AI-as-advisor Protocol

Updated 8 July 2026

AI-as-advisor protocol is a decision framework where AI offers recommendations and critiques while human judgment remains the final authority.
It spans diverse patterns including selective intervention, executable-action auditing, independent aggregation, and model-to-model steering.
Evaluation shifts from model-centric metrics to protocol-centric measures that assess decision quality, reconciliation costs, and advisory safety.

Searching arXiv for the cited works to ground the article and confirm bibliographic details. AI-as-advisor protocol denotes a family of decision architectures in which an AI system contributes recommendations, critiques, drafts, or control signals while final authority remains bounded by a human, by a deterministic verifier, or by a formally specified process boundary. In the cited literature, the protocol is not treated as a single interface pattern but as a design space spanning selective intervention after an independent human judgment, executable-action auditing before outcome evaluation, independent aggregation of human and AI judgments, multi-agent drafting with human approval, and even model-to-model steering in which one model advises another (Noti et al., 2022, Barbieri et al., 25 Jun 2026, Berger et al., 31 Mar 2026, Jiang et al., 7 Nov 2025, Asawa et al., 2 Oct 2025). Across these formulations, the recurrent claim is that advice should be evaluated at the level of its effect on decisions, workflows, and governance rather than as standalone text or predictive output.

1. Conceptual foundations

In high-stakes human-facing formulations, the defining feature of an AI-as-advisor protocol is that the AI does not replace the human decision-maker. In pretrial risk prediction, the protocol is explicitly: case description, human initial prediction, AI risk assessment, AI decision whether to advise, optional advice display, and human final prediction; the human always makes the final decision (Noti et al., 2022). In the high-stakes AIaDM framework of “learning to advise,” the human expert also remains the accountable actor on every case, while the AI offers recommendations selectively and must account for reconciliation costs and the human’s algorithm discretion behavior (ADB), that is, the tendency to imperfectly accept or reject recommendations (Wolczynski et al., 2022).

A related line of work generalizes the same idea to sequential control. In adherence-aware advising, the machine’s action space is the ordinary task action space augmented with a special defer action, so the advisor chooses either a recommendation or silence at each state while the human remains the executor of the environmental action (Chen et al., 2023). This moves AI-as-advisor away from a static “always show the model output” pipeline and toward a policy that decides when intervention is worth the burden it imposes.

Other papers widen the meaning of “advisor” beyond human-facing recommendation. In “Advisor Models,” a small trainable model emits natural-language steering instructions to a stronger frozen black-box LLM, so the advised entity is another model rather than a person (Asawa et al., 2 Oct 2025). At the opposite end of the control spectrum, the negotiation study on advisors, coaches, and delegates distinguishes proactive recommendations from reactive feedback and autonomous execution, showing that “advisor” is specifically a proactive recommendation modality rather than a synonym for any AI assistance (Zhu et al., 12 Feb 2026). This suggests that AI-as-advisor is best treated as a bounded intervention role, defined by who retains authority and how advice enters the decision process, rather than by any single model class or interface.

2. Protocol families and interaction patterns

The literature identifies several recurrent protocol families, each with a different decision boundary.

Pattern	Representative formulation	Decision boundary
Selective human-facing intervention	Human gives an initial judgment; AI advises only when intervention is predicted to help (Noti et al., 2022)	Human decides first and last
Adherence-aware or value-aware advising	AI recommends or defers based on expected team value and contradiction cost (Chen et al., 2023)	Human executes action
Executable-action auditing	Advisor text is normalized into candidate orders and deterministically verified before return is computed (Barbieri et al., 25 Jun 2026)	Verifier decides admissibility
Independent aggregation	Human and AI judge independently; a second human resolves disagreement (Berger et al., 31 Mar 2026)	No direct advice uptake at disagreement
Human-validated drafting	AI retrieves, asks follow-up questions, drafts a response, and a human advisor approves delivery (Jiang et al., 7 Nov 2025)	Human approves outgoing advice
Model-to-model steering	A small advisor model issues per-instance textual guidance to a frozen black-box model (Asawa et al., 2 Oct 2025)	Student model produces final output

The selective-intervention family is the most explicit about timing. “Learning When to Advise Human Decision Makers” defines the “correct times” as cases where the algorithm’s prediction is more accurate than the human’s initial prediction, and trains a binary policy to show advice only on those cases (Noti et al., 2022). The value-centered advising papers extend this by adding reconciliation cost and expert-specific behavior. In “The Value of AI Advice,” the recommended advisor is selective, personalized, and optimized for context-specific trade-offs between decision improvements and advising costs rather than for predictive quality alone (Wolczynski et al., 2024). “Learning to Advise Humans in High-Stakes Settings” similarly treats silence as an explicit option, because contradictory advice consumes time and effort even when it is ignored (Wolczynski et al., 2022).

