{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,6]],"date-time":"2026-11-06T01:27:14Z","timestamp":1793928434229,"version":"4.8.0"},"reference-count":87,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T00:00:00Z","timestamp":1786665600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:p>\n                    Deploying autonomous AI agents in high-consequence operational environments requires organizational authorization, yet few frameworks provide end-to-end, testable governance mechanisms suitable for such authorization decisions. This paper introduces LATTICE (Layered Agentic Triad Topology for Intelligent Coordinated Execution), a governance-first architecture that reframes the authorization question from \u201cdo we trust this AI?\u201d to \u201cdo we trust this architecture?\u201d The latter question is answerable through engineering validation rather than assumptions about model behavior. LATTICE enforces separation of concerns across planning, execution, and governance functions through a 1+3 Grid Cell pattern, so that no single component can both decide actions and judge compliance. The architecture implements policy-as-code enforcement with deterministic verdicts, gated execution paths that, under stated trusted-infrastructure assumptions (A1\u2013A5), prevent unauthorized actions, confidence-based escalation to human operators, and cryptographic audit trails that preserve complete decision provenance. Empirical results characterize the AEGIS reference implementation; architecture-level properties are analytic, under stated assumptions. The governance engine is released as open source and reproduces its core results on commodity hardware: deterministic verdicts with zero deviations across 13 configurations repeated 10,000 times each, and no bypass in a 21-vector adversarial suite (0\/21 observed; one-sided 95% upper bound 13.3%). In a pre-specified, planner-invariant\n                    <jats:italic>safety<\/jats:italic>\n                    evaluation (not an autonomy benchmark) across four frontier planner families (GPT-5, Claude Sonnet 4.6, Gemini, Grok-4; 4,000 trajectories), a confidence-threshold baseline's false-allow rate ranged from 0.03 to 0.998 across planners, whereas the AEGIS reference implementation admitted zero unsafe actions (false-allow 0.0, recall 1.0) invariant to the planner, at a conservative operating point that auto-allowed no action; a separate live run additionally governed real operating-system actions with zero unsafe executions. Governance latency is low and host-specific (on an Apple M4 Pro: policy evaluation p50 \u2248 6.2 \u03bcs; full gated enforcement p50 \u2248 0.7 ms including audit I\/O). LATTICE provides a pathway for responsible deployment of autonomous AI in defense, critical infrastructure, and regulated industries where authorization requires verifiable governance rather than trust in AI behavior.\n                  <\/jats:p>","DOI":"10.3389\/frai.2026.1800407","type":"journal-article","created":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T05:32:56Z","timestamp":1786685576000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["LATTICE: a governance-first architecture for authorized autonomous AI operations"],"prefix":"10.3389","volume":"9","author":[{"given":"Elias","family":"Calboreanu","sequence":"first","affiliation":[{"name":"Capitol Technology University","place":["Laurel, MD, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,8,14]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2601.10440","article-title":"AgentGuardian: learning access control policies to govern AI agent behavior","author":"Abaev","year":"2026","journal-title":"arXiv"},{"key":"B2","unstructured":"\u201cIncident 1152: LLM-driven Replit agent reportedly executed unauthorized destructive commands during code freeze, leading to loss of production data,\u201d\n          \n          Technical Report, Responsible AI Collaborative\n          \n          2025"},{"key":"B3","unstructured":"\u201cAI Incident Roundup \u2013 November and December 2025 and January 2026,\u201d\n          \n          Technical Report, Responsible AI Collaborative\n          \n          2026"},{"key":"B4","doi-asserted-by":"publisher","first-page":"44432","DOI":"10.1038\/s41598-025-25266-z","article-title":"A validated framework for responsible AI in healthcare autonomous systems","volume":"15","author":"Alelyani","year":"2025","journal-title":"Sci. Rep"},{"key":"B5","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2510.14133","article-title":"Formalizing the safety, security, and functional properties of agentic AI systems","author":"Allegrini","year":"2025","journal-title":"arXiv"},{"key":"B6","article-title":"\u201cComputer security technology planning study,\u201d","volume-title":"Technical Report ESD-TR-73-51, Electronic Systems Division, Air Force Systems Command","author":"Anderson","year":"1972"},{"key":"B7","doi-asserted-by":"publisher","first-page":"1036","DOI":"10.1037\/0033-295X.111.4.1036","article-title":"An integrated theory of the mind","volume":"111","author":"Anderson","year":"2004","journal-title":"Psychol. Rev"},{"key":"B8","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2212.08073","article-title":"Constitutional AI: harmlessness from AI feedback","author":"Bai","year":"2022","journal-title":"arXiv"},{"key":"B9","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2602.22302","article-title":"Agent