Audit Packet: The Agent Acts Before It Decides

The central judgment, what it is supported to claim, and what it is not.

Verdict: SUPPORTED FOR PUBLICATION WITH MATERIAL CAVEATS.

The central mechanism is well supported: some speculative agent runtimes can issue predicted external tool calls before committing to the branch that requires them, and an abandoned call can disclose inferred user intent even when its result never appears in the final answer. Evidence also supports the control conclusion that intervention before dispatch is materially different from remediation after an external observer has already received the request. 123

The evidence does not support claims that:

• all tool-using agents speculate;
• ordinary parallel tool use is inherently speculative;
• speculative external dispatch is already common in enterprise production;
• a named vendor product currently leaks inferred user intent;
• issue-time privacy controls are universally required by law;
• any adoption, incident-rate, market-size, or business-impact figure can be stated.

The strongest direct evidence is recent and partly preprint- or benchmark-based. Confidence is high in the technical mechanism, moderate in its near-term enterprise relevance, low in any estimate of prevalence, and moderate in the 12–24 month platform-control forecast.

The seven questions under test, and what was deliberately excluded.

The audit tested seven questions:

1. Can a speculative runtime issue a tool call before branch commitment?
2. Can an abandoned call expose intent through arguments, destination, timing, or metadata?
3. Can commit-time cleanup undo a disclosure already observed externally?
4. Do pre-dispatch controls differ materially from post-issue controls?
5. Does task success or API correctness establish purpose-bound privacy across intermediate calls?
6. Can tool schemas create disclosure channels by permitting weakly constrained service-bound arguments?
7. What enterprise control and audit changes follow from the mechanism?

The audit also tested the brief’s dissent and forecast against the source record. It deliberately excluded production prevalence, vendor-specific incidents, legal mandates, and realized business outcomes because the evidence set does not establish them.

Each public claim, the evidence behind it, the verdict, and the boundary.

Autonoma analytic synthesis

Two conclusions are analytic synthesis rather than direct quotations from a single source:

1. The decisive enterprise control point is issue time when an uncommitted request can cross the trusted boundary.
2. Audit should distinguish proposed, issued, promoted, abandoned, and committed tool events rather than recording only the final action path.

These conclusions are supported by the combined mechanism, benchmark, safety-guidance, and lifecycle-governance evidence. 1478

Moderate-confidence forecast

Within 12–24 months, leading enterprise agent platforms will begin adding explicit private-planning or no-dispatch modes, attempted-call provenance, destination and argument policy, and issue-time authorization for externally observable speculative calls.

This is a forecast, not a documented current market state. It is supported by the latency incentive, the newly articulated issue-time mechanism, trajectory-level privacy research, and existing input-validation and approval primitives. 12347

What each source is competent to prove — and its limitation.

Source-role conclusion

The core mechanism is supported primarily by independent research. Vendor documentation is used only to describe documented execution behavior or recommended controls. NIST provides a general governance framework, not a rule specific to speculative calls. No vendor source is used to claim fairness, safety outcomes, reduced leakage, or production prevalence.

The strongest objections, their weight, and how each could be falsified.

Counterargument 1: The risk is architecture-dependent, not inherent to agents.

Weight: Strong. Accepted.

A runtime that keeps planning local, disables speculative dispatch, uses tenant-controlled shadow services, or requires confirmation before external access may largely avoid this mechanism. Ordinary parallel tool use may consist entirely of committed calls. 167

Falsification test: Instrument the runtime and show that no uncommitted request crosses an external trust boundary. If every external call occurs only after branch commitment, the brief’s central mechanism is absent for that system.

Counterargument 2: The evidence is too new to justify broad enterprise conclusions.

Weight: Strong. Accepted in part.

Several central sources are recent preprints or benchmarks. They support a technical mechanism and control problem, not a claim of widespread enterprise exposure.

Falsification test: Replicate the issue-time leakage result across different agent frameworks, models, tool classes, and real enterprise-like workflows. Failure to reproduce external disclosure outside the original settings would lower confidence in generalizability.

Counterargument 3: Existing access controls and approvals already solve the problem.

