The Supervisor LLM Trap: Verifying AI Agent Intent at Runtime

The fastest way to make an autonomous agent feel safe is to put another model in charge of watching it. Read the agent's full transcript, including its chain-of-thought, and have a supervisor model decide whether the behavior is acceptable. It is an appealing design. It is also a trap.

Bottom line for CISOs. Intent verification is real and necessary, but a language model that reads another model's reasoning inherits every weakness it was meant to catch: non-determinism, susceptibility to prompt injection, and persuasion. The durable approach evaluates the action an agent is about to take against deterministic policy, treats declared intent as governed evidence with provenance, and uses statistical signals rather than a second model to judge whether an agent is still aligned. Intent is an input to the decision. It is never the decision.

Why The Supervisor Model Is a Trap

Reasoning is persuasive by design. When an agent hits a blocker and reaches for a risky workaround, its internal monologue does not read like an attack. It reads like a competent engineer explaining a sensible next step. A classifier that consumes that justification is being asked to resist the most convincing text in the transcript, and advanced models are very good at producing exactly that text.

The deeper problem is that the supervisor is itself a model reading untrusted input. The same prompt injection that can redirect the agent can target the judge. Anything in the transcript, a tool output, a retrieved document, a crafted user turn, becomes an input to your security control. You have not removed the language model from the trust path. You have added a second one and pointed it at adversarial text.

Reasoning-Blind Is Progress, And Still Probabilistic

The reasoning-blind classifier in Anthropic's Auto mode for Claude Code is a meaningful improvement. The classifier reads only the user messages and the executable tool-call payload. It does not read the assistant's prose or the tool outputs. As Anthropic puts it, "we strip assistant text so the agent can't talk the classifier into making a bad call." Evaluate the action rather than the narrative around it. That removes the persuasion surface, and it is the right instinct.

It does not remove the model. Even reasoning-blind, the gate is still a classifier making a probabilistic call. Anthropic reports a 17% false-negative rate on real overeager actions in their evaluation, and the cause is the part worth sitting with: the classifier correctly recognizes the dangerous operation but cannot verify that the user's consent actually covers that action's scope. "Clean up the PR" does not authorize a force-push. A prior approval does not establish that the blast radius of the current action was ever agreed to. For a file read, a 17% miss is tolerable. For a force-push, a wire transfer, or an external publish, it is the entire risk.

Authorize The Action Against Policy You Wrote

The decision a security program can stand behind is deterministic. The agent proposes a tool call. The control plane evaluates that call, its action, its target resource, and the authority the agent holds, against current, versioned policy. The same request produces the same decision every time, and there is no narrative for an attacker to craft because the narrative is never read.

This is the core of Agent Runtime Governance: authorization before action, enforced by a deterministic control plane that sits outside the agent and cannot be reasoned with. A classifier still has a place in this design, but as a signal that feeds the policy decision, not as the gate that makes it. When the enforcement point is deterministic, a persuasive justification has nothing to act on.

Provenance Over Inference

The failure mode Anthropic reports is instructive. The classifier flags the dangerous operation correctly, then infers that the user's consent stretches to cover it. The fix is to stop inferring consent at all.

Capture intent as a declared input with provenance. An agent's objective can arrive three ways: declared explicitly by the agent or its operator, inferred from the prompt, or absent. Record which one it was. Then write policy that requires declared intent before any high-risk action. A vague phrase now carries inferred or absent provenance, which cannot satisfy a policy that demands a declaration. The agent cannot reach a sensitive capability without first stating, on the record, what it is trying to accomplish, and that declaration becomes part of the audit trail. Inference is fine for low-risk actions. For the ones that can cause harm, require a declaration.

The Tool Registry Is The Contract

A classifier, or a policy, is only as good as the environment boundaries it can see. That makes metadata the highest-leverage investment in agentic security.

A centralized tool and service registry with rich security metadata is what turns a vague judgment into a precise decision: which tools are destructive and which are read-only, what each one can reach, what trust boundary it crosses, and how much damage it could do if misused. That last property is Authority Blast Radius, and it is what lets you tier your controls. Safe-by-default tools, a file read, a local search, can bypass the heavy machinery entirely. Anthropic's Auto mode tiers its controls the same way: a built-in allowlist clears safe operations like file reads and searches, and the classifier is held in reserve for the high-risk actions. The budget goes to the actions that change state, move money, or leave the building. Running an expensive check on everything is how governance gets removed for slowing teams down.

Runtime Alignment Without a Second Model

Authorization answers whether an action is permitted. It does not answer whether the agent is still pursuing the objective it started with. That second question, alignment over the course of a run, is where the supervisor-model instinct came from in the first place. It does not require a model to answer.

Score the agent's behavior statistically. Build a baseline of the action distribution for a given task class, and watch whether a run drifts away from it. A run authorized for analysis that pivots toward bulk export looks different in the distribution long before any single action is individually forbidden. Feed that drift signal into the policy engine as context, so a rising drift score raises the bar on the next high-risk action, or pauses the agent for a human, through the same deterministic policy that authorizes everything else. The alignment check gates the next decision, and there is no second language model to inject or persuade.

This is the shape Karl McGuinness describes when he argues that mission shaping is not enough. Shaping the authority is necessary, but the system stays safe because of what surrounds it. Authorize deterministically. Contain the blast radius with short-lived credentials and strong tool mediation. Let drift gate the next decision. McGuinness calls the goal survivable incorrectness: a control plane that stays governable and limits damage even when the semantic model is partial, noisy, or wrong. Once a language model is in the loop at all, that is the only realistic goal.

The Discipline Is a Strict Runtime Contract

Agentic security is the discipline of a strict runtime contract. The contract is deterministic policy over the action an agent is about to take. Intent is captured as governed evidence with provenance and used as an input to that policy. Behavioral drift is measured statistically and fed back into the same decision. A classifier can advise, but it never holds the gate, and the agent's own reasoning never enters the trust path.

Evaluating an AI's good intentions will always be a probabilistic exercise. Enforcing what it is allowed to do does not have to be.

---

If your teams are putting agents into production, the Agent Runtime Governance workshops work through exactly this: the authorization model, the tool registry and blast-radius classification, and the runtime controls that make it real. Or start with the 12 Principles for Agent Runtime Governance.