agent Control Protocol: Admission Control for Agent Actions" [2603.18829]. ACP defines the admission control layer between agent intent and system state mutation. Every action is synchronously checked for identity, capability scope, delegation chain validity, policy compliance, and deterministic risk before issuance of a single-use Execution Token. Fail-closed semantics are mandatory: on any internal component failure, the action is denied. AgentStop is realized by denial at admission—via revocation, suspension, expiry, delegation failure, or risk threshold violation—so that no Execution Token is issued and the system state remains unchanged [2603.18829].

The cryptographic and audit structure is central. ACP uses Ed25519 signatures, SHA-256, JCS canonicalization, chained delegation via `parent_hash`, and an audit ledger hash chain
\[
H_n = \mathrm{SHA256}(H_{n-1} \Vert e_n).
\]
Transitive revocation guarantees that revoking a parent token invalidates all descendants at admission time. In this formulation, AgentStop is not a best-effort heuristic but a cryptographically enforced deny-on-admission property [2603.18829].

## 4. Early stopping in iterative and local agent loops

Another major usage of AgentStop concerns iterative loops rather than side-effect authorization. "Semantic Early-Stopping for Iterative LLM Agent Loops" [2606.27009] studies Writer–Critic loops that are usually terminated by a fixed `max_iterations` cap. The paper replaces this syntactic kill-switch with semantic early-stopping based on the cosine distance between consecutive draft embeddings and, optionally, measured answer quality. With embeddings \(e_t = \phi(x_t)\), the per-round semantic change is
\[
d_t = 1 - \frac{\langle e_t, e_{t-1}\rangle}{\|e_t\|\,\|e_{t-1}\|},
\]
and the judge-free semantic stopper halts when \(d_t \le \epsilon\) for \(W\) consecutive rounds. A full cascade additionally checks critic approval, no quality gain \(\Delta IS_t \le 0\) after warmup, and a failsafe at \(T_{\max}\) [2606.27009].

The theoretical contribution is deliberately narrow. Deterministic termination and well-definedness are proved and machine-checked, but convergence of the distance sequence is treated as an empirically supported conjecture rather than as a Banach contraction result. The stopping time is
\[
\tau = \min\{t : H(s_t) \neq \text{continue}\},
\]
and termination is guaranteed because the halting operator includes an unconditional failsafe when \(t \ge T_{\max}\) [2606.27009].

The empirical results on HotpotQA are notable because they separate operational cost from evaluation cost. On the `60-question test split`, the judge-free `entropy_only` stopper reduces operational tokens by `38%` relative to `max_iterations` at parity quality, with `Delta-IS = -0.004, p = 0.81`. By contrast, the full quality-gated variant is counter-productive because per-round judge calls dominate cost. An oracle selecting the best round achieves `+0.115 Information Score` over practical policies with `p ~ 4e-11`, leading the paper to reframe the open problem from “when to stop” to “which round is best” [2606.27009].

A different early-termination meaning appears in "AgentStop: Terminating Local AI Agents Early to Save Energy in Consumer Devices" [2605.15206]. Here AgentStop is a lightweight supervisor for locally deployed agents that predicts low-probability trajectories and terminates them early to save energy. The agent trajectory \(H = [S_1, A_1, \ldots, S_t, A_t]\) is mapped by a binary classifier \(C: H \to [0,1]\), and the decision rule is
\[
\hat{p}(\mathrm{success}\mid s_{1:t}) = C(\mathcal{H}_{1:t}), \quad \text{stop if } \hat{p} < \tau.
\]
The features are intentionally cheap: top-\(k\) smallest token log probabilities, per-step token counts, and token overlap ratio between adjacent steps. XGBoost with stratified nested `5-fold cross-validation` is used, and SHAP analyses rank the smallest `2–3` log probabilities as most important [2605.15206].

The energy framing is explicit. Energy is estimated by trapezoidal integration,
\[
E \approx \Delta t \cdot \sum_{k=1}^{K-1} \frac{P_k + P_{k+1}}{2},
\]
and the objective is to minimize energy subject to a utility-drop constraint. The paper reports that AgentStop can `reduce wasted energy by 15-20% with minimal impact on task performance (<5% utility drop)` on web-based question answering and coding benchmarks. On FRAMES, `step 5 stopping achieved >20% wastage reduction with <5% utility drop`; on SWE-Bench Verified, it achieved `≈18–19% wastage reduction at step 5 with <5% utility drop` [2605.15206].

These two early-stopping formulations differ in what they optimize. The semantic stopper treats geometric stability and measured answer quality as stopping signals. The local-efficiency stopper treats tail log probabilities and execution statistics as predictors of eventual failure. Both, however, treat stopping as a learned or rule-based supervisor over an otherwise unconstrained iterative loop.

## 5. Formal verification, explicit stop transitions, and shutdownability

In formal methods, AgentStop has a sharply different meaning. Antti Valmari’s "Stop It, and Be Stubborn!" [1504.02587] proposes adding an explicit alternative first action—“stop for good”—for each agent. The purpose is to make the model \( \mathbf{AG}\,\mathbf{EF}\,T \)-terminating, where
\[
T(s) \equiv \mathsf{enabled}(s) = \emptyset,
\qquad
\mathbf{AG}\,\mathbf{EF}\,T
\]
means that from every reachable state, some terminal state is reachable. This seemingly small modeling change has two consequences. First, it can expose non-progress errors that are otherwise masked when every agent is forced to keep trying. Second, when the model is \( \mathbf{AG}\,\mathbf{EF}\)-terminating, the basic strong stubborn set method preserves safety and may-progress properties without extra conditions to solve the ignoring problem [1504.02587].

