Language-Based Agent Control (LBAC)

• Language-Based Agent Control (LBAC) is a framework that uses language-level artifacts to explicitly define and enforce control over agent behaviors.
• It integrates methods from typed programming, workflow specification languages, and dynamic information-flow governance for secure execution.
• LBAC combines static type checking, runtime policy enforcement, and explicit control boundaries to balance autonomy, security, and efficiency.

Language-Based Agent Control (LBAC) denotes a line of research in which control over agentic systems is expressed and enforced through language-level artifacts rather than through unconstrained prompt-following alone. In one formulation, LBAC is “a new programming model for agentic applications” that extends techniques from programming languages and language-based security by requiring agents to generate programs that are themselves well typed in the context of surrounding scaffolding code; unsafe programs are rejected by the type-checker before execution (Zhou et al., 13 May 2026). In another, the central problem is recast as information flow governance: “dynamic, context-aware” control over what an agent may disclose, transform, or execute, rather than a binary decision over access (Li et al., 13 Oct 2025). A third formulation treats LBAC as governing LLM-based agents by writing “high-level, language-oriented policies” whose enforcement is carried out through system-level information-flow monitoring (Ji et al., 17 Jan 2026). Taken together, these works suggest that LBAC is not a single mechanism but a technical umbrella spanning typed code generation, workflow specification languages, runtime policy engines, graph-based monitors, and verifier-mediated admission boundaries.

1. Formal models and semantic units

A recurring feature of LBAC research is the attempt to replace informal “agent behavior” with explicit state, policy, and execution objects. In the access-control formulation, the system state at timestep $t$ is defined as

$s_t = (u_t, r_t, s_{ten}, n_t),$

where $u_t \in \mathbb{R}^m$ is the identity embedding of the requesting principal, $r_t \in \mathbb{R}^p$ is the relationship embedding with the agent, $s_{ten} \in \mathbb{R}^q$ is the scenario/task embedding, and $n_t \in \mathbb{R}^k$ is the normative-context embedding. Information flow governance is then the process

$\Pi:\mathbb{R}^{m+p+q+k}\to A,$

mapping the combined context $c_t=[u_t; r_t; s_{ten}; n_t]$ to a set of permitted actions $$A=\{\text{allow},\text{deny},\text{redact},\text{summarize},\text{paraphrase}\}$$ (Li et al., 13 Oct 2025).

The programming-languages formulation instead starts from a host language. It assumes “a purely functional, call-by-value host language $L$ with algebraic data types, higher-order functions and a monadic effect discipline,” and an LBAC application consists of developer-written scaffolding code, an LBAC library, and agent-generated code that must type-check before execution. The principal typing judgment is

$s_t = (u_t, r_t, s_{ten}, n_t),$0

and the agent-call rule requires that the generated program $s_t = (u_t, r_t, s_{ten}, n_t),$1 check against the expected type annotation $s_t = (u_t, r_t, s_{ten}, n_t),$2 (Zhou et al., 13 May 2026).

System-level policy frameworks introduce yet another semantic layer. SEAgent models an LLM-based agent system over four domains—Agents $s_t = (u_t, r_t, s_{ten}, n_t),$3, Tools $s_t = (u_t, r_t, s_{ten}, n_t),$4, Users $s_t = (u_t, r_t, s_{ten}, n_t),$5, and RAG databases $s_t = (u_t, r_t, s_{ten}, n_t),$6—with invocation actions $s_t = (u_t, r_t, s_{ten}, n_t),$7, response actions $s_t = (u_t, r_t, s_{ten}, n_t),$8, and a global system state $s_t = (u_t, r_t, s_{ten}, n_t),$9. A round completes when no new invocations are generated. Within that model, privilege escalation is defined relative to an oracle-minimal invocation set $u_t \in \mathbb{R}^m$0, so that an escalation occurs when some emitted invocation is not in $u_t \in \mathbb{R}^m$1 (Ji et al., 17 Jan 2026).

These formalizations differ in surface syntax, but they all externalize control-relevant structure. This suggests that a central LBAC design objective is to move from latent, prompt-internal control to explicit objects that can be checked, composed, logged, or rejected.

2. Control boundaries and execution architectures

A major theme in the literature is where control resides. “The Cartesian Cut in Agentic AI” distinguishes three architectures—“Bounded Services / Boxed Cognition,” “Cartesian Agents,” and “Integrated Agents”—which differ in whether arbitration, stopping, memory updates, and recovery are endogenous to the learned model or exogenous in humans and engineered runtimes (Sainburg et al., 9 Apr 2026). In the Cartesian-agent baseline, the orchestration layer builds a prompt $u_t \in \mathbb{R}^m$2, the LLM emits a trace $u_t \in \mathbb{R}^m$3, and the runtime controller manages termination/stopping criteria, retry policies and error recovery, tool allowlists, sandboxing, rate limits, and memory serialization and retrieval. The paper characterizes the “Cartesian cut” as the boundary between a learned predictive core $u_t \in \mathbb{R}^m$4 and an engineered runtime $u_t \in \mathbb{R}^m$5, with all control-relevant state living in $u_t \in \mathbb{R}^m$6 and flowing into $u_t \in \mathbb{R}^m$7 only when serialized through the interface (Sainburg et al., 9 Apr 2026).

