The Contextual Agentic Enterprise: A Formally Governed Architecture for Bounded Multi-Agent Systems in Mission-Critical Systems of Record

About this paper. The Contextual Agentic Enterprise (CAE) is a vendor- and platform-agnostic architecture framework from Contextual Agentic. This is a manuscript draft: it has not been peer reviewed. The case study and the data are constructed for illustration. Any adoption or use of CAE should be undertaken in consultation with Contextual Agentic or an authorised advisory partner, who will tailor the framework to the organisation.

Abstract

Large language model (LLM) agents are increasingly proposed as autonomous operators of enterprise systems of record (SoR) – ERP, CMMS, MES and SCADA – whose correctness rests on deterministic, attributable state transitions. Allowing a stochastic generator to issue writes against such systems couples their integrity to the generator’s error distribution. We present the Contextual Agentic Enterprise (CAE), an architecture that separates probabilistic deliberation from deterministic commitment. Agents reason over an immutable, signed projection of enterprise state (a Context Contract); they emit candidate transitions packaged with verifiable justification (a Minimum Action-Evidence Bundle, MAEB); and a non-learned policy function, the Deterministic Shell, is the sole holder of write capability, mapping each bundle to $\{\text{𝖢𝗈𝗆𝗆𝗂𝗍},\text{𝖤𝗌𝖼𝖺𝗅𝖺𝗍𝖾}\}$. We (i) formalise context as an ordered family of projective measurements and show why classical retrieval, which is order-agnostic, is insufficient for precondition-sensitive operations; (ii) give formal definitions of the contract, bundle and shell, and state invariant-preservation, complete-mediation and tamper-evidence properties together with the assumptions under which they hold; (iii) derive the Context Stability Index (CSI), an entropy-normalised admission criterion for autonomy, and characterise its estimation bias; and (iv) evaluate a reference Open Policy Agent (OPA) policy against a 14-case mutation suite in an industrial turbine scenario. The evaluation confirms the intended commit/escalate behaviour but exposes three defects in the reference policy – an implicit third outcome, incomplete reason reporting, and trust in agent-asserted evidence – each of which we resolve formally.

Index Terms – LLM agents, multi-agent systems, policy-as-code, runtime verification, systems of record, industrial informatics, audit logging, process mining.

---

1. Introduction

1.1 Problem statement

Let $\Sigma$ denote the state space of an enterprise’s systems of record and let $ℐ\subseteq \Sigma$ be the set of states satisfying the organisation’s invariants: financial delegations, inventory safety stock, safety interlocks and regulatory constraints. A conventional SoR guarantees that each transition $\delta :\Sigma \to \Sigma$ is (a) authorised by an accountable principal, (b) atomic, and (c) invariant-preserving, i.e. $\sigma \in ℐ\Rightarrow \delta \left(\sigma \right)\in ℐ$.

An LLM agent $𝒜$ conditioned on context $x$ induces a distribution $p_{\theta }(\delta \mid x)$ over candidate transitions. If $𝒜$ holds write capability, the probability of an invariant violation per decision is

which is non-zero for any non-degenerate $p_{\theta }$ and is moreover non-stationary under model updates, prompt variation and adversarial inputs. Prompt-level instructions (“never exceed budget”) alter $p_{\theta }$ but do not change its support. The problem we address is therefore:

Problem P. Construct an architecture in which an agent’s reasoning may be arbitrarily expressive, yet every committed transition is authorised, invariant-preserving and accompanied by evidence sufficient for independent audit – irrespective of the agent’s error distribution.

1.2 Contributions

1. A formal account of operational context as an ordered, projective object, contrasting it with point-embedding retrieval (§3).
2. Formal definitions of the Context Contract $C_{\text{env}}=⟨S,T,H,\sigma ⟩$, the MAEB and the shell function $f_{\text{shell}}$, with stated safety properties and their assumptions (§4).
3. A derivation of the Context Stability Index as a normalised conditional-entropy admission test, with bias analysis and a stratified admission rule (§5).
4. An executable evaluation of the reference policy and a case-study walkthrough (§6), and a threat model with an auditability argument (§7).

We are explicit about scope: CAE’s safety properties are properties of the commit boundary. They do not depend on, and do not certify, the correctness of the agents’ reasoning.

---

2. Related Work

Tool-augmented LLMs. ReAct interleaves reasoning traces with actions [1]; Toolformer learns when to invoke APIs [2]; retrieval-augmented generation grounds generation in retrieved passages [3]. These works improve task competence but treat tool invocation as an action the model is entitled to take. Authority and verification are out of scope.

