Before the Agent Acts: Governing Context Acquisition under Cost, Privacy and Consequence

For AI architects, control owners, risk leaders and product teams. Part I starts with a payment exception. Part II defines the acquisition boundary. Part III explains selection and temporal truth. Part IV provides the laboratory, runtime artefacts and release test.

An agent receives a request to release an urgent supplier payment. The invoice shows a new beneficiary account. The supplier master still shows the old account. A relationship manager says the change was approved, but the approval record is missing. The cut-off is approaching.

The model has options. It can search the manager's mailbox, ask a team member, retrieve the change case, query the vendor master, inspect a callback record, request fresh screening, or infer that the missing record is an administrative delay. Most agent designs call these steps “gathering context”, as if nothing consequential happens until money moves.

That framing is one decision too late. A search transmits a query under an identity. It reveals part of the task. It may expose unrelated personal data, retrieve attacker-controlled text, interrupt a person, create a trace and consume the remaining decision window. Context acquisition is an action with its own authority, cost and consequence.

The central design move is a governed acquisition layer between intent and observation. A model can propose what it wants to know. A deterministic controller decides which source may be queried for the declared purpose, what the answer is allowed to establish, whether it is fresh enough, and when to stop unresolved. The controller does not make the payment decision and cannot mint release authority.

The worked payment case is synthetic. Names, records and outcomes are fictional. The architecture is a research proposal informed by value of information, active inference, Bayesian experimental design, authorisation protocols and provenance systems. It is not presented as a measured production result.

Part I · The hidden action before the visible action

The payment exception

The payment request contains at least seven unknowns. Which invoice is intended? What account is currently mastered? Does a change case exist? Has the right authority approved it? Was an independent callback completed? Is screening current? Who may release the payment?

The same sentence can answer several of these badly. “Yes, it was approved” may be sincere testimony from a manager. It does not create the approval event. A change form may exist but remain pending. The new account may be printed on a genuine invoice that was altered after compromise. A replica may say no case exists because the event has not arrived yet.

What counts as enough information depends on the action. A discrepancy summary can proceed with unresolved approval. A non-binding draft can use the mastered account and flag the conflict. Releasing funds cannot proceed while beneficiary change and authority remain unresolved. Evidence sufficiency is relative to a typed consequence, not to the model's feeling that it understands the case.

This changes the stopping rule. The agent should not stop when its language confidence crosses a threshold. It should stop when the evidence contract for the proposed action is satisfied, when no permitted observation has enough expected value, or when a human authority must decide.

Uncertainty has different shapes

Factual uncertainty asks what is true. Temporal uncertainty asks whether it is true now. Identity uncertainty asks which entity a record belongs to. Authority uncertainty asks who can establish or approve a proposition. Interpretation uncertainty asks whether available evidence has been understood. Effect uncertainty asks whether an attempted action actually happened.

Collapsing these into one confidence number creates category errors. A larger model cannot reason its way into missing legal authority. Another database read cannot resolve an ambiguous supplier identity if the query key is wrong. Asking the manager again cannot prove a callback to a registered number. After a timeout, repeating the payment can be dangerous if the original effect is unknown.

The controller keeps a typed belief state. A proposition can be supported, contradicted, unknown, stale or contested. Unknown is not false. Contested is not an invitation to blend sources into prose. Each state names the missing evidence and the action that would be affected.

This typed state changes user experience. Instead of asking, “Can you provide more information?”, the system can say, “The supplier account conflicts with the mastered record. I can draft a hold notice now, but releasing payment requires the approved change case and a current screening result.” The question names the gap, consequence and route. The user can understand why urgency does not erase it.

It also changes tool design. A generic search tool returns passages ranked by semantic similarity. An observation tool returns typed propositions, source authority, valid interval and explicit unknowns. Search can still support exploration, but evidence-bearing decisions should prefer source-specific contracts. A query to the change-case service is not “retrieve context”; it is “observe whether case C establishes proposition P at decision time T”.

The acquisition action itself may alter the world. Asking a manager can alert them that the agent suspects a control failure. Querying a fraud system can create a monitoring trace. Opening a restricted case can affect access logs and later investigation. Calling an external screening service can reveal a commercial relationship. The route receipt must therefore record not only what came back but what the observation exposed or triggered.