A second family treats advice as a proposed action under a contract. “Auditing AI Investment Recommendations as Executable Actions” insists that an investment recommendation should first be audited as an executable financial action, not primarily as text and not even primarily as a prediction (Barbieri et al., 25 Jun 2026). Frozen scenario data and advisor output are passed through a normalizer and deterministic verifier, which emits either admissible orders or typed violations before any return is computed.

A third family rejects direct advice uptake altogether. The hybrid confirmation tree preserves the independence of human and AI judgments: Human 1 and AI judge independently, agreement is accepted, and disagreement is resolved by a second independent human (Berger et al., 31 Mar 2026). The paper presents this as an alternative to classical AI-as-advisor precisely because humans are often poor at deciding whether conflicting AI advice is correct.

Higher-education advising introduces a workflow-centric variant. AdvisingWise uses a multi-agent pipeline that extracts student context, retrieves institutional information, asks follow-up questions when needed, drafts a response package with sources and uncertainty notes, and requires human advisor validation before anything is sent to the student (Jiang et al., 7 Nov 2025). Aurora takes a neuro-symbolic version of the same pattern, placing SQL retrieval and Prolog rule enforcement before LLM explanation so that the model verbalizes validated advising outputs rather than inventing them (Lugones et al., 20 Feb 2026).

3. Objectives, metrics, and evaluation logic

A central shift in the literature is from model-centric metrics to protocol-centric ones. In the value-maximizing advisory framework, expected team loss is written as

$\mathcal{L}(y,\hat{y},h,\hat{p}(a),\alpha)=\hat{p}(a)\mathcal{V}(y,\hat{y})+\big(1-\hat{p}(a)\big)\mathcal{V}(y,h)+\alpha\mathbbm{1}\{\hat{y}\neq h\},$

where $\hat{p}(a)$ is estimated advice acceptance, $\mathcal{V}$ is context-specific decision loss, and $\alpha$ is the advising cost-benefit trade-off (Wolczynski et al., 2024). “Learning to Advise Humans in High-Stakes Settings” uses an analogous Team Loss that combines discretion-adjusted decision loss with reconciliation cost, formalizing the claim that contradictory advice is itself costly (Wolczynski et al., 2022). In the sequential setting, adherence-aware advising adds a penalized reward $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ , so “advise now” versus “defer now” becomes an optimal-control decision under an explicit intervention penalty (Chen et al., 2023).

The executable-action literature sharpens this decomposition further by refusing to compress distinct properties into a single score. For repeated runs on a frozen scenario, the investment-audit protocol defines validity $V$ , set-stability $S$ , amount-aware stability $S_w$ , and agreement $A$ with a deterministic baseline, and argues that these should not be collapsed because they correspond to different failure classes (Barbieri et al., 25 Jun 2026). The paper’s most vivid result makes the point numerically: in a 120-scenario bank, the “Agreement split” control achieved agreement $0.94$ but validity $\hat{p}(a)$ 0, yielding an agreement-only false-positive rate of $\hat{p}(a)$ 1; in the authors’ phrasing, agreement certified an invalid action in $\hat{p}(a)$ 2 of those runs (Barbieri et al., 25 Jun 2026). On the adversarial frontier-model set, GPT-5.5 and Opus-4.8 were valid in only $\hat{p}(a)$ 3 and $\hat{p}(a)$ 4 of bare-prompt runs, while supplying the arithmetic deterministically lifted validity to $\hat{p}(a)$ 5 and $\hat{p}(a)$ 6, supporting the paper’s claim that “computation, not judgment, dominates admissibility failure” (Barbieri et al., 25 Jun 2026).

Human-behavior metrics are equally central in selective-advising work. In pretrial prediction, advising policy quality is measured by whether advice is shown at the “correct times,” while downstream decision quality uses linear and quadratic scores and advice uptake is quantified through influence and acceptance rate (Noti et al., 2022). The learned advising policy chose the correct times $\hat{p}(a)$ 7 of the time, compared with $\hat{p}(a)$ 8 for the always-advise Update condition, and achieved quadratic score $\hat{p}(a)$ 9 versus $\mathcal{V}$ 0 for Update and $\mathcal{V}$ 1 for No Advice (Noti et al., 2022).

