Risk-Aware Perimeter Controller

• Risk-aware perimeter controllers integrate explicit boundary objects with risk quantification to mitigate unsafe system behaviors.
• They apply to various domains such as tool supervision, safe-set enforcement, obstacle avoidance, and network traffic control.
• By modulating exposure via metrics like CVaR, spectral risk, and barrier functions, these controllers balance safety and performance.

A risk-aware perimeter-style controller is a control or supervisory architecture that enforces a boundary—over actions, states, obstacles, inflows, or access paths—using an explicit notion of risk rather than relying only on nominal optimization or raw predictive confidence. Across recent work, the “perimeter” may be the visible action set of a tool-using agent, the superlevel-set boundary of a control barrier function, an uncertainty-inflated obstacle buffer in model predictive control, or the inflow boundary of a protected traffic region. This suggests a unifying interpretation: the controller acts at the boundary of what is allowed, reachable, or exposed, and modulates that boundary according to uncertainty, tail risk, authorization, or congestion structure (Iyer et al., 11 Jun 2026, Kishida, 2023, Eom et al., 2 Jun 2026, Li et al., 2024).

1. Canonical forms of the perimeter

The literature does not present a single standardized definition of a “risk-aware perimeter-style controller,” but it repeatedly instantiates the same architectural idea in different domains. In each case, a controller does not merely choose a nominal action; it constrains a boundary object and uses that boundary as the primary safety interface. In this sense, the perimeter is the controlled interface between admissible and inadmissible behavior.

Formulation	Perimeter object	Risk mechanism
Capability supervision	Visible and callable tools	Authorization, explicit risk labels
Safe-set enforcement	Barrier-defined state boundary	CVaR, level-crossing probability
Obstacle avoidance	Inflated hazard buffer	Spectral risk, prediction sets, sensing fusion
Traffic/network control	Region inflow boundary or risky state region	Congestion signals, stochastic MPC, runtime shielding

A closely related network-control interpretation appears in ReGuard, where the “perimeter” is a symbolic boundary around high-regret operating regions, and intervention occurs only when a risky state is detected (Hè et al., 6 May 2026). A complementary enterprise-security interpretation appears in zero-trust RAdAC architectures, where the traditional coarse perimeter is replaced by transaction-level, context-sensitive gating at zone or resource boundaries, with firewall rules updated in response to each access decision (Lee et al., 2017). These formulations differ in plant model, optimization, and guarantee type, but they share the same structural role: the controller governs exposure at the boundary rather than directly replacing the nominal decision-maker.

2. Capability perimeters and runtime least privilege

The most explicit formulation of a perimeter-style controller appears in the runtime supervision of tool-using language-model agents. In "Capability Minimization as a Safety Primitive: Risk-Aware Causal Gating for Least-Privilege LLM Agents" (Iyer et al., 11 Jun 2026), Risk-Aware Causal Gating (RACG) is described as a perimeter-style capability controller and a supervisory access-control layer around another policy/model. The decision setting is a sequential tool-selection problem over a library

$\mathcal{T}=\{t_1,\dots,t_n\},$

with tool contracts

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$

Here $R_i$ are preconditions, $E_i$ are effects, $c_i$ is optional cost, $\rho_i\in\{low,med,high\}$ is a risk level, and $\alpha_i\subseteq \mathcal{X}$ is the set of authorization variables required before a risk-bearing tool may be exposed. The system state is $s_t\subseteq\mathcal{X}$, the goal is $g\subseteq\mathcal{X}$, a controller chooses a visible set $\mathcal{V}_t\subseteq\mathcal{T}$, the base agent chooses $t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$0, and the transition is

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$1

This formulation treats visibility as authority. RACG does not ask whether the model is uncertain. It asks whether a capability is both causally necessary and authorized at the current state. A tool is executable when $t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$2. A risk-bearing tool is admissible only if

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$3

The visible set is then

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$4

where $t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$5 is the first executable frontier of the minimal-score causal path. The path score is

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$6

with

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$7

This realizes least privilege plus just-in-time privilege escalation in a deterministic gating rule.