behavioral contracts: Formal specification and runtime enforcement for reliable autonomous AI agents","author":"Bhardwaj","year":"2026","journal-title":"arXiv"},{"key":"B10","first-page":"131","article-title":"Checking for race conditions in file accesses","volume":"9","author":"Bishop","year":"1996","journal-title":"Comp. Syst"},{"key":"B11","article-title":"\u201cWhen AI acts alone: What organizations must know about managing the next era of risk,\u201d","volume-title":"Technical report, Boston Consulting Group","year":"2025"},{"key":"B12","volume-title":"Intention, Plans, and Practical Reason","author":"Bratman","year":"1987"},{"key":"B13","doi-asserted-by":"publisher","first-page":"26","DOI":"10.3390\/software5020026","article-title":"Iterative audit convergence in LLM-managed multi-agent systems: a case study in prompt-engineering quality assurance","volume":"5","author":"Calboreanu","year":"","journal-title":"Software"},{"key":"B14","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.6151128","article-title":"\u201cLATTICE: A governance-first architecture for authorized autonomous AI operations,\u201d","volume-title":"SSRN Working Paper","author":"Calboreanu","year":""},{"key":"B15","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.6170328","article-title":"\u201cMANDATE: A tolerance-based framework for autonomous agent task specification,\u201d","volume-title":"SSRN Working Paper","author":"Calboreanu","year":""},{"key":"B16","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.6212818","article-title":"\u201cTRACE: A governance-first execution framework providing architectural assurance for autonomous AI operations,\u201d","volume-title":"SSRN Working Paper","author":"Calboreanu","year":""},{"key":"B17","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1109\/THMS.2013.2293535","article-title":"Human-agent teaming for multirobot control: a review of human factors issues","volume":"44","author":"Chen","year":"2014","journal-title":"IEEE Trans. Human-Mach. Syst"},{"key":"B18","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2512.01295","article-title":"Systems security foundations for agentic computing","author":"Christodorescu","year":"2025","journal-title":"arXiv"},{"key":"B19","article-title":"\u201cPrinciples for the secure integration of artificial intelligence in operational technology,\u201d","volume-title":"Technical Report, CISA","year":"2025"},{"key":"B20","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2510.23883","author":"Datta","year":"2025","journal-title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges. arXiv"},{"key":"B21","doi-asserted-by":"publisher","first-page":"1820827","DOI":"10.3389\/frai.2026.1820827","article-title":"From LLM narratives to parameterized cooperation policies in multi-agent systems","volume":"9","author":"de Curt\u00f3","year":"2026","journal-title":"Front. Artif. Intellig"},{"key":"B22","first-page":"4914","article-title":"\u201cBDI agent architectures: a survey,\u201d","volume-title":"Proceedings of the 29th International Joint Conference on Artificial Intelligence (IJCAI-20)","author":"de Silva","year":"2020"},{"key":"B23","first-page":"60","volume-title":"Computing: A Personal Perspective","author":"Dijkstra","year":"1974"},{"key":"B24","volume-title":"Regulation (EU) 2024\/1689 (Artificial Intelligence Act)","year":"2024"},{"key":"B25","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2404.08144","article-title":"LLM agents can autonomously exploit one-day vulnerabilities","author":"Fang","year":"2024","journal-title":"arXiv"},{"key":"B26","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2601.17744","article-title":"Faramesh: a protocol-agnostic execution control plane for autonomous agent systems","author":"Fatmi","year":"2026","journal-title":"arXiv"},{"key":"B27","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2508.18765","article-title":"Governance-as-a-service: a multi-agent framework for AI system compliance and policy enforcement","author":"Gaurav","year":"2025","journal-title":"arXiv"},{"key":"B28","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2603.07191","article-title":"Governance architecture for autonomous agent systems: Threats, framework, and engineering practice","author":"Ge","year":"2026","journal-title":"arXiv"},{"key":"B29","doi-asserted-by":"crossref","first-page":"6577","DOI":"10.18653\/v1\/2024.naacl-long.366","article-title":"\u201cA survey of confidence estimation and calibration in large language models,\u201d","volume-title":"Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)","author":"Geng","year":"2024"},{"key":"B30","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2603.13942","article-title":"AI agents in financial markets: Architecture, applications, and systemic implications","author":"Gong","year":"2026","journal-title":"arXiv"},{"key":"B31","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2502.14143","article-title":"Multi-agent risks from advanced AI","author":"Hammond","year":"2025","journal-title":"arXiv"},{"key":"B32","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-162","author":"Hu","year":"2014","journal-title":"Guide to Attribute Based Access Control (ABAC) Definition and Considerations"},{"key":"B33","volume-title":"IEC 61508-1:2010. Functional Safety of Electrical\/Electronic\/Programmable