Workflow languages make that boundary explicit. AgentSPEX introduces an “Agent SPecification and EXecution Language” in valid UTF-8 YAML with typed steps, branching and loops, parallel execution, reusable submodules, and explicit state management. Execution occurs in a harness that provides tool access, a sandboxed virtual environment, checkpointing, verification, and logging. The global harness state is $u_t \in \mathbb{R}^m$8, and big-step operational semantics are given for step execution, conditionals, loops, parallel execution, and gather operations (Wang et al., 14 Apr 2026).

Graph orchestration provides a related abstraction. AGORA models an agent’s control-flow and data-flow as a directed acyclic graph $u_t \in \mathbb{R}^m$9 whose nodes are partitioned into reasoning nodes, memory nodes, and action nodes, and whose edges carry either control tokens or data payloads. Each node is equipped with a transition function

$r_t \in \mathbb{R}^p$0

so that orchestration becomes an explicit execution graph rather than an implicit conversational trace (Zhang et al., 30 May 2025).

These architectural treatments converge on a common point: LBAC depends not only on what an LLM predicts, but on the interface through which predictions become control. The literature therefore treats prompt templates, JSON schemas, function-call interfaces, YAML workflows, and graph runtimes as first-order control artifacts rather than peripheral engineering details.

3. Type systems, libraries, and static enforcement

The most formal LBAC line frames agent control as a type-safety problem. In this model, the LBAC library defines a custom monad $r_t \in \mathbb{R}^p$1, abstract data types enforcing provenance, capabilities or labels, and primitives $r_t \in \mathbb{R}^p$2. The static discipline enforces that no effects other than those mediated by $r_t \in \mathbb{R}^p$3 are available, and that policy-relevant abstract types cannot be forged because their constructors are not exported (Zhou et al., 13 May 2026).

The key claim is that policy enforcement can apply uniformly across “the entire application, including both agent-generated behavior and developer-written scaffolding.” The Soundness Theorem states Preservation (Subject Reduction), Progress, and Safety: no sequence of evaluation steps from a well-typed program can perform a disallowed operation. The proof sketch appeals to standard monadic-lambda calculus metatheory, hidden constructors for abstract types, and library-internal runtime checks such as path-subtree checks in $r_t \in \mathbb{R}^p$4 and label checks in LIO (Zhou et al., 13 May 2026).

Three case studies instantiate this approach. In the BibTeX EDSL, dblpFetchBib :: [DOI](https://www.emergentmind.com/topics/diamond-on-insulator-doi-substrate) -> BibIO TrustedBib and appendToBibFile :: FilePath -> TrustedBib -> BibIO () enforce the policy that bibliography entries written to disk must come from the DBLP API. In the capability-based filesystem sandbox, readRIO and writeRIO require an abstract Path, and (//) narrows capability while performing runtime symlink checks. In the information-flow-control case, type DC α = LIO DCLabel α, toLabeled, httpGet, and sendDM are used so that confidentiality and integrity are mediated by Disjunction-Category labels (Zhou et al., 13 May 2026).

A distinctive feature is expressiveness under restriction. Because the monad $r_t \in \mathbb{R}^p$5 is separated from the pure fragment, an agent may write arbitrary side-effect-free computation, including recursion, higher-order functions, data structures, and arithmetic. Agent-generated programs may also recursively invoke subagents through the same agent mechanism, with all subagents inheriting—or tightening—the ambient policy carried by $r_t \in \mathbb{R}^p$6 (Zhou et al., 13 May 2026). This is a stricter notion of agent control than shell approval or regex filtering: the only way to produce an M τ effect is via declared operations whose types already encode the admissible policy surface.

4. Information-flow governance and adaptive policy reasoning

A second major LBAC tradition centers on dynamic context, policy synthesis, and runtime enforcement. The AAC position paper argues that “static, rule-based systems designed for predictable environments are fundamentally ill-equipped to manage the dynamic information flows inherent in agentic interactions,” and proposes Agent Access Control (AAC) with two core modules: multi-dimensional contextual evaluation and adaptive response formulation (Li et al., 13 Oct 2025). Contextual evaluation computes sub-scores $r_t \in \mathbb{R}^p$7, $r_t \in \mathbb{R}^p$8, $r_t \in \mathbb{R}^p$9, and $s_{ten} \in \mathbb{R}^q$0 and aggregates them into

$s_{ten} \in \mathbb{R}^q$1

after which thresholds determine whether the action is deny, redact, summarize, paraphrase, or allow. Adaptive response formulation then transforms the candidate answer $s_{ten} \in \mathbb{R}^q$2 by a chosen $s_{ten} \in \mathbb{R}^q$3, including span masking, summarization, and paraphrasing (Li et al., 13 Oct 2025).