The paper also defines attack-surface metrics that are directly usable as controller objectives: $t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$8

$t_i=(d_i,R_i,E_i,c_i,\rho_i,\alpha_i).$9

$R_i$0

The controller seeks to preserve progress toward $R_i$1 while minimizing $R_i$2 and $R_i$3 and driving $R_i$4 to zero. If gating removes all frontier actions, RACG exposes the lowest-risk causal tool establishing a missing authorization variable; if no trusted establisher exists, it fails closed and requires external or user intervention.

The load-bearing assumption is authorization provenance. Authorization facts must lie in a trusted partition $R_i$5, and no content producer may include any authorization variable in its effects. Under enforced tool visibility, immutable contracts and risk labels, trusted authorization provenance, and no platform bypass, an injected instruction targeting a high-risk tool not in $R_i$6 has success probability $R_i$7 because the capability is absent, not because the model refused it. This is an access-control invariant, not a probabilistic calibration theorem.

Empirically, this perimeter interpretation is reflected in exposure control. In the RiskGate benchmark, RACG at $R_i$8 achieved benign-task Success $R_i$9, $E_i$0, $E_i$1, $E_i$2, and injection success $E_i$3, whereas all-tools and confidence-like baselines left nonzero exposure or injection success. The same study also shows the boundary condition of the guarantee: with intact authorization provenance, ISR $E_i$4; when authorization variables can be forged by attacker-controlled content, ISR rises to $E_i$5. A common misconception is that this is a conformal or distribution-free risk-control method. The paper explicitly states the opposite: there are no calibration sets, no selective-risk bounds, and no theorem of the form $E_i$6. “Causal” here means causal dependency in a contract-defined task graph, not causal effect estimation in an SCM or potential-outcome sense.

3. State-space perimeters from barrier functions and tail risk

In physical control, the perimeter is usually a safe-set boundary. The safe set takes the form

$E_i$7

and the controller’s task is to keep the state inside $E_i$8 with an explicit treatment of uncertainty. "A Risk-Aware Control: Integrating Worst-Case CVaR with Control Barrier Function" develops a discrete-time risk-aware control barrier function for nonlinear systems with stochastic disturbances and a moment-based ambiguity set $E_i$9 (Kishida, 2023). Its core condition is

$c_i$0

which upper-bounds the worst-case tail risk of next-step safety loss. For half-space and polytope safe sets this yields QP-based online controllers; for ellipsoids it yields an SDP-representable convex quadratically constrained problem. In perimeter terms, the controller does not merely stay on the safe side of the boundary in expectation. It maintains a risk-calibrated interior offset whose size depends on worst-case tail risk under distributional ambiguity.

"Safety Under Uncertainty: Tight Bounds with Risk-Aware Control Barrier Functions" instead treats a continuous-time Itô SDE and derives a finite-time unsafe-crossing probability bound using a level-crossing argument rather than the martingale arguments common in earlier stochastic CBF work (Black et al., 2023). With

$c_i$1

the RA-CBF condition is formulated through the integrated generator term

$c_i$2

and the auxiliary quantity

$c_i$3

where

$c_i$4

If the RA-CBF condition holds, then

$c_i$5

where $c_i$6 is the probability of crossing the unsafe boundary over the finite horizon $c_i$7. This is a perimeter controller in the literal sense of finite-time boundary-crossing risk management.

A more recent vehicle-envelope formulation appears in "Response-Aware Risk-Constrained Control Barrier Function With Application to Vehicles" (Liao et al., 13 Mar 2026). There the perimeter is a dynamic handling envelope built around body-response variables, with barrier

$c_i$8

The risk-aware condition is imposed on the barrier derivative through CVaR: $c_i$9 Combined with Bayesian online learning of response covariance from prediction residuals, this yields an SOCP-based safety filter around a nominal tracking controller. The paper gives a per-step probabilistic safety bound of approximately $\rho_i\in\{low,med,high\}$0 for the chosen risk level and reports zero boundary violations across all tested scenarios. This formulation is significant because the perimeter is defined in response space rather than through accurate online friction estimation.