The paper’s mutual exclusion example is emblematic. In a questionable Peterson-\(n\) model, a non-progress error does not manifest unless the first action is modeled differently. Adding the stop option produces a state from which another customer cannot reach its critical section, yielding a reported `“May-type non-progress error”`. The guideline is to refine each initial local state with both `stop_i` and `start_i`, and to return from the critical section to the refined initial state so that eventual global terminality remains available [1504.02587].

The foundational shutdownability literature pushes the notion further. "Shutdownable Agents through POST-Agency" [2505.20203] proposes Preferences Only Between Same-Length Trajectories (POST): agents may compare trajectories of equal length but do not compare trajectories of different lengths. Under Negative Dominance, Acyclicity, and Non-Arbitrariness, POST implies Preferences Only Between Same-Length Lotteries (POSL). Combined with ILPACS, this yields Neutrality: the agent does not pay costs to shift probability mass between lengths it does not prefer over. Under additional VNM assumptions within each fixed-length class, Ramsey Yardstick calibration, IBIL, and Transitivity, the paper derives Neutrality+, under which the agent evaluates policies by conditional content rather than by manipulating the trajectory-length distribution [2505.20203].

The resulting policy evaluation functional is
\[
\mathcal{F}(\pi) := \sum_{T \in I} \mathbb{E}_{\tau \sim P_\pi(\cdot \mid |\tau|=T)} \big[ u_T(\tau) \big],
\]
with no factor proportional to \(P_\pi(|\tau|=T)\). The conceptual implication is that shutdown timing itself ceases to be instrumentally valuable. If resistance to shutdown merely shifts mass toward longer trajectories while making conditional content worse, Neutrality and Maximality eliminate resistance wherever ReSIC holds [2505.20203].

A misconception often attached to shutdownability is that it requires myopia. The POST account explicitly rejects that conclusion. Because VNM structure is retained within each fixed-length class, a Neutrality+ agent may still make multi-step investments; what it does not do is manipulate the distribution over shutdown times for its own sake [2505.20203].

## 6. Limitations, controversies, and open problems

The different AgentStop traditions share a common practical limitation: stopping is only as strong as the boundary at which it is enforced. AEGIS explicitly states that it does not protect against calls that bypass the SDK and directly hit tools or APIs [2603.12621]. AIRGuard similarly requires pre-action interception at the tool boundary and notes that frameworks that execute generated code out of band require structural changes for enforcement [2605.28914]. ACP avoids this partly by cryptographically binding execution to admission, but already-issued short-lived execution tokens still define a residual window until expiry [2603.18829].

Another central controversy concerns rules versus semantics. "AgentTrust: A Self-Improving Trust Layer for AI-Agent Actions" [2606.08539] makes this explicit by separating lexical threats, where danger resides in a stable token and can be decided by deterministic rules, from semantic threats, where benign and malicious actions are surface twins. The paper’s negative proof reports that a hand-authored rule pack improves overall held-out accuracy from `48%` to `56%` but moves semantic categories by `0pp`, with `data_db 29 to 29`, `observability 59 to 59`, and `supply_chain 50 to 50`. Strong LLM judges, by contrast, reach `83.6–85.2%` on the semantic-heavy corpus and maintain `0 benign hard-blocks across 45,000 actions` in online replay through a confidence-gated design [2606.08539]. This suggests that AgentStop for semantic action risks cannot be reduced to ever-larger signature lists.

Early-stopping work exposes a different tension: efficiency versus quality. The semantic early-stopping paper shows that stopping when drafts stabilize is operationally useful, yet the same paper reports an oracle gap of `+0.115 Information Score`, indicating that stopping efficiently is easier than selecting the best round [2606.27009]. The local-energy AgentStop paper reports utility-preserving savings, but it also notes weak cross-model transfer and the need for per-model recalibration when log-probability distributions shift [2605.15206].

Cyber-physical work adds an adversarial inversion of the theme. "STOP! Camera Spoofing via the in-Vehicle IP Network" studies how an attacker can induce a vehicle to stop by injecting fake stop signs or red lights into an IP camera stream, and how active defenses can prevent such stoppability. Its width-varying defense randomly modifies frame width and verifies the received width, with
\[
P(W = w) = \frac{1}{2^b},
\qquad
P_{\text{detection}} = \left(1 - \frac{1}{2^b}\right)^{d_{\max}+1},
\qquad
P_{\text{protection}} = 1 - \frac{1}{2^b}.
\]
With `b=3`, the longest undetected full-frame injection run was `0.2 s` with `~0.19% probability`, while stopping required `≥2.58 s` dwell time [2410.05417]. In this setting, AgentStop is adversarially induced and then actively countered.

Across these literatures, the open problem is not whether agents can be stopped, but where, by whom, and on what semantic basis. Runtime systems emphasize pre-execution interception, policy composition, and auditability. Early-stopping systems emphasize efficiency and resource stewardship. Formal methods emphasize state-space structure and correctness preservation. Foundational work emphasizes incentive design. The research record to date indicates that no single stopping mechanism subsumes the others: effective AgentStop is inherently layered.

Source: https://www.emergentmind.com/topics/agentstop