Multi-agent coordination. AutoGen [4], MetaGPT [5] and CAMEL [6] compose role-specialised agents via conversation protocols. Coordination improves decomposition and self-critique, but critique by another stochastic agent does not yield a deterministic guarantee: two samples from correlated distributions do not constitute an independent control.

Guardrails and runtime filtering. Systems such as NeMo Guardrails [7] constrain dialogue flows and filter outputs, often using a model as the classifier. Prompt-injection research [8] shows that model-mediated controls are themselves attack surfaces. CAE differs in placing no learned component on the authorisation path.

Policy engines. OPA/Rego [9] and Cedar [10] provide declarative, deterministic authorisation decoupled from application code. CAE adopts this class of engine as the shell but extends the input from a request tuple $⟨\text{principal},\text{action},\text{resource}⟩$ to an evidence-bearing bundle bound to a signed state snapshot.

Security foundations. Complete mediation and least privilege [11], capability-based addressing [12], tamper-evident logging [13, 14] and Byzantine agreement [15] supply the vocabulary for §7.

Process mining. Inductive mining [16, 17] reconstructs process models from event logs. Agentic Flow Mining (AFM) reuses this to discover candidate workflows, and adds an information-theoretic admission criterion (§5).

Quantum-probabilistic and compositional models. Quantum cognition models order effects in human judgement with non-commuting projectors [18, 19]; DisCoCat composes word meanings via functors from pregroup grammars into finite-dimensional Hilbert spaces [20]. We use these as representational formalisms (§3), making no claim of physical quantum effects in enterprises.

---

3. Mathematical Formulations of Context

3.1 Point embeddings versus projective states

In transformer-based retrieval, an item $w$ is mapped to $\overrightarrow{w}\in {ℝ}^d$ and relevance is scored by an inner product, as in scaled dot-product attention:

${ℝ}^d$ is itself a (real, finite-dimensional) Hilbert space, so the distinction that matters is not the ambient space but the role of its elements. In retrieval, items are points and context is a set – the top-$k$ neighbours of a query – whose semantics are invariant under permutation.

In a projective formulation, the operational situation is a state $\rho$ (a density operator on $\mathscr{H}$, with $\rho \succcurlyeq 0$, $\mathrm{tr}\rho =1$), and each operational question is an observable with spectral projectors $\left\{P_i\right\}$. Asking question $A$ yields outcome $a$ with probability $\mathrm{tr}\left(P_a\rho \right)$ and updates the state by the Lüders rule

Context is then not a set of items but a sequence of measurements, each conditioning the next.

3.2 Non-commutative observables in operational workflows

For projectors $P_A,P_B$, the probability of “yes to $A$, then yes to $B$” is $\Vert P_B{P}_A\psi {\Vert }^2$ for pure state $\psi$. If $[P_A,P_B]=P_A{P}_B-P_B{P}_A\ne 0$, the sequential probabilities differ by order.

Worked example. Let $\psi =(1,0{)}^{\top }\in {ℝ}^2$, and let $P_A,P_B$ project onto unit vectors at ${30}^{\circ }$ and ${60}^{\circ }$. Then

with $\Vert [P_A,P_B]{\Vert }_F\approx 0.612$. Under Kolmogorov probability, joint events commute ($P(A\cap B)=P(B\cap A)$), so this asymmetry is inexpressible without introducing order as an explicit variable.

Two sources of non-commutativity arise in operations, and they should be distinguished:

1. Physical (classical) non-commutativity. Operations that mutate plant state are functions ${\delta }_A,{\delta }_B:\Sigma \to \Sigma$ with, in general, ${\delta }_A\circ {\delta }_B\ne {\delta }_B\circ {\delta }_A$. Throttling a turbine and then sampling vibration does not equal sampling and then throttling. This requires no quantum formalism.
2. Judgemental non-commutativity. Empirically, the order in which human or model judges are posed questions shifts their answers [19]. The projective model above is a compact descriptive account of such order effects.

The architectural implication is the same in both cases: a Context Contract must specify an observation order and preconditions, not merely a set of fields. In CAE this is encoded as a partial order $⪯$ over contract fields such that safety-relevant observables (e.g. relief-valve inspection status) precede commercially motivated ones (e.g. over-pressure dispatch).