Independent aggregation introduces a different evaluation baseline. The hybrid confirmation tree outperformed the AI-as-advisor approach on all 10 datasets studied, with a pooled improvement of $\mathcal{V}$ 2 percentage points and 95% HDI $\mathcal{V}$ 3 (Berger et al., 31 Mar 2026). The mechanism analysis is explicitly behavioral: when AI and human disagreed and AI was correct, humans in advisor mode adopted the correct AI advice only $\mathcal{V}$ 4 of the time, whereas HCT tiebreakers sided with the correct AI answer $\mathcal{V}$ 5 of the time (Berger et al., 31 Mar 2026). This suggests that in some regimes the core bottleneck is not model accuracy but the human ability to discriminate correct from incorrect advice during disagreement.

4. Major application domains

Finance has become one of the most technically explicit domains for AI-as-advisor protocols. The executable-action audit paper treats investment advice as candidate orders subject to cash constraints, fee logic, concentration caps, universe restrictions, and fact-grounding rules, with a deterministic replayable baseline and typed violations such as “cash overrun,” “below-floor order,” “fee-worsening split,” and “ungrounded cited fact” (Barbieri et al., 25 Jun 2026). A distinct finance study examines conversational personalized advisors and reports a split result: LLM-advisors often match human experts in preference elicitation on simpler profiles, but the average elicitation accuracy of the LLM variants was $\mathcal{V}$ 6 versus $\mathcal{V}$ 7 for the human expert, and the hardest “risk-taking value investor” profile fell to $\mathcal{V}$ 8, $\mathcal{V}$ 9, and $\alpha$ 0 for the three LLM variants versus $\alpha$ 1 for the expert (Takayanagi et al., 8 Apr 2025). Downstream personalization was beneficial only when elicitation succeeded: personalized advice achieved Spearman’s $\alpha$ 2 when elicitation was successful but $\alpha$ 3 when it was unsuccessful, indicating harmful personalization rather than mere ineffectiveness (Takayanagi et al., 8 Apr 2025).

Higher education has produced two complementary implementations. AdvisingWise is a human-in-the-loop multi-agent framework in which all system responses undergo human advisor validation before delivery, and the information-collection phase proceeds through a ReAct-style loop of up to four iterations using search_knowledge_base, search_course_db, search_web, request_student_info, and provide_answer (Jiang et al., 7 Nov 2025). In expert evaluation, 16 of 19 scored responses received accuracy scores of 4–5, including 12 with the maximum score of 5 (Jiang et al., 7 Nov 2025). Aurora instead combines a BCNF curricular schema, SWI-Prolog constraint checking, SQL retrieval, and an instruction-tuned LLM explanation layer, improving semantic alignment with expert-crafted answers from $\alpha$ 4 to $\alpha$ 5 and delivering mean latency $\alpha$ 6 s across 20 queries versus $\alpha$ 7 s for the Raw-LLM baseline (Lugones et al., 20 Feb 2026).

Negotiation and strategic interaction expose a different design axis: the choice among advisor, coach, and delegate. In the three-player bargaining study, participants preferred the Advisor modality, selecting it $\alpha$ 8 of the time as their preferred mode, but achieved the highest mean individual gains with the Delegate, producing the paper’s stated “preference-performance misalignment” (Zhu et al., 12 Feb 2026). The mechanism analysis attributes this to delegation’s ability to inject higher-quality, Pareto-improving offers into the market. By contrast, in Advisor and Coach modes, human intervention filtered or diluted strong proposals (Zhu et al., 12 Feb 2026).

Model-to-model advising extends the paradigm beyond human-AI teaming. Advisor Models train a smaller open-weight model with GRPO to emit free-form natural-language steering instructions for a stronger black-box LLM on a per-instance basis (Asawa et al., 2 Oct 2025). The strongest gains appear in hidden-latent personalization tasks: review-length reward rises to about $\alpha$ 9, review-level accuracy reaches $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ 0, and math-solution preference reward reaches $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ 1, all substantially above static prompt optimization baselines (Asawa et al., 2 Oct 2025). The same paper also reports a failure mode of “over-advising,” where the advisor stops steering and starts solving the task itself (Asawa et al., 2 Oct 2025).

5. Governance, safety, and contestability

The safety literature surrounding AI-as-advisor protocols emphasizes that advice can shape behavior, trust, and authority relations in ways that are not captured by accuracy. “The corruptive force of AI-generated advice” shows that dishonesty-promoting AI advice increased reported die outcomes by $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ 2 relative to no advice, from $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ 3 to $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ 4, and that transparency about the advice source did not significantly reduce this effect; the AI’s corrupting force was statistically indistinguishable from human advice (Leib et al., 2021). This result directly challenges the idea that source disclosure alone is an adequate safeguard for advisory systems.

