Intent integrity is the ability to prove that an agent’s executed actions remained within the purpose and authority the requester approved. It addresses a gap between identity (“which agent?”) and authorization (“is this tool allowed?”): whether the action still serves the authorized goal.
Intent chain
- Capture a structured request with owner, purpose, constraints, and prohibited outcomes.
- Version the agent, workflow, policy, and tool catalog.
- Separate untrusted content from instructions and label provenance.
- Generate a plan whose steps reference permitted capabilities.
- Evaluate every consequential action against purpose, resource, and risk.
- Bind human approval to the material action fingerprint.
- Reconcile the downstream result with the requested business outcome.
Drift signals
| Signal | Response |
|---|---|
| New tool, destination, or data class | Stop and re-authorize. |
| Retrieved content attempts to redefine policy | Quarantine source and continue only within trusted instructions. |
| Plan expands resource scope | Require a new request or approval. |
| Repeated retries change parameters | Compare fingerprints; fail closed on material difference. |
| Outcome cannot be reconciled | Enter repair state; do not claim completion. |
Evidence contract
Preserve request, purpose, constraints, plan version, retrieved-source references, policy decisions, proposed action, approval, executed request, result, and accepted outcome under one correlation graph. Do not rely on hidden chain-of-thought; record structured decisions and observable events.
Test corpus
Include direct and indirect prompt injection, benign ambiguity, changed destinations, stale approvals, nested tool calls, malicious documents, compromised integrations, and model fallback. The expected result should name the allowed action or safe stop condition.