3.3 Categorical compositional cognition (DisCoCat)

DisCoCat [20] defines a strong monoidal functor $F:\mathrm{𝐏𝐫𝐞𝐠}\to \mathrm{𝐅𝐝𝐇𝐢𝐥𝐛}$ from a pregroup grammar to finite-dimensional Hilbert spaces. Basic types map to spaces, $F\left(n\right)=N$, $F\left(s\right)=S$; a transitive verb of type $n^{r}s{n}^l$ maps to a tensor $\overline{v}\in N\otimes S\otimes N$; and grammatical reductions map to the counits (“cups”) ${\epsilon }_N:N\otimes N\to ℂ$. Sentence meaning is obtained by contraction:

In quantum-circuit realisations the cups correspond to Bell effects, written $⟨\text{Cup}|$, giving the form $⟨\text{Sentence}|=⟨\text{Cup}|\left(\right|\text{Noun}⟩\otimes |\text{Verb}⟩)$ used in the compendium.

For multi-modal enterprise data we take the type system from the enterprise ontology rather than from natural-language grammar. Let types include $\text{𝖠𝗌𝗌𝖾𝗍}$, $\text{𝖯𝖺𝗋𝗍}$, $\text{𝖲𝗂𝗀𝗇𝖺𝗅}$ and $\text{𝖯𝖾𝗋𝗌𝗈𝗇}$, and let typed relations such as $\text{𝖿𝗂𝗍𝗌}:\text{𝖯𝖺𝗋𝗍}\otimes \text{𝖠𝗌𝗌𝖾𝗍}\to S$ or $\text{𝖼𝖾𝗋𝗍𝗂𝖿𝗂𝖾𝖽𝖥𝗈𝗋}:\text{𝖯𝖾𝗋𝗌𝗈𝗇}\otimes \text{𝖠𝗌𝗌𝖾𝗍}\to S$ be morphisms. A compound assertion – “bearing SKU-88219 fits turbine GT-02, and the on-shift technician is certified for GT-02” – is then a well-typed string diagram whose evaluation composes structured (ERP), relational (knowledge graph) and unstructured (technician note, embedded into $N$) evidence. The compositional discipline matters because ill-typed compositions, such as attaching a warranty to a person, are rejected structurally rather than scored as low-similarity.

Scope statement. §3 motivates how contracts should be structured (ordered, typed, compositional). The shell’s guarantees in §4 do not depend on any agent adopting these representations.

---

4. System Architecture and Formal Contracts

4.1 System model

The system comprises: SoR adapters $\{R_1,\dots ,R_m\}$ (ERP, CMMS, SCADA, MES, IAM); a contract compiler $𝒦$; an agent mesh $ℳ=\{{𝒜}_1,\dots ,{𝒜}_k\}$; a bundle compiler $ℬ$; the shell $𝒮$; an escalation queue $𝒬$; and an append-only ledger $ℒ$.

Assumption A1 (Capability confinement). Only $𝒮$ holds write capabilities to any $R_j$. Agents hold read access to contracts only.

Assumption A2 (Cryptographic soundness). SHA-256 is collision- and second-preimage-resistant; the signature scheme is EUF-CMA secure; signing keys for $𝒦$ and $ℬ$ are not available to $ℳ$.

Assumption A3 (Policy correctness). The invariant predicates encoded in policy $\Pi$ are sufficient conditions for preservation of $ℐ$ (see Theorem 1).

4.2 Context Contracts

Definition 1 (Context Contract). A Context Contract is a tuple

where

• $S={\pi }_Q\left({\Sigma }_t\right)$ is the projection of global state at time $t$ onto a query set $Q$ (asset state, telemetry window, maintenance history, shift roster, delegation limits, operational boundaries), together with the observation order $⪯$ of §3.2;
• $T=(t_{\text{snap}},\tau )$ is the snapshot timestamp and freshness bound;
• $H=\mathrm{SHA-256}\left(\mathrm{canon}\right(S\parallel T\left)\right)$ under a canonical serialisation such as RFC 8785 (JCS);
• $\sigma ={\mathrm{Sign}}_{s{k}_{𝒦}}\left(H\right)$.

$C_{\text{env}}$ is immutable by content addressing: any change to $S$ or $T$ changes $H$ and invalidates $\sigma$. Validity at evaluation time $t$ is

The reference design uses $\tau =15$ minutes.