A different but related warning comes from personalized financial advising. In the persona study, the extroverted advisor produced worse decision-quality impact than the conscientious advisor, yet users reported higher willingness to use it, and—when elicitation succeeded—higher emotional trust as well (Takayanagi et al., 8 Apr 2025). The paper’s own interpretation is that social fluency and positive affect can increase reliance independently of advice quality. A common misconception therefore follows: user trust is not a reliable indicator of advisor quality. The data suggest the opposite can occur.

The governance response in several papers is structural rather than merely behavioral. The AI-SDLC protocol language introduces capability boundaries, validation tokens, non-overridable blockers, disagreement policies such as split -> require_human, and a 2+N team pattern with two human-in-control roles plus specialized agent members (Prifti, 24 May 2026). Its explicit argument is that prompting an agent to “act as an advisor” is behavioral compliance, whereas capability boundaries and token-gated transitions are structural enforcement (Prifti, 24 May 2026). HADA applies a related idea at the organizational level through role-specific stakeholder agents, a controller that enforces routing and policy, catalogues for values and business targets, and a decision ledger that captures model version, feature vector, applied policy, and outcome for each decision (Pitkäranta et al., 1 Jun 2025). In the banking proof of concept, a customer complaint about ZIP-code use triggered an ethics ticket, metadata updates, a watch-list change, retraining, and redeployment, illustrating contestability as a workflow rather than a static explanation feature (Pitkäranta et al., 1 Jun 2025).

Human validation remains the strongest boundary in service-oriented advisory settings. AdvisingWise is explicit that the system is not allowed to deliver substantive advising answers autonomously; the advisor reviews, edits, and approves the draft package before anything reaches the student (Jiang et al., 7 Nov 2025). The executable finance-audit work places the boundary inside deterministic code rather than a human review queue: arithmetic, fee logic, concentration checks, and grounding checks are owned by the verifier, and only admissible actions proceed to any downstream performance discussion (Barbieri et al., 25 Jun 2026). These architectures differ in mechanism, but both treat advisory safety as a property of the surrounding protocol rather than of the model output alone.

6. Limitations, unresolved questions, and likely trajectories

Several limitations recur across the literature. Many selective-advising studies rely on controlled experiments or simulated human behavior rather than long-term field deployment. The pretrial advising study notes that its evidence comes from MTurk workers rather than domain experts and that long-term equilibrium effects remain open (Noti et al., 2022). The adherence-aware sequential model assumes stationary adherence $r^M_{h,\beta}(s,a)=r_h^M(s,a)-\beta\mathbb{I}\{a\neq\text{defer}\}$ 5, full state observability, and no strategic or reactive human behavior, which the paper itself presents as strong simplifications (Chen et al., 2023). The value-maximizing advisory framework also relies heavily on modeled or simulated expert behavior and calls for low-stakes validation with real users before deployment (Wolczynski et al., 2024).

Domain-specific systems face their own external-validity problems. The personalized finance study is lab-based, role-played, and limited to four assets per profile; it explicitly leaves open whether stronger models, real investors, or better uncertainty displays would change harmful over-trust patterns (Takayanagi et al., 8 Apr 2025). AdvisingWise is evaluated with eight advisors from a single CS department, and Aurora’s results come from synthetic student profiles rather than live institutional deployment (Jiang et al., 7 Nov 2025, Lugones et al., 20 Feb 2026). The network-exposed AI session architecture proposes DISCOVER, AI PAGING, atomic PREPARE/COMMIT, and make-before-break MIGRATION, but the paper identifies portable state classes, truthfulness and safety auditing, and practical session-state management as open problems (Saimler et al., 17 Feb 2026).

Methodological alternatives also remain unsettled. The hybrid confirmation tree performs strongly on binary tasks, but the paper notes additional work is needed for multiclass, ranking, or open-ended settings and for more realistic staffing trade-offs (Berger et al., 31 Mar 2026). Advisor Models show large gains in personalization and transfer, yet the authors explicitly acknowledge over-advising, noisy reward assignment, and weaker gains on internal reasoning tasks (Asawa et al., 2 Oct 2025). The AI-SDLC protocol language and HADA both present convincing governance architectures, but both are explicit that empirical evaluation at scale remains future work (Prifti, 24 May 2026, Pitkäranta et al., 1 Jun 2025).

These unresolved points suggest that the next stage of AI-as-advisor research will likely center less on generic benchmark accuracy and more on protocol synthesis: how to combine selective intervention, executable verification, calibrated trust, structural authority boundaries, contestability, and replayable logs in domain-specific workflows. The literature already supports one general conclusion: advisory quality is not reducible to model quality. In high-stakes settings, the protocol that determines when advice is produced, how it is validated, who can overrule it, and how it is audited is part of the decision system itself.