The Agent Acts Before It Decides

Most enterprise AI controls begin after an agent has chosen an action: authorize the tool, record the call, log the result, review the transaction. Speculative tool execution moves the consequential boundary earlier.

To reduce latency, an agent runtime can predict a tool call and issue it while the model is still deciding which branch to take. If that branch is abandoned, the call may never appear in the final answer or completed-action record. But an external service may already have observed the destination, arguments, timing, and other metadata—and inferred what the user or enterprise was considering. Recent systems research defines this as an issue-time privacy problem: information can leave before the agent commits to the action later preserved in the audit trail. 123

This matters sharply in workforce systems. A career, learning, performance, benefits, security, or employee-support agent may infer sensitive intent before the user states it directly. A speculative request can therefore disclose a possible transfer, skills gap, health-related need, compensation concern, disciplinary issue, or strategic project even when the agent later abandons that path. These are illustrative enterprise scenarios, not claims that a named product currently behaves this way.

The evidence does not show that all agents speculate, that parallel tool use is inherently unsafe, or that this behavior is already common in production. The strongest direct studies are recent and largely preprint- or benchmark-based. The design boundary is nevertheless clear: when an uncommitted call can reach an external observer, governance must act when the request is issued—not only when the final action is approved.

1. An agent can create externally observable data before it creates a committed action. In speculative runtimes, predicted tool calls may be dispatched during model generation or before the final branch is selected. The abandoned call can still carry intent-revealing arguments or metadata. 123
2. A final-action audit trail can be accurate and still be incomplete. If a speculative call is issued and later discarded, the final answer may omit it even though an external service already observed the request. Commit-time cleanup cannot retroactively remove a prior disclosure. 1
3. The effective control point is pre-dispatch. In the bounded Ghost Tool Calls evaluation, controls that changed, suppressed, or delayed a call before issuance reduced exposure; controls applied after issuance generally could not reverse it. 1
4. This is an architecture-dependent emerging risk, not a universal agent defect. Local-only planning, disabled speculation, tenant-controlled shadow execution, strict destination policy, argument minimization, and confirmation before external dispatch can materially reduce exposure. Current evidence establishes a mechanism and active design direction, not production prevalence. 167

Intent becomes data before it becomes action.

Speculation is attractive because tool latency is expensive. A runtime that waits for a model to complete every reasoning step before starting a database query, search, or API call can leave compute and network time idle. Recent systems work therefore explores predicting likely future calls and starting them during generation, or allowing an agent to act while relevant information is still arriving. 23

That optimization changes the privacy model. In a conventional workflow, the system decides, authorizes, then calls. In a speculative workflow, the system may call, observe the result, and only later decide whether the branch was necessary. The external request is no longer merely an implementation detail. It is an observable event that can encode the agent’s current hypothesis about the user.

Consider a hypothetical workforce copilot evaluating several branches: internal mobility, performance coaching, a leave-related process, or an external learning recommendation. The runtime could speculatively query different services to reduce response time, then return only one path. The user sees the committed answer. The other services may have seen the abandoned possibilities. The privacy exposure is not limited to the result of the call; the request itself can disclose what the agent inferred.

This is distinct from ordinary parallel tool use. Multiple calls can all belong to an already committed plan. The concern here is a request sent before the runtime has committed to the branch that requires it. Conflating the two would overstate the problem and weaken the control design. 16

The audit log arrives too late.

Enterprise governance usually asks a retrospective question: What did the agent do? Issue-time privacy adds a second question: What did the runtime expose while deciding?

The distinction matters because a system can complete the right task, call a valid API, and produce a compliant final answer while still disclosing more than the purpose required through intermediate tool calls. ToolPrivacyBench is designed around this gap: task success and API correctness do not, by themselves, establish purpose-bound privacy across the full trajectory. 4

Tool interfaces can amplify the problem. Research on agentic disclosure argues that schemas with weakly constrained fields give models room to construct service-bound arguments that reveal more context than the task requires. The paper is diagnostic rather than an incidence study: it identifies interface conditions that can invite oversharing, not a measured population of realized enterprise leaks. 5

A completed-action log is still useful for accountability, but it may not capture the full external trace. Autonoma Intelligence’s synthesis is that enterprise audit should distinguish at least five states:

• Proposed — the runtime considered a call.
• Issued — a request crossed the trust boundary.
• Promoted — the result became part of the selected branch.
• Abandoned — the branch was discarded after issuance.
• Committed — the action became part of the final plan or transaction.

Without that distinction, an audit can accurately describe the final action and still miss the information exposure that preceded it.

Control moves to the moment of issue.

The central control requirement is complete mediation before an externally observable request leaves the trusted boundary. The Ghost Tool Calls paper states the design rule directly: “Issue-time is therefore the only enforcement point for externally observable speculative dispatch.” 1

That does not imply one universal control. Different architectures can reduce risk in different ways:

• keep speculative planning local;
• use tenant-controlled shadow services;
• suppress external dispatch until branch commitment;
• minimize or rewrite arguments before issuance;
• block sensitive destinations or data classes;
• require explicit confirmation for high-risk calls;
• record attempted and abandoned calls separately from committed actions.

Microsoft’s Agent Framework guidance already treats tool-accessed external services as trust boundaries and recommends validating model-generated arguments and gating high-risk tools before execution. NIST’s AI Risk Management Framework provides the broader lifecycle rationale for governing, testing, measuring, and monitoring risk across the system—not just at the final transaction. Neither source proves that these controls eliminate speculative privacy exposure, but both support the direction of travel. 78

Moderate-confidence forecast: Within 12–24 months, leading enterprise agent platforms will begin adding explicit private-planning or no-dispatch modes, attempted-call provenance, destination and argument policy, and issue-time authorization for externally observable speculative calls.

The forecast rests on three converging pressures: a measurable latency incentive, a newly articulated issue-time privacy mechanism, and growing demand for trajectory-level governance. It remains uncertain because production adoption of speculative external dispatch is not established and local architectures may solve the problem differently.

Watch for these externally observable signals:

1. Platform documentation distinguishes proposed, issued, promoted, abandoned, and committed tool events.
2. Policy layers can rewrite, defer, shadow, or block a call before external dispatch.
3. Audit schemas record destination and argument projections separately from the final plan.
4. “Private planning,” “no-dispatch,” or tenant-local shadow execution becomes a named product mode.
5. Privacy evaluations inspect intermediate tool arguments and backend traces, not only final responses.

Weight: Strong. The strongest counterargument is that this is a narrow runtime-design problem, not a general property of agentic AI. That is correct.

An agent that keeps planning local, does not dispatch uncommitted calls, uses only tenant-controlled services, minimizes arguments, or requires confirmation before external access may largely avoid this specific exposure. Ordinary parallel tool use can be fully committed and therefore should not be treated as speculation. 6

The evidence base also demands restraint. The core mechanism is supported by recent research, but several central sources are preprints or bounded benchmarks. There is no reliable estimate of how often enterprise systems issue abandoned speculative calls, no documented universal incident rate, and no basis for accusing a named vendor product of leaking inferred intent.

The appropriate response is therefore not a blanket ban on speculative execution. It is a requirement to make the architecture observable and governable: prove whether uncommitted calls can cross the boundary, and apply controls before they do.

Enterprise AI governance still models action as a completed transaction. Agentic runtimes increasingly create meaningful traces before that transaction exists.

The practical shift is simple: stop treating the final answer as the complete record of agent behavior. The control plane must govern attempted externalization—the moment an inference becomes a request another system can observe. The question is no longer only, What did the agent do? It is also, What did the agent reveal while deciding?