4.3 The Minimum Action-Evidence Bundle

Definition 2 (MAEB). A bundle is a tuple $M=⟨\iota ,\Lambda ,E,\Delta ,\Phi ⟩$ comprising an identifier $\iota$; lineage $\Lambda =(\text{agents},H_C,t_C,\text{seed},\text{run})$; evidence $E=\left\{e_j\right\}$, where each telemetry excursion $e_j=(\text{metric},v_j,{\theta }_j,\text{unit})$; proposed actions $\Delta$ (work order, reservations, operating-point change); and financials $\Phi =(c,L)$, the estimated action cost and the projected avoided loss. The bundle is signed: ${\sigma }_M={\mathrm{Sign}}_{s{k}_{ℬ}}\left(\mathrm{SHA-256}\right(\mathrm{canon}\left(M\right)\left)\right)$.

Definition 3 (Binding). $M$ is bound to $C$ iff $\Lambda .H_C=C.H$ and $\Lambda .t_C=C.t_{\text{snap}}$.

Definition 4 (Evidence groundedness). $M$ is grounded in $C$ iff for every $e_j\in E$ there exists a reference $r_j$ into $C.S$ such that $v_j=\mathrm{eval}(r_j,C.S)$ and ${\theta }_j$ equals the configured threshold for that metric in $C.S$.

Definition 4 is stronger than the compendium’s reference policy, which compares $v_j$ to ${\theta }_j$ as both are reported by the agent. §6.4 shows this distinction is material.

“Minimum” is defined relative to the policy: $E$ must contain every datum referenced by some predicate of $\Pi$, and nothing whose omission would leave $f_{\text{shell}}$ unchanged. This makes the bundle both automatically checkable and complete for audit replay.

4.4 The Deterministic Shell

The verification pipeline is a conjunction of stages:

1. $V_1$: schema conformance of $M$ (JSON Schema 2020-12);
2. $V_2$: $\mathrm{valid}(C,t)$ and $\mathrm{Verify}\left({\sigma }_M\right)$;
3. $V_3$: binding (Def. 3) and groundedness (Def. 4);
4. $V_4$: invariant predicates ${\phi }_1,\dots ,{\phi }_n$ of $\Pi$ evaluated on $(M,D_t)$, where $D_t$ is live reference data (e.g. current inventory) read inside the commit transaction;
5. $V_5$: atomic execution of $\Delta$ with idempotency key $\iota$, then ledger append.

Definition 5 (Shell function). Let $\mathrm{wf}\left(M\right)\equiv V_1\wedge V_2\wedge V_3$ and ${\Phi }_{\Pi }(M,D_t)\equiv \underset{i=1}{\overset{n}{\bigwedge }}{\phi }_i(M,D_t)$. Then

where ${\psi }_{\Pi }$ is the disjunction of escalation triggers (e.g. $c>c_{\max }$). Every $\text{𝖤𝗌𝖼𝖺𝗅𝖺𝗍𝖾}$ carries a reason set $ℛ\left(M\right)=\{i:\neg {\phi }_i\}\cup \{\text{trigger}:\psi \}\cup \{V_k:\neg V_k\}$, and we require $ℛ\left(M\right)\ne \varnothing$ whenever the outcome is $\text{𝖤𝗌𝖼𝖺𝗅𝖺𝗍𝖾}$ (reason completeness).

$f_{\text{shell}}$ is total and fail-closed: any input not provably admissible escalates. Escalation subsumes rejection; the reason set distinguishes “requires authority” from “malformed”.

For the turbine workflow, the reference invariants are

Theorem 1 (Invariant preservation). Under A1 and A3, if ${\sigma }_0\in ℐ$ then every state reachable by committed transitions lies in $ℐ$.

Proof sketch. By A1 the only transitions applied to $\Sigma$ are those for which $f_{\text{shell}}=\text{𝖢𝗈𝗆𝗆𝗂𝗍}$, so ${\Phi }_{\Pi }$ held on $(M,D_t)$. By A3, ${\Phi }_{\Pi }$ is a sufficient precondition: $\sigma \in ℐ\wedge {\Phi }_{\Pi }\Rightarrow {\delta }_M\left(\sigma \right)\in ℐ$ (a Hoare triple $\{ℐ\wedge {\Phi }_{\Pi }\}{\delta }_M\left\{ℐ\right\}$). Because $D_t$ is read inside the same serialisable transaction as ${\delta }_M$, no interleaving transition invalidates the precondition (no TOCTOU window). Induction on the length of the committed sequence completes the proof. $\square$

Proposition 2 (Agent-independence). The guarantee of Theorem 1 holds for any distribution $p_{\theta }$, including adversarial ones.