4. Prediction-set, sensing, and perception driven perimeter inflation

A second major family of controllers does not move the boundary by changing admissible actions or barrier derivatives; it changes the boundary by inflating the uncertainty buffer around hazards. "Distribution-Free Risk-Aware Planning and Control Under Uncertainty Using Conformal Spectral Risk Control" calibrates prediction-set radii $\rho_i\in\{low,med,high\}$1 using conformal spectral risk control and then converts them into deterministic MPC tightening (Eom et al., 2 Jun 2026). Under the Lipschitz condition

$\rho_i\in\{low,med,high\}$2

the online controller enforces

$\rho_i\in\{low,med,high\}$3

For circular obstacles with

$\rho_i\in\{low,med,high\}$4

this becomes

$\rho_i\in\{low,med,high\}$5

which is a statistically calibrated obstacle-centered perimeter. The guarantee is distribution-free under exchangeability assumptions and controls a spectral risk measure rather than worst-case geometry.

"Learning Disturbances Online for Risk-Aware Control: Risk-Aware Flight with Less Than One Minute of Data" addresses a related problem when the disturbance bound is unknown a priori (Akella et al., 2022). It introduces Surface-at-Risk,

$\rho_i\in\{low,med,high\}$6

for the state-indexed norm of model discrepancy, and fits an upper envelope with Gaussian process regression. The online radius

$\rho_i\in\{low,med,high\}$7

upper-bounds the learned risk surface under stated assumptions. This is naturally interpreted as a state-dependent perimeter thickness for tube MPC, barrier tightening, or reachable-set inflation.

A cooperative-sensing version appears in "Risk Aware Safe Control with Cooperative Sensing for Dynamic Obstacle Avoidance" (Chang et al., 3 Nov 2025). There, LiDAR, camera, and V2X obstacle estimates are fused via a Wasserstein barycenter, and a CVaR-CBF safety filter modulates nominal MPC inputs to maintain a distance-based safety buffer

$\rho_i\in\{low,med,high\}$8

around dynamic obstacles. The implemented AV uses a nominal MPC for path tracking and a safety filter that adapts the protective boundary to sensing and communication uncertainty.

Perimeter inflation can also be perception-driven rather than calibration-driven. "Pedestrian Emergence Estimation and Occlusion-Aware Risk Assessment for Urban Autonomous Driving" estimates hidden pedestrian emergence probability from contextual cues using

$\rho_i\in\{low,med,high\}$9

and evaluates this risk over a forward stopping-distance partition consisting of a danger zone $\alpha_i\subseteq \mathcal{X}$0, a discomfort zone $\alpha_i\subseteq \mathcal{X}$1, and a safety zone $\alpha_i\subseteq \mathcal{X}$2 (Koc et al., 2021). The result is effectively a dynamic forward perimeter around the ego path whose severity depends both on emergence probability and on the zone in which hidden risk lies.

5. Networked, traffic, and infrastructure perimeters

In urban traffic control, the perimeter is often literal: a protected region whose inflow is metered at its boundary. "Generalized Multi-hop Traffic Pressure for Heterogeneous Traffic Perimeter Control" studies a protected urban region with feeder links and replaces homogeneous metering with a two-stage controller: a first-stage homogeneous controller sets total inflow, and a second-stage Softmax redistribution uses multi-hop downstream pressure (Li et al., 2024). The pressure recursion

$\alpha_i\subseteq \mathcal{X}$3

captures congestion deeper inside the protected region, and feeder inflows are allocated as

$\alpha_i\subseteq \mathcal{X}$4

This is not a formal chance-constrained or CVaR controller, but it is a perimeter controller whose boundary policy is explicitly shaped by heterogeneous downstream risk of oversaturation.

A more classical MFD-based formulation appears in "Multi-scale Perimeter Control Approach in a Connected-Vehicle Environment" (Yang et al., 2016). There, the perimeter controller jointly optimizes region-level accumulation and local boundary queues through a coupled MPC objective

$\alpha_i\subseteq \mathcal{X}$5

with a stochastic MPC extension that minimizes expected cost over sampled scenarios when CV penetration is low and measurements are noisy. The design is not expressed through coherent risk measures, but it is uncertainty-aware and directly models the local consequences of boundary gating.