Weight: Moderate. Partly rejected.

Existing controls can reduce risk, but only when they mediate the request before external dispatch. A valid permission to use a service does not establish that every speculative argument is purpose-appropriate, and an approval applied after issuance cannot reverse prior observation. 17

Falsification test: Demonstrate that existing policy blocks or minimizes sensitive content in every issued-but-abandoned request, not merely in committed actions.

Counterargument 4: The latency benefit may not justify extra control complexity.

Weight: Moderate. Open.

The tradeoff is deployment-specific. Systems with small tool latency or highly sensitive data may rationally disable speculation; others may retain it behind local shadow execution or strict issue-time policy.

Falsification test: Measure latency gain against exposure reduction across control modes. If no meaningful latency benefit remains after safe mediation, speculation may not be worth operating.

Confidence by dimension, and the material limits of the analysis.

Material limitations

• Several central papers are preprints.
• The evidence set does not measure production incidence.
• No named vendor product is proven to issue abandoned speculative external calls.
• Architecture determines whether an external observer exists and what it can see.
• The brief’s HR and L&D examples are illustrative applications of the mechanism, not documented incidents.
• NIST and vendor guidance support general control logic, not a binding mandate or guaranteed outcome.

A sandboxed issue-time exposure test that uses no real employee data.

An enterprise can test for issue-time privacy exposure without using real employee data.

Test setup

1. Create a sandboxed agent workflow using synthetic workforce scenarios—for example, a fictional internal-transfer request, learning recommendation, benefits question, or performance-support case.
2. Connect controlled mock tools representing an internal system, a tenant-controlled shadow service, and an external service. Do not use production employee records.
3. Instrument five event states: proposed, issued, promoted, abandoned, and committed.
4. Seed synthetic intent markers in the prompt or context so exposure can be measured without using sensitive real-world data.
5. Enable the runtime’s speculative or low-latency mode and create branch alternatives that cause some predicted calls to be abandoned.
6. Capture both runtime and service-side traces including destination, arguments, timing, response use, and final-plan membership.

Compare these control modes

• speculation disabled;
• dispatch deferred until commitment;
• tenant-local shadow execution;
• destination policy;
• argument minimization or rewriting;
• explicit confirmation for high-risk calls;
• post-issue logging only.

Core measures

• issued-but-abandoned external call rate;
• synthetic intent-marker exposure rate;
• percentage of external calls represented in the committed-action log;
• time saved by speculation;
• exposure reduction by each pre-dispatch control;
• false blocks and operational latency introduced by the controls.

Pass condition

A system should not be considered issue-time-governed merely because its final actions are logged. The stronger pass condition is that every externally issued call is either committed or explicitly recorded as an abandoned attempt, and sensitive arguments are blocked, minimized, or held inside the trusted boundary before dispatch.

How sources were reviewed and what was deliberately excluded.

The audit reviewed eight public sources, separated independent research from vendor behavior, vendor guidance, and government framework material, and evaluated each public claim against its stated scope. Claims were excluded when the evidence did not support production prevalence, universalization, legal mandate, vendor-specific accusation, or quantified business impact. The forecast was assessed separately from factual claims. The public brief and this packet use the same evidence boundaries.

Numbered to match the citations in Brief №014 and in this packet.

1. Mohammadi, Klein, Arora, and Bindschaedler — Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools, arXiv, 2026.
2. Sui et al. — Parallelizing Tool Execution and LLM Generation for Low-Latency Agent Serving, arXiv, v3, 2026.
3. Hooper et al. — Speculative Interaction Agents: Building Real-Time Agents with Asynchronous I/O and Speculative Tool Calling, arXiv, v2, 2026.
4. Hu, Liu, Meng, and Zhao — ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents, arXiv, 2026.
5. Shayesteh and Wilson — From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing, ACL PrivateNLP, 2026.
6. Anthropic — Parallel tool use, Claude Platform documentation.
7. Microsoft — Agent Safety, Microsoft Agent Framework documentation.
8. National Institute of Standards and Technology — AI Risk Management Framework, AI Resource Center.