Proof. Theorem 1 quantifies over all bundles; nothing in its premises refers to $ℳ$. $\square$

Proposition 3 (Replay determinism). If evaluation time $t$ and $D_t$ are supplied as explicit inputs, $f_{\text{shell}}$ is a pure function and every decision is reproducible from $(M,C,\Pi ,D_t,t)$ recorded in $ℒ$.

The reference policy calls time.now_ns() internally, which violates Proposition 3’s premise; a conforming implementation passes $t$ as input and records it.

The theorems bound what can be committed, not whether it is wise: a grounded, in-policy, mistaken diagnosis is committed. CAE converts unbounded model error into bounded, attributable error.

---

5. Inductive Process Discovery and the Context Stability Index

5.1 Derivation

AFM reconstructs, for a candidate workflow, a historical sample of pairs $(s_i,a_i)$ where $s_i$ is the recorded SoR state at the decision point (from change tables, CMMS logs, IAM trails) and $a_i$ is the action taken. Let $A$ and $S$ be the corresponding random variables. The question for admission is: how much of the uncertainty in what was done is explained by what was recorded?

Shannon entropy $H\left(A\right)=-\sum _{a}p\left(a\right){\log }_{2}p\left(a\right)$ measures total action uncertainty; $H(A\mid S)=\sum _{s}p\left(s\right)H(A\mid S=s)$ measures what remains once recorded state is known. Their difference is the mutual information $I(A;S)=H\left(A\right)-H(A\mid S)$. Normalising by $H\left(A\right)$ gives

which is Theil’s uncertainty coefficient $U(A\mid S)$.

Properties. (i) $0\le \mathrm{CSI}\le 1$, since $0\le H(A\mid S)\le H\left(A\right)$. (ii) $\mathrm{CSI}=1$ iff $A$ is a deterministic function of $S$ almost surely. (iii) $\mathrm{CSI}=0$ iff $A\perp S$. (iv) CSI is invariant to relabelling of actions and states. (v) Refinement monotonicity: if $S^{\prime }=(S,X)$ then $H(A\mid S^{\prime })\le H(A\mid S)$, so adding recorded variables never decreases population CSI. Property (v) formalises “instrument, then automate”.

Admission rule (reference): a workflow is eligible for autonomy iff $\widehat{\mathrm{CSI}}\ge 0.85$. The residual $1-\mathrm{CSI}$ is the fraction of action uncertainty attributable to unrecorded factors – tribal knowledge, informal communication or judgement.

5.2 Estimation

The plug-in estimator is biased: $\widehat{H}$ underestimates entropy, and the bias is larger for $\widehat{H}(A\mid S)$ because each conditional is estimated from fewer samples. Hence $\widehat{\mathrm{CSI}}$ is biased upwards, and the bias grows with the cardinality of $S$ – precisely the regime that refinement (v) encourages. We recommend: (a) the Miller–Madow correction ${\widehat{H}}_{\text{MM}}=\widehat{H}+(\widehat{m}-1)/\left(2N\ln 2\right)$ per distribution, where $\widehat{m}$ is the number of non-empty cells; (b) a bootstrap confidence interval, admitting only if the lower bound clears the threshold; and (c) out-of-time validation.

To illustrate the hazard, we assigned the 1,000 actions of the example below to a uniformly random state variable with 500 levels, carrying no information. The plug-in estimate was $\widehat{\mathrm{CSI}}=0.479$. Without correction, an analyst could “instrument” a workflow into admissibility with noise.

5.3 Worked example (constructed data)

Consider 1,000 historical bearing-vibration alarms with actions $A\in \{\text{defer and monitor},\text{throttle, reserve and schedule},\text{controlled shutdown}\}$ (counts 364 / 455 / 182; $H\left(A\right)=1.495$ bits).

Two conclusions follow. First, recording shift coverage – a socio-technical variable – moved the workflow across the admission threshold, consistent with property (v). Second, the residual uncertainty is concentrated in skeleton shifts. We therefore recommend stratified admission: autonomy is granted per stratum, and the shell enforces the stratum via a predicate on $C.S.\text{shift}$, escalating otherwise. A contrasting workflow – supplier substitution on purchase orders, conditioned on lead time and contract status – yielded $\widehat{\mathrm{CSI}}=0.075$, indicating decisions driven almost entirely by unrecorded factors.

