A protocol gate stopped unconfirmed airline changes under pressure
Concordat: Typed Sessions for LLM Agents · arXiv:2610.37461
In plain words
An airline agent may be told in its prompt to get a customer’s clear yes before changing a booking. But a hurried customer might push it to act, and the change can still look successful if the booking ends up right.
Concordat is a Python library that offers the agent only the tools allowed at each step. In a test with simulated pushback, its agent made no unconfirmed changes with either tested model; the standard agent did.
The research
When an agent is told to get a customer’s explicit yes before changing a booking, will it still obey if the customer urges it to hurry? And if it makes the change the customer wanted, will a task score reveal that the required confirmation never came? The paper tests this gap between following a rule and reaching the expected outcome.
Concordat gates an agent’s tools by protocol state, and in airline tests with simulated pushback it prevented the measured unconfirmed changes.
Researchers compared a standard airline agent with a Concordat version on 50 tasks, adding simulated customers who pushed back at the first confirmation request. They counted a task as passed when the final database matched the expected state and required information had been communicated. The standard agent made unconfirmed changes with both tested models; Concordat made none.
Yet outcome scoring could miss a violation: in the first Haiku pressure run, 8 of 13 tasks with an unconfirmed change still received full reward.
Paired task-pass comparisons found no statistically significant difference between the agents in either model setting, supporting a bounded conclusion that the gate prevented measured violations without a significant task-success difference.
The enforcement gate and the study’s measure both treated a message containing an explicit “yes” as confirmation, so the zero count applies to that shared test, not every form of consent. The evidence covers one airline task domain, two models, few trials, and simulated customer pressure.
What the evidence shows
- A rule meets customer pressure
Concordat is a Python library that gives an LLM agent a finite-state protocol interface and enforces it while the agent runs. The paper asks whether an airline agent will follow a stated rule to obtain explicit confirmation before changing a booking when a customer pushes back, and whether ordinary task scoring notices a violation.
The pressure condition makes the question concrete: customers initially resist confirmation and say yes only if asked again.
- Tool access follows the protocol
The library derives a protocol from an agent class and checks it when the class is defined. At each turn, the runner offers only tools allowed in the current state, and rejects calls that are unavailable or have invalid arguments before a tool can run.
In the airline test, database-writing tools were available only after the customer’s latest message met the protocol’s yes test. This changes what the agent can do, rather than relying on its prompt alone.
- The gate blocked measured changes
Researchers compared the standard airline agent with its Concordat version on all 50 airline tasks, adding simulated customer pushback. A task counted as passed when its final database matched the expected state and required information had been communicated.
Under pressure, the standard agent made an unconfirmed change in 29 of 128 Haiku task-runs and in 13 of 50 gpt-4.1 tasks; the Concordat agent made none in either comparison.
- Success scores missed some violations
Task reward could still call a violating task successful if the final outcome looked right. In the first Haiku pressure run, 8 of the 13 tasks with an unconfirmed change received full reward.
Researchers also found no statistically significant task-pass difference between the agents in either model comparison. Together, these results show that outcome scoring missed some rule violations and that the gate prevented the measured violations without a significant task-success difference in these evaluations.
Deep
- Original paper authors
- Milad Sikaroudi
- Submitted to arXiv
- License
- arXiv non-exclusive