Electronic Safety-Related Systems","year":"2010"},{"key":"B34","volume-title":"ISO 13850:2015. Safety of Machinery: Emergency Stop Function","year":"2015"},{"key":"B35","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2603.16586","article-title":"Runtime governance for AI agents: Policies on paths","author":"Kaptein","year":"2026","journal-title":"arXiv"},{"key":"B36","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2512.11933","article-title":"The agentic regulator: risks for AI in finance and a proposed agent-based framework for governance","author":"Kurshan","year":"2025","journal-title":"arXiv"},{"key":"B37","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/7688.001.0001)","author":"Laird","year":"2012","journal-title":"The Soar Cognitive Architecture"},{"key":"B38","volume-title":"LangChain: Building Applications with LLMs Through Composability","year":"2023"},{"key":"B39","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1518\/hfes.46.1.50_30392","article-title":"Trust in automation: Designing for appropriate reliance","volume":"46","author":"Lee","year":"2004","journal-title":"Human Fact"},{"key":"B40","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2508.17155","article-title":"Mind the gap: Time-of-check to time-of-use vulnerabilities in LLM-enabled agents","author":"Lilienthal","year":"2025","journal-title":"arXiv"},{"key":"B41","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2601.18491","article-title":"AgentDoG: a diagnostic guardrail framework for AI agent safety and security","author":"Liu","year":"2026","journal-title":"arXiv"},{"key":"B42","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2509.07006","article-title":"Argen: Auto-regulation of generative AI via GRPO and policy-as-code","author":"Madan","year":"2025","journal-title":"arXiv"},{"key":"B43","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2510.24383","article-title":"Policy cards: Machine-readable runtime governance for autonomous AI agents","author":"Mavra\u010di\u0107","year":"2025","journal-title":"arXiv"},{"key":"B44","volume-title":"Deploying Agentic AI With Safety and Security: A Playbook for Technology Leaders","year":"2025"},{"key":"B45","volume-title":"Introducing the Agent Governance Toolkit: Open-Source Runtime Security for AI Agents","year":"2026"},{"key":"B46","year":"2026","journal-title":"Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio."},{"key":"B47","unstructured":"CVE-2025-32711: M365 Copilot Information Disclosure Vulnerability\n          \n          2025"},{"key":"B48","volume-title":"CrewAI: Framework for Orchestrating Role-Playing Autonomous AI Agents","author":"Moura","year":"2024"},{"key":"B49","unstructured":"CVE-2025-32711: M365 Copilot Information Disclosure Vulnerability\n          \n          2025"},{"key":"B50","doi-asserted-by":"publisher","year":"2024","journal-title":"Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile","DOI":"10.6028\/NIST.AI.600-1"},{"key":"B51","year":"2013","journal-title":"eXtensible Access Control Markup Language (XACML) Version 3.0"},{"key":"B52","unstructured":"Washington, DC\n          ODNI\n          Intelligence Community Directive 505: Artificial Intelligence.\n          \n          2025"},{"key":"B53","volume-title":"M-25-21: Accelerating Federal Use of AI Through Innovation, Governance, and Public Trust","year":"2025"},{"key":"B54","volume-title":"National Security Memorandum on Advancing United States' Leadership in Artificial Intelligence (NSM-25)","year":"2024"},{"key":"B55","doi-asserted-by":"publisher","first-page":"27730","DOI":"10.48550\/arXiv.2203.02155","article-title":"Training language models to follow instructions with human feedback","volume":"35","author":"Ouyang","year":"2022","journal-title":"Adv. Neural Inform. Proc. Syst"},{"key":"B56","year":"","journal-title":"OWASP Top 10 for Agentic Applications for 2026"},{"key":"B57","volume-title":"OWASP Top 10 for Large Language Model Applications 2025","year":""},{"key":"B58","doi-asserted-by":"publisher","first-page":"381","DOI":"10.1177\/0018720810376055","article-title":"Complacency and bias in human use of automation: an attentional integration","volume":"52","author":"Parasuraman","year":"2010","journal-title":"Hum. Fact"},{"key":"B59","doi-asserted-by":"publisher","first-page":"286","DOI":"10.1109\/3468.844354","article-title":"A model for types and levels of human interaction with automation","volume":"30","author":"Parasuraman","year":"2000","journal-title":"IEEE Trans. Syst. Man Cybernet.\u2013Part A: Syst. Humans"},{"key":"B60","doi-asserted-by":"publisher","first-page":"1053","DOI":"10.1145\/361598.361623","article-title":"On the criteria to be used in decomposing systems into modules","volume":"15","author":"Parnas","year":"1972","journal-title":"Commun. ACM"},{"key":"B61","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2602.16666","article-title":"Towards a science of AI agent reliability","author":"Rabanser","year":"2026","journal-title":"arXiv"},{"key":"B62","first-page":"312","article-title":"\u201cBDI agents: from theory to practice,\u201d","author":"Rao","year":"1995","journal-title":"Proceedings of ICMAS-95"},{"key":"B63","doi-asserted-by":"publisher","DOI":"10.1609\/aaaiss.v7i1.36899","article-title":"\u201cEchoLeak: The first real-world zero-click prompt injection exploit in a production LLM