---

6. Validation and Industrial Case Study

The scenario is constructed for illustration and does not describe a specific facility. Policy outcomes in §6.4 were produced by executing the compendium’s reference policy in OPA v1.4.2.

6.1 Scenario

A primary gas turbine (GT-02) reports drive-end bearing peak RMS velocity of $v=7.9$ mm/s against an alarm threshold $\theta =7.2$ mm/s. (Thresholds of this order appear in ISO 10816/20816-style severity zoning, but appropriate limits are machine- and standard-specific; the value here is illustrative.)

6.2 Pipeline trace

1. Contract. $𝒦$ compiles $C$ with a 600 s telemetry window, maintenance history, inventory for SKU-88219 (on hand 3, safety stock 2), the shift roster (lead reliability engineer on duty) and $c_{\max }=\mathrm{25,000}$. $t-t_{\text{snap}}=6$ min.
2. Deliberation. The telemetry specialist reports spectral content consistent with an inner-race defect (diagnostic confidence 94%); the asset-and-supply specialist confirms stock and the 06:00 low-demand window. The orchestrator proposes $\Delta$: speed $\to 85\%$ for 14 h, reserve one bearing, raise an URGENT work order.
3. Bundle. $\Phi =(c,L)=(\mathrm{12,400},\mathrm{180,000})$.
4. Shell. ${\phi }_{\text{tel}}$: $7.9\ge 7.2$ ✓. ${\phi }_{\text{doa}}$: $\mathrm{12,400}\le \mathrm{25,000}$ and $\mathrm{180,000}>\mathrm{12,400}$ ✓. ${\phi }_{\text{inv}}$: $3-1=2\ge 2$ ✓. ${\phi }_{\text{op}}$: $80\le 85\le 100$ ✓. Freshness: $6\le 15$ ✓. Outcome: $\text{𝖢𝗈𝗆𝗆𝗂𝗍}$.
5. Commit. CMMS work order and ERP reservation are written atomically, and $H\left(M\right)$ is appended to $ℒ$.

6.3 Decision-economic note

The invariant $L>c$ compares the avoided loss with cost, ignoring the probability of loss. A decision-theoretically sound form is $\widehat{p}L-c>0$, where $\widehat{p}$ is the estimated probability of unplanned failure before the planned window if no action is taken. Here, break-even is $p^{\ast }=c/L=\mathrm{12,400}/\mathrm{180,000}\approx 0.069$. Note that diagnostic confidence (0.94, the probability a defect is present) is not $\widehat{p}$; conflating the two would overstate the case. We recommend that $\widehat{p}$ be computed by a validated reliability model referenced from $C$, not asserted by an agent.

6.4 Policy conformance experiment

We executed the reference policy against a baseline bundle and 13 single- or double-field mutations. Inventory data: SKU-88219 (3 on hand / 2 safety stock); impeller assembly (1 / 1).

Findings.

• F1 – Implicit third outcome. Nine of 14 cases produce neither allow nor requires_escalation. Such cases are not committed, so the policy is fail-closed in effect, but the codomain is ternary and the third state has no defined handler. Definition 5 resolves this by totality: every non-commit is $\text{𝖤𝗌𝖼𝖺𝗅𝖺𝗍𝖾}$ with a reason set.
• F2 – Reason incompleteness. Six cases are denied with an empty reason set, so an escalation docket would receive no explanation. C3, a future-dated contract (a clock-skew or forgery signal), is reported as “stale”. Definition 5 requires $ℛ\left(M\right)\ne \varnothing$ and one reason per failed predicate.
• F3 – Ungrounded evidence (C12). An agent-asserted reading of 99.0 mm/s is committed because ${\phi }_{\text{tel}}$ compares agent-supplied values. Under Definition 4, $v_j$ must be re-derived from the signed $C.S$; the check then fails for any fabricated value. This is the most consequential defect, since it places agent output on the authorisation path, which the architecture forbids.
• F4 – Vacuous quantification (C11). ${\phi }_{\text{inv}}$ holds vacuously over an empty reservation set. This is correct if the action requires no parts, but a work order that requires parts and reserves none should fail a completeness predicate derived from the bill of materials.

C1 confirms the central claim: the unbounded agentic action of §1 is not committed and reaches a human with reasons attached. The defects F1–F4 are properties of this reference policy, not of the architecture, and are corrected by Definitions 4 and 5. The experiment also illustrates the AFM step-5 requirement: policies must be tested against known-bad cases before commissioning.

