Skip to content

Budgeted Verification of Inherited Agent Constraints

Agents rarely re-check an inherited constraint that reads as settled. Under a scarce verification budget they act on limits already withdrawn.

Budgeted constraint verification decides which inherited memories an agent re-checks when it can only re-check a few. Nakayashiki (2026) gave sixteen models a six-record store, two inspections, five candidate actions, and one consolidated memory stating a constraint whose source record had since been superseded. Inspection tracked the constraint's presence: agents followed the provenance path "in about one episode in five (20.1%, 23.1%; 66.9%, 72.9% with it removed)".

When this applies

Three conditions have to hold together, and the paper measures each boundary.

The budget has to be scarce. Sweeping it gives a "selection ratio ρ(k)=V(k)/(k/6) of 0.32, 0.51, 0.83 and 1.33 [1.27, 1.39]" at one to four slots, and the constraint's path was named in "5.3%, 17.0%, 41.7% and 88.7% of episodes" (Nakayashiki 2026). At four slots of six the agent over-selects the constraint on its own. The failure lives at two and three.

The stale memory has to state a limit. The deployable rule keys on memories "that state a limit or prohibition on one of the candidate directions" (Nakayashiki 2026). A superseded plain value matches nothing and stays unchecked.

The supersession has to go undetected, and the paper does not measure how often that holds in production. A store that closes the old row on write, as fact supersession memory does, keeps the stale constraint away from the agent entirely.

Why it works

Start with what the paper declines to claim: "why native allocation under-verifies the stated constraint is not causally isolated" (Nakayashiki 2026). The mechanism below is an account of the measurements, not a demonstrated cause.

The slot sweep does show the evidence path is reachable and goes unselected, at 17.0% with two slots against 88.7% with four (Nakayashiki 2026). The agent is not failing to find provenance. It ranks that path below the memories backing the plan it already prefers.

Retrieval ranks on relevance, and relevance carries no term for the cost of being wrong. Nakayashiki names the missing question: "A retriever answers what is relevant now?; under a verification budget the agent must also answer which inherited belief is most costly to leave unchecked?". A stated constraint that nothing contradicts scores low on relevance and high on already-answered, which is backwards for staleness risk.

What the numbers show

Native allocation "produced stale-consistent decisions in 77.3%, 74.7% and 74.7% of episodes across a primary run, a replication and a held-out domain" (Nakayashiki 2026). Three quarters of decisions followed a withdrawn limit.

Two interventions, and only one is yours to run. Forcing a slot onto the critical path "raised current-record-consistent decisions from 34/150 to 145/150 in the primary run: +74.0 points [+68.0, +80.0]" (Nakayashiki 2026). That oracle "uses experimenter knowledge of the critical path and delivers the record unsolicited and first", so the +74.0 covers delivery as well as allocation. The paper rules it out as "not a deployable policy". Read it as a ceiling.

The deployable half is target-blind. Telling the agent to prefer memories that state a limit on a candidate direction moved allocation onto the constraint path by +43.3 points at one slot. At two slots it raised current-record-consistent decisions by "+89.3 [+84.7, +94.0]" (Nakayashiki 2026). Take that second figure with the author's own caveat. He reads the k=2 contrast as combining "compliance with top-two ranking", and not "stale-versus-current precision".

When this backfires

  • Your budget is not tight. Above three inspections the agent reaches the constraint unaided, so the rule buys nothing and still costs you the slot it took.
  • The rule fires on the wrong memory. Its "precision when relevance and staleness diverge is unmeasured" (Nakayashiki 2026), and in a store full of prohibitions a heuristic that prefers all of them ranks nothing.
  • The instruction leaks into the decision. The same limitation notes the rule's "instruction can act on the decision as well as on allocation" (Nakayashiki 2026). An agent told to prefer limit-stating memories may start treating limits as more authoritative, not merely inspect them more often.
  • A deterministic check does the same job outside the budget. StateAuditor proposes state transitions with a model, then verifies chronology and provenance in code, scoring 0.736 against 0.686 on the STALE benchmark (Sun and He 2026). It spends no agent slots.
  • Freshness is already the salient axis. Where the task frames a fact as changeable, models re-check unprompted: bare Qwen verified 12 of 18 freshness items while asking for clarification on 0 of 12 (Li, Yao and Zheng 2026). The blindness is specific to a constraint that reads as closed.
  • Your store looks nothing like the study. Six-record stores, two scripted domains, one system prompt, and unpinned model aliases (Nakayashiki 2026). The outcome measured is action consistency, not belief update.

Example

The study's scenario is a growth setting with declining metrics and five candidate actions. One consolidated memory states a discount constraint (Nakayashiki 2026), and the agent may open two of the six records.

Relevance ordering picks the two records describing the metrics and the leading candidate action. The constraint is not in question, so it goes uninspected and its superseded source record stays unread.

The intervention is one line in the agent's instructions, telling it to prefer inherited memories "that state a limit or prohibition on one of the candidate directions" (Nakayashiki 2026). The discount constraint matches, its provenance path takes a slot, and the withdrawal surfaces. The budget did not change. One of the same two slots moved.

Key Takeaways

  • Rank verification by which inherited belief is most costly to leave unchecked, not by which memory answers the current question. A retriever computes the second ordering and never the first (Nakayashiki 2026).
  • Count your own ratio before adopting the rule: inspections available against records inherited. The effect lives near two of six and is gone by four (Nakayashiki 2026).
  • Ship the target-blind rule, not the +74.0-point figure. That number came from an oracle policy the author rules out as undeployable, and the rule's own +89.3 measures compliance and ranking rather than stale-versus-current precision (Nakayashiki 2026).
  • Watch the rule for a side effect the paper flags and does not measure: it can move the decision as well as the allocation (Nakayashiki 2026).
  • If you own the write path, retire the stale row there and skip this problem entirely.
Emerging — single recent source Last reviewed: 2026-08-31