SEAgent realizes runtime LBAC through a mandatory access control framework built on attribute-based access control. It maintains a runtime information-flow graph $s_{ten} \in \mathbb{R}^q$4 over users, agents, tools, and databases; labels entities with attributes such as integrity∈{TRUSTED, UNFILTERED} and tool sensitivity; and evaluates policies $s_{ten} \in \mathbb{R}^q$5 under first-match semantics. The enforcement engine may return allow, deny, or ask, with ask prompting the user with a policy summary and allowing three choices: block, allow-once, or permanently add a new allow rule (Ji et al., 17 Jan 2026).

CSAgent pushes enforcement down to an OS service for computer-use agents. Its context space $s_{ten} \in \mathbb{R}^q$6 stores, for each function entry, a description, security level, anticipated intents, and a mapping from intents to policies. At runtime, the Intent Extractor maps each user request $s_{ten} \in \mathbb{R}^q$7 to one or more predefined intents, the Context Manager maintains a live Context Vector CV, and the Policy Verifier checks every rule in the relevant policy. The resulting complexity is $s_{ten} \in \mathbb{R}^q$8 per action, where $s_{ten} \in \mathbb{R}^q$9 is “typically <100 in practice.” In evaluation, CSAgent “successfully defends against more than 99.36% of attacks” while introducing “only 6.83% performance overhead” (Gong et al., 26 Sep 2025).

Uncertainty-aware, risk-adaptive TBAC adds a second axis to just-in-time policy synthesis. The LLM Judge synthesizes a policy $n_t \in \mathbb{R}^k$0, computes a composite risk score $n_t \in \mathbb{R}^k$1 from resource risks $n_t \in \mathbb{R}^k$2, estimates model uncertainty $n_t \in \mathbb{R}^k$3 by MC-dropout approximation or ensemble disagreement, and escalates to human review when

$n_t \in \mathbb{R}^k$4

The paper states that high-risk or high-uncertainty requests trigger “more stringent controls, such as requiring human approval” (Fleming et al., 13 Oct 2025).

These approaches all treat LBAC as policy-governed mediation over agent actions and outputs, but they differ in what is mediated: typed effects, information disclosures, tool invocations, inter-agent messages, or OS-level function calls. This suggests that “control” in LBAC is best understood as a layered property rather than a single gate.

5. Representative systems and application domains

LBAC techniques appear in a wide range of agentic systems. In zero-shot computer control, the reflective MiniWoB++ agent loops between staged planning, environment execution, and structured reflection. It uses a compact HTML representation of each screen, a planner $n_t \in \mathbb{R}^k$5 that emits up to $n_t \in \mathbb{R}^k$6 executable actions on the current screen, and a reflection module $n_t \in \mathbb{R}^k$7 that identifies the earliest critical mistake at action index $n_t \in \mathbb{R}^k$8 and suggests a corrective action $n_t \in \mathbb{R}^k$9. On the 43 language-only MiniWoB++ tasks, average success on 1-screen, 1-step tasks is 96.4% for $\Pi:\mathbb{R}^{m+p+q+k}\to A,$0 and 99.6% for $\Pi:\mathbb{R}^{m+p+q+k}\to A,$1; on 1-screen, $\Pi:\mathbb{R}^{m+p+q+k}\to A,$2-step tasks, the zero-shot agent reaches 97.3% at $\Pi:\mathbb{R}^{m+p+q+k}\to A,$3; staged planning reduces #LLM calls by ~70% versus iterative planning (Li et al., 2023).

In formal controller synthesis, “LLM-Enhanced Symbolic Control for Safety-Critical Applications” inserts a Code Agent and a Checker Agent in front of Dionysos. The user supplies a natural-language reach-avoid specification, the Code Agent emits Julia code fragments instantiating the problem, and the Checker Agent either outputs CORRECT or a structured list of discrepancies. Across 20 distinct 2D/3D environments paraphrased 3× for 60 natural-language inputs total, direct LLM planning yields 7 correct, Code Agent only yields 34 correct, and Code + Checker yields 39 correct and checked, with 12 incorrect blocked (Bayat et al., 16 May 2025).

Industrial multi-agent systems adopt LBAC for resource adaptation. In the manufacturing architecture with a Central Controller Agent, Resource Database, Environment Model, and LLM Interface, the LLM outputs exploration decisions $\Pi:\mathbb{R}^{m+p+q+k}\to A,$4 that are validated against capability bounds and safety constraints. In the RepastS simulation of a 20-station semiconductor fab with 25 wafer lots, the baseline S1 completed 15 wafers before permanent stalls, whereas S2-1 and S2-2 completed 23 and S2-3 completed 21; the interpretation given is that CCA+LLM recovers ≈ 50–60 % more throughput (Lim et al., 28 May 2025).