---

7. Security, Threat Model and Proof of Auditability

7.1 Adversary model

We assume an adversary who may: (T1) inject instructions through unstructured context (manuals, chat, work-order free text) [8]; (T2) fully control one or more agents; (T3) replay or reorder previously valid bundles; (T4) present stale or forged context; (T5) attempt privilege escalation via agent-held credentials; (T6) as an insider, attempt to alter ledger entries after the fact; (T7) alter policy $\Pi$. The adversary cannot break A2 and cannot obtain $s{k}_{𝒦}$, $s{k}_{ℬ}$ or $𝒮$’s write credentials.

Hallucination mitigation. Hallucination is not prevented; it is contained. Ungrounded factual claims fail Definition 4. Grounded but erroneous inferences, such as a mistaken diagnosis from real data, are bounded by ${\Phi }_{\Pi }$ and recorded for review.

7.2 Tamper-evident audit ledger

Each decision appends an entry $r_i=\left(H\right(M_i),H(C_i),H(\Pi ),t_i,{\text{outcome}}_i,{ℛ}_i)$ and the chain value

Periodically, a Merkle root over a block of entries is published to an external witness – a write-once (WORM) store under separate administrative control, or a transparency log in the style of RFC 6962 [14].

Theorem 4 (Tamper evidence). Under A2, any modification, insertion or deletion of an entry $r_j$ with $j\le i$ that leaves the published anchor ${\ell }_i$ unchanged yields a SHA-256 collision.

Proof sketch. Suppose $r_j^{\prime }\ne r_j$ and the recomputed chain reaches the same ${\ell }_i$. Let $k\ge j$ be the largest index at which the input to the hash differs while outputs agree from $k$ onward. Then ${\ell }_{k-1}^{\prime }\parallel r_k^{\prime }\ne {\ell }_{k-1}\parallel r_k$ while $\mathrm{SHA-256}$ of each equals ${\ell }_k$: a collision. $\square$

Proof of auditability. Combining Proposition 3 and Theorem 4: for every committed transition, an auditor holding $ℒ$ and the content-addressed store can (a) retrieve $M$, $C$ and $\Pi$ by hash, (b) verify their integrity against the anchored chain, and (c) re-execute $f_{\text{shell}}(M,\Pi )$ with the recorded $t$ and $D_t$ and obtain the recorded outcome. Auditability in this sense is decision reproducibility; it does not require, and does not claim, reproducibility of LLM sampling. The recorded token seed aids investigation but does not guarantee identical generations across hardware or model versions.

On Byzantine tolerance. A single-operator hash chain is tamper-evident, not Byzantine fault-tolerant. Where multiple organisations must agree on the ledger – joint ventures, or regulator-observed operations – the log should be replicated across $n\ge 3f+1$ independent parties running a BFT agreement protocol [15], or anchored to multiple independent witnesses so that equivocation is detectable. CAE does not otherwise require consensus: the shell is a single logical writer per SoR, and Theorem 1 relies on serialisable transactions, not agreement among agents.

---

8. Limitations and Threats to Validity

(i) The case study and CSI data are constructed. They demonstrate mechanism, not field performance. (ii) Theorem 1 is only as strong as A3: invariants are hand-authored or mined (AFM step 4), and mined policies inherit historical bias, including tolerated violations. (iii) The §3 formalism is descriptive; we have not shown that projective context models improve agent accuracy over ordered classical schemas. (iv) CSI measures predictability from recorded state, not decision quality. A workflow can be consistently wrong at high CSI. (v) Escalation load is an operational risk: an over-conservative $\Pi$ shifts work to humans, and escalation latency becomes a safety variable that must itself be monitored. (vi) Contract compilation adds latency, which is unsuitable for control loops that require sub-second action; CAE targets supervisory and transactional decisions, not real-time control. (vii) Parameters such as $\tau$, $c_{\max }$ and the 0.85 admission threshold are reference values, not recommendations for any particular organisation; they must be set through a tailoring engagement with Contextual Agentic or an authorised advisory partner.

