发表机构
MPI-SWS; MIT CSAIL; Purdue University（马克斯·普朗克软件系统研究所; 麻省理工学院计算机科学与人工智能实验室; 普渡大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出受保护的提交设计，将人工审批纳入LLM工作流状态，通过账本记录和凭据受限的提交适配器确保每个风险路径到达审批门，支持审计与重放。
AI 中文摘要
LLM 工作流在执行不可逆的外部操作之前，通常需要人工审批。大多数系统将该审批置于工作流之外，作为界面点击或审计条目。因此，工作流缺乏提交时检查，无法确保每个风险路径都到达审批门。其日志可能无法保留已审查的证据或重用先前决策的条件。我们提出了一种受保护的提交设计，将人工审批作为工作流状态的一部分。在外部操作执行之前，决策源将决议记录及其引用的证据追加到账本中。然后，一个凭据受限的提交适配器根据工件、策略版本和执行路径检查该记录。我们的证据仅限于轨迹重建。对合成无环工作流计划的验证器测试接受无故障计划，并拒绝每个注入故障的计划：缺失门、错误门类型或不完整的路径覆盖。在总计 271,035 条轨迹的三个公开工作负载中，重放会在存在时重现记录的工件哈希。避免的审查和与记录决策的分歧因工作负载而异。生成的记录支持在决议记录时生效的策略下进行审计和重放。
英文摘要
LLM workflows often require human approval before an irreversible external action. Most systems keep that approval outside the workflow, as an interface click or an audit entry. The workflow therefore lacks a commit-time check that every risky path reached an approval gate. Its logs may not preserve the reviewed evidence or the conditions for reusing an earlier decision. We present a guarded-commit design that makes human approval part of workflow state. Before the external action runs, a decision source appends a resolution record and its referenced evidence to a ledger. A credential-confined commit adapter then checks that record against the artifact, policy version, and executed path. Our evidence is limited to trace reconstruction. A validator test on synthetic acyclic workflow plans accepts unfaulted plans and rejects plans with each injected fault: a missing gate, the wrong gate type, or incomplete path coverage. Across three public workloads totaling 271,035 traces, replay reproduces recorded artifact hashes when present. Avoided reviews and disagreement with recorded decisions vary by workload. The resulting record supports audit and replay under the policy in force when the resolution was recorded.
Comments13 pages, 2 figures, 2 tables