Embodied control systems use language as a planning and action interface. LA-RCS is built around a Dual-Agent framework consisting of a Host Agent and an App Agent connected to the CAROBO robot platform. The Host Agent translates the user request $\Pi:\mathbb{R}^{m+p+q+k}\to A,$5 and current state into a Global Plan $\Pi:\mathbb{R}^{m+p+q+k}\to A,$6, while the App Agent iteratively selects low-level control functions such as car_forward, car_back, and car_left from live observations and sensor data. Across four scenario categories—Object Detection, Command Execution, Obstacle Navigation, and Situation Awareness—the paper reports an average success rate of 90 percent, and states that GPT-4o yields an overall success rate of 95% versus 90% for GPT-4-Turbo (Park et al., 23 May 2025).

Other domain-specific systems apply closely related patterns. The multi-agent framework for objective-oriented control design in power electronics decomposes a natural-language controller-design request across a Manager Agent, Objective Design Agent, Model Design Agent, Control Algorithm Design Agent, Control Parameter Design Agent, and Control Verification Agent; the Control Verification Agent reports performance metrics and triggers another iteration when constraints are violated (Cui et al., 2024). The LLM-Agent-Controller uses a Supervisor plus nine specialized agents, Retrieval-Augmented Generation, Chain-of-Thought reasoning, self-criticism and correction, and memory handling, and reports 83% overall task success with an average 87% per-agent correctness across 20 runs per scenario (Zahedifar et al., 26 May 2025). In crowd simulation, an LLM-driven dialogue system and language-driven movement planner produce grouping, ungrouping, and information passing without hand-scripted group rules (Liu et al., 20 Aug 2025).

6. Security bounds, empirical trade-offs, and recurrent tensions

A persistent concern in LBAC is that surface-level policy compliance does not preclude hidden coordination or unsafe long-horizon behavior. “Verifier-Bound Communication for LLM Agents” addresses covert signaling by separating generation from admission: a message enters transcript state only if a small verifier accepts a proof-bound envelope under a pinned predicate $\Pi:\mathbb{R}^{m+p+q+k}\to A,$7. The paper gives an upper bound on transcript leakage in terms of latent leakage plus explicit residual channels, an adaptive composition guarantee, and a semantic lower bound when policy-valid alternatives remain choosable. Empirically, strict-lane evaluation reports max decoder advantage 0.0000, MI proxy 0.0636 bits, and min utility 0.8860; strict full-proof mode has median turn latency 27.53 s and p95 28.08 s, while sampled proving reduces non-proved-turn latency to 0.327 ms (Tailor, 27 Feb 2026).

Another recurrent finding is that stronger structure does not always imply better end-task efficiency. AGORA’s evaluation across GSM8K, AQuA, MATH-500, and MME-RealWorld reports that sophisticated reasoning approaches can enhance agent capabilities, but “simpler methods like Chain-of-Thought often exhibit robust performance with significantly lower computational overhead.” On GSM8K with Doubao-lite-32k, CoT achieves [ACC](https://www.emergentmind.com/topics/agent-cognitive-compressor-acc)=89.31% and C=$0.0558, while SC-CoT is slightly higher in accuracy but \>5× the cost; prompt wording is also highly consequential, since adding “You may take as many thinking steps as needed” in ReAct-Pro boosts AQuA ACC from 34.25% → 64.57% (Zhang et al., 30 May 2025).

Declarative workflow systems make a different trade-off. AgentSPEX externalizes control flow into YAML and reports higher benchmark performance than CoT and ReAct on 7 benchmarks, including 100.0% on AIME 2025 and 43.70% on ELAIPBench. In the user study with 23 participants, 82 % found AgentSPEX easier to read and understand, 78 % said it is easier for new users/non-coders, and 85 % agreed that it makes prompt inspection more direct, although 52 % still preferred LangGraph for very complex/custom workflows (Wang et al., 14 Apr 2026).

The literature therefore rejects two common simplifications. First, LBAC is not merely prompt engineering: it includes type systems, monads, abstract types, ABAC policies, context vectors, graph runtimes, YAML execution languages, and verifier predicates. Second, bottlenecks alone are not sufficient. The CLBC paper states this explicitly: “security claims depend on verifiable admission semantics that are online, deterministic, and fail-closed” (Tailor, 27 Feb 2026). A plausible implication is that future LBAC work will continue to combine explicit control boundaries with stronger semantic guarantees, while negotiating the persistent trade-offs among autonomy, robustness, oversight, interpretability, latency, and computational overhead.