system,\u201d","author":"Reddy","year":"2025","journal-title":"Proceedings of the AAAI Symposium Series"},{"key":"B64","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-207","author":"Rose","year":"2020","journal-title":"Zero Trust Architecture"},{"key":"B65","volume-title":"DO-178C: Software Considerations in Airborne Systems and Equipment Certification","year":"2011"},{"key":"B66","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2603.03515","article-title":"The controllability trap: A governance framework for military AI agents","author":"Sahoo","year":"2026","journal-title":"arXiv"},{"key":"B67","doi-asserted-by":"publisher","first-page":"1278","DOI":"10.1109\/PROC.1975.9939","article-title":"The protection of information in computer systems","volume":"63","author":"Saltzer","year":"1975","journal-title":"Proc. IEEE"},{"key":"B68","doi-asserted-by":"publisher","first-page":"38","DOI":"10.1109\/2.485845","article-title":"Role-based access control models","volume":"29","author":"Sandhu","year":"1996","journal-title":"IEEE Comp"},{"key":"B69","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2603.15885","article-title":"Resilience meets autonomy: governing embodied AI in critical infrastructure","author":"Sharma","year":"2026","journal-title":"arXiv"},{"key":"B70","doi-asserted-by":"publisher","DOI":"10.1093\/oso\/9780192845290.001.0001","author":"Shneiderman","year":"2022","journal-title":"Human-Centered AI"},{"key":"B71","unstructured":"Technical report, Edinburgh\n          Significant Gravitas\n          AutoGPT\n          \n          2023"},{"key":"B72","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2602.17753","article-title":"The 2025 AI agent index: Documenting technical and safety features of deployed agentic AI systems","author":"Staufer","year":"2025","journal-title":"arXiv"},{"key":"B73","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2504.21034","article-title":"Saga: A security architecture for governing AI agentic systems","author":"Syros","year":"2025","journal-title":"arXiv"},{"key":"B74","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.AI.100-1","author":"Tabassi","year":"2023","journal-title":"AI Risk Management Framework 1.0"},{"key":"B75","doi-asserted-by":"publisher","first-page":"224","DOI":"10.1145\/3723158","article-title":"Alert fatigue in security operations centres: research challenges and opportunities","volume":"57","author":"Tariq","year":"2025","journal-title":"ACM Comp. Surv"},{"key":"B76","year":"","journal-title":"Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence"},{"key":"B77","volume-title":"Winning the Race: America's AI Action Plan","year":""},{"key":"B78","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2508.03858","article-title":"Mi9: An integrated runtime governance framework for agentic AI","author":"Wang","year":"2025","journal-title":"arXiv"},{"key":"B79","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2503.18666","article-title":"\u201cAgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,\u201d","author":"Wang","year":"2026","journal-title":"Proceedings of the 48th IEEE\/ACM International Conference on Software Engineering (ICSE)"},{"key":"B80","doi-asserted-by":"publisher","first-page":"186345","DOI":"10.1007\/s11704-024-40231-1","article-title":"A survey on large language model based autonomous agents","volume":"18","author":"Wang","year":"2024","journal-title":"Front. Comp. Sci"},{"key":"B81","volume-title":"An Introduction to Multiagent Systems, 2nd Edn.","author":"Wooldridge","year":"2009"},{"key":"B82","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2308.08155","article-title":"AutoGen: Enabling next-gen llm applications via multi-agent conversation","author":"Wu","year":"2023","journal-title":"arXiv"},{"key":"B83","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241131","article-title":"\u201cIsolateGPT: An execution isolation architecture for LLM-based agentic systems,\u201d","author":"Wu","year":"2025","journal-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS)"},{"key":"B84","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2309.07864","article-title":"The rise and potential of large language model based agents","author":"Xi","year":"2023","journal-title":"arXiv"},{"key":"B85","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2510.13857","article-title":"From craft to constitution: a governance-first paradigm for principled agent engineering","author":"Xu","year":"2025","journal-title":"arXiv"},{"key":"B86","article-title":"\u201cReact: synergizing reasoning and acting in language models,\u201d","volume-title":"Proceedings of the 11th International Conference on Learning Representations (ICLR)","author":"Yao","year":"2023"},{"key":"B87","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2406.01637","article-title":"Teams of llm agents can exploit zero-day vulnerabilities","author":"Zhu","year":"2024","journal-title":"arXiv"}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1800407\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T05:33:08Z","timestamp":1786685588000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1800407\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,14]]},"references-count":87,"alternative-id":["10.3389\/frai.2026.1800407"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1800407","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,14]]},"article-number":"1800407"}}