Agentic AI controls fail when gates interact — new protocol fixes it

Agentic AI systems increasingly rely on multiple pre-action controls—authority gates, resource gates, and evidence gates—to govern consequential actions before execution. Gaston Besanson's paper, "One Gate Is Not Enough," exposes a subtle flaw in this design: remediation-induced control coupling. When one gate applies a remediation (like degrading an action or substituting evidence), it can alter the action, evidence, or context that another gate depends on, invalidating that gate's earlier assessment. This creates a safety gap that a single gate cannot close.

To address this, Besanson formalizes a remediate-and-regate protocol that re-evaluates actions after any remediation, preserving per-action soundness within stated assumptions. The paper also demonstrates that two implemented remediation operators—evidence substitution and resource-budget downroute—do not commute, meaning the order of gate operations is part of the control-plane semantics, not an implementation detail. It further shows that a governed evidence buffer is vulnerable to poisoning from uncovered defect classes. Empirically, using three published engines unmodified, five of six checks met their registered decision rules across all 30 pre-registered seeds; the sixth only passed under a larger workflow. The findings provide a concrete framework for composing stateful controls in agentic AI, with honest reporting of limitations.