---

9. Conclusion and Future Research Directions

CAE addresses Problem P by relocating authority: agents may reason without restriction over a signed, ordered projection of enterprise state, but only a deterministic, testable function commits transitions, and it commits only grounded, evidence-bearing bundles that satisfy explicit invariants. The resulting guarantees – invariant preservation, agent-independence, decision reproducibility and tamper evidence – hold under stated cryptographic and capability assumptions and are independent of model quality. The conformance experiment shows that these guarantees are easy to lose in implementation. Three of four defects found in the reference policy stem from treating agent output as fact or leaving outcomes undefined, which argues for formal definitions as the specification against which policies are tested.

Future work includes: (1) mechanised verification of $\Pi$ against $ℐ$, for example by translating Rego fragments to SMT; (2) CSI estimators with guaranteed coverage for high-cardinality state, and causal variants that distinguish recorded correlates from recorded causes; (3) field evaluation measuring escalation rates, escalation latency and post-commit incident rates against human-only baselines; (4) empirical tests of whether order-annotated contracts reduce precondition violations in agent proposals; and (5) cross-organisational ledgers with BFT replication for multi-party assets.

---

Disclosure: The Contextual Agentic Enterprise is a vendor- and platform-agnostic architecture framework from Contextual Agentic. The formal properties stated here hold under the stated assumptions; any adoption or use of CAE in a production setting should be undertaken in consultation with Contextual Agentic or an authorised advisory partner, who will tailor the contracts, invariants and admission thresholds to the organisation. The industrial scenario and CSI datasets are constructed for illustration. The reference policy and schemas are drawn from the CAE compendium; the companion book, The Contextual Agentic Enterprise (Polymath Signal Press, 2026), develops them further.

References

1. S. Yao et al., "ReAct: Synergizing reasoning and acting in language models," ICLR, 2023.
2. T. Schick et al., "Toolformer: Language models can teach themselves to use tools," NeurIPS, 2023.
3. P. Lewis et al., "Retrieval-augmented generation for knowledge-intensive NLP tasks," NeurIPS, 2020.
4. Q. Wu et al., "AutoGen: Enabling next-gen LLM applications via multi-agent conversation," arXiv:2308.08155, 2023.
5. S. Hong et al., "MetaGPT: Meta programming for a multi-agent collaborative framework," ICLR, 2024.
6. G. Li et al., "CAMEL: Communicative agents for 'mind' exploration of large language model society," NeurIPS, 2023.
7. T. Rebedea et al., "NeMo Guardrails: A toolkit for controllable and safe LLM applications with programmable rails," EMNLP (Demos), 2023.
8. K. Greshake et al., "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection," ACM AISec, 2023.
9. Open Policy Agent, "Policy language (Rego)," CNCF project documentation.
10. J. Cutler et al., "Cedar: A new language for expressive, fast, safe, and analyzable authorization," Proc. ACM Program. Lang. (OOPSLA), 2024.
11. J. H. Saltzer and M. D. Schroeder, "The protection of information in computer systems," Proc. IEEE, 63(9), 1975.
12. J. B. Dennis and E. C. Van Horn, "Programming semantics for multiprogrammed computations," Commun. ACM, 9(3), 1966.
13. S. A. Crosby and D. S. Wallach, "Efficient data structures for tamper-evident logging," USENIX Security, 2009.
14. B. Laurie, A. Langley and E. Kasper, "Certificate Transparency," RFC 6962, IETF, 2013.
15. L. Lamport, R. Shostak and M. Pease, "The Byzantine generals problem," ACM TOPLAS, 4(3), 1982.
16. W. M. P. van der Aalst, Process Mining: Data Science in Action, 2nd ed. Springer, 2016.
17. S. J. J. Leemans, D. Fahland and W. M. P. van der Aalst, "Discovering block-structured process models from event logs," Petri Nets, 2013.
18. J. R. Busemeyer and P. D. Bruza, Quantum Models of Cognition and Decision. Cambridge Univ. Press, 2012.
19. Z. Wang and J. R. Busemeyer, "A quantum question order model supported by empirical tests of an a priori and precise prediction," Topics in Cognitive Science, 5(4), 2013.
20. B. Coecke, M. Sadrzadeh and S. Clark, "Mathematical foundations for a compositional distributional model of meaning," Linguistic Analysis, 36, 2010.
21. C. E. Shannon, "A mathematical theory of communication," Bell Syst. Tech. J., 27, 1948.
22. A. Vaswani et al., "Attention is all you need," NeurIPS, 2017.
23. A. Rundgren, B. Jordan and S. Erdtman, "JSON Canonicalization Scheme (JCS)," RFC 8785, IETF, 2020.