"Sliding Mode Network Perimeter Control" provides a robust nonlinear alternative based on aggregate density regulation near the NFD critical density (Bichiou et al., 2020). With density dynamics

$\alpha_i\subseteq \mathcal{X}$6

the controller defines a sliding surface

$\alpha_i\subseteq \mathcal{X}$7

and implements the final control law

$\alpha_i\subseteq \mathcal{X}$8

This is robust to bounded outflow and disturbance uncertainty, although risk is handled through uncertainty bounds rather than stochastic tail metrics.

In communication and network-control systems, the perimeter may be a risky region of controller state space rather than a physical edge. ReGuard discovers worst-case feasible scenarios for pretrained RL-based network controllers, extracts recurring high-regret patterns, and compiles them into lightweight runtime rules that nudge, clip, or mask actions only in risky states (Hè et al., 6 May 2026). The same boundary logic appears in zero-trust enterprise access control, where FURZE combines RAdAC, fuzzy risk evaluation, decision continuity, and firewall provisioning so that access is re-evaluated continuously at segmentation boundaries rather than being granted once at a static perimeter (Lee et al., 2017). These systems are infrastructural rather than geometric, but they preserve the same supervisory principle: boundary enforcement is the primary risk-control interface.

6. Guarantees, misconceptions, and adjacent formulations

A recurring misconception is that “risk-aware perimeter-style controller” denotes a single guarantee class. The literature instead spans structural invariants, finite-time probability bounds, distribution-free marginal guarantees, CVaR constraints, robust ambiguity-set controllers, and purely empirical robustness. In RACG, the strongest claim is structural: absent capabilities cannot be called if the platform enforces visibility and authorization provenance (Iyer et al., 11 Jun 2026). In RA-CBF methods, the claim is probabilistic: unsafe-boundary crossing over a horizon is upper-bounded under an SDE or moment-ambiguity model (Black et al., 2023, Kishida, 2023). In conformal spectral risk control, the claim is distribution-free marginal validity under exchangeability rather than worst-case geometric safety (Eom et al., 2 Jun 2026). In multi-hop traffic pressure, the paper explicitly states that it is not a fully formal risk-aware controller in the robust or chance-constrained sense (Li et al., 2024).

A second misconception is that all perimeter controllers act on physical distance. Some control the visible action menu rather than motion. RACG makes the visible set $\alpha_i\subseteq \mathcal{X}$9 the security boundary, and ReGuard turns rule-triggered safe action sets into a learned boundary around high-regret states. Conversely, some methods are only perimeter-like in a looser sense. "Risk-Aware Control of Systems with Quasi-Cone-Bounded Nonlinearities" develops a finite-horizon, risk-aware affine state-feedback controller for nonlinear systems enclosed in a cone or shifted-cone uncertainty envelope, but it does not impose explicit safe-set boundaries or barrier constraints (Patel et al., 6 Jun 2026). Its contribution is better read as geometric uncertainty-envelope regulation than as a literal perimeter controller.

A third distinction concerns where the method sits in the control stack. Some papers design runtime supervisors around an existing policy; others tune controller parameters rather than filtering actions online. "Safe Risk-averse Bayesian Optimization for Controller Tuning" is a safe optimization framework over controller parameter space,

$s_t\subseteq\mathcal{X}$0

with safe-set expansion

$s_t\subseteq\mathcal{X}$1

but it does not synthesize a perimeter controller directly (Koenig et al., 2023). Its relevance is strongest as a method for tuning a controller near a safety envelope while preferring low-variance parameter settings.

Taken together, the literature suggests a compact design doctrine. A risk-aware perimeter-style controller first identifies the boundary object that matters—visible capability set, safe-state superlevel set, inflated obstacle buffer, congestion perimeter, or risky state region. It then attaches a risk semantics to that boundary—authorization, worst-case CVaR, finite-horizon crossing probability, spectral-risk calibration, residual-adaptive covariance, or high-regret detection—and finally enforces the resulting boundary with minimal intervention relative to a nominal planner or controller. This suggests that the most reusable idea is not a single algorithm, but a control architecture: make the perimeter explicit, quantify its uncertainty or authority conditions, and let the controller act primarily by shaping that perimeter rather than by trusting nominal decisions to remain safe.