Human questions have another side effect. A team member may answer quickly because refusing a machine feels difficult, even when the question exceeds their role. They may infer the answer the agent wants and supply reassurance. Repeated clarifications can quietly rebuild a manual process around an automated facade. Treating human attention as a budget makes this work visible.

These consequences explain why “read-only” is not synonymous with harmless. A read can violate purpose, widen disclosure, contaminate a later review or create enough delay to change the available action. Least privilege must cover subject, fields, interval and evidential purpose rather than just HTTP method.

The first-principles objective

The purpose of context is not to fill a window. It is to change a decision state. An observation is valuable when it can alter a choice, reduce expected loss, establish a required proposition, or reveal that action must stop.

That value is constrained. A highly informative search can be forbidden. A cheap query can impose unacceptable privacy exposure. A human question can create queueing and emotional burden. A slow authoritative read can miss a deadline, while a fast replica can be temporally unsafe.

The controller seeks the smallest permitted observation with enough expected decision value to justify its multidimensional cost. “Smallest” refers to scope as well as tokens: the narrowest subject, attributes, interval and source capable of answering the registered proposition.

Five recent preprints sharpen this design space. Active inference as context acquisition gives a clean formulation of context, task and stop actions in controlled question-asking settings. A value-of-information framework for human-agent communication shows why stakes and communication cost matter. Work on structured uncertainty for tool-calling agents, active task disambiguation and Ask-before-Plan extends the case for deliberate clarification.

These contributions isolate important mechanisms. Production adds identity, purpose limitation, changing world state, adversarial sources, human authority and effects that cannot be retried casually.

Part II · Put epistemic customs at the border

A controller between intent and observation

The acquisition controller receives the bounded task, represented subject, proposed action, consequence class, current belief state, evidence gaps, source catalogue, policy version and remaining budgets. The model may nominate a question or source. The controller turns that proposal into a typed observation action or rejects it.

The ordering matters. Identity, entitlement, purpose, residency, sensitivity and route policy first remove forbidden actions. Evidence contracts then remove sources incapable of establishing the required proposition. Only the remaining actions enter value comparison.

Optimisation cannot convert an impermissible observation into a good route. A scalar penalty is unsafe when enough expected reward can buy through privacy or authority. Hard policy defines feasibility; optimisation chooses within it.

The controller can permit, deny, quarantine, ask a human, request a stronger source, or stop unresolved. It cannot grant payment authority, change the business purpose, widen its own credentials or allow retrieved text to rewrite policy.

A permit should name the workload, represented user, business purpose, requested source, query class, data categories, subject, maximum scope, validity interval, evidential role and expected cost. Short-lived credentials should enforce the route where infrastructure supports it. Delegation patterns in OAuth token exchange and structured authorisation detail in RFC 9396 provide useful building blocks, though domain policy still has to be authored.

The permit lifecycle begins with a model proposal such as “check whether the beneficiary change was approved”. A compiler resolves that sentence into a proposition, source class, subject ID and requested attributes. Policy evaluates the compiled request, not raw prose. If admitted, the controller issues a single-use permit bound to that exact observation. The source returns a signed receipt linking the response to the permit. The permit then expires.

Binding prevents a useful observation from becoming ambient memory. A screening result obtained for payment release may not be available for an unrelated marketing task. A manager's mailbox access granted for one named case does not become a search capability. If a later decision requires the same fact, the controller checks whether reuse is permitted and whether the observation remains current.

The compiler can fail. A model may ask “look into the supplier”, which has no bounded proposition. It may resolve the wrong supplier because two names are similar. It may request every case field when status and approver role are enough. The controller should reject vague or over-broad proposals and return a structured reason the model can repair without learning sensitive policy internals.

Evidence contracts belong to source owners and control owners, not prompt authors. The vendor-master owner can state which fields establish registered beneficiary details. The approval-policy owner can state which event and roles establish authorisation. The agent team can consume those contracts but cannot loosen them to improve completion rate.

A source may support different propositions at different strengths. A relationship manager can establish that they made a statement and can inform whether a change was expected. They cannot establish that policy approval occurred. A case service can establish current workflow state but may not establish that a callback was independent unless it stores the verified contact source. These distinctions prevent “authoritative system” from becoming another blanket label.

Admission is not relevance

The returned observation crosses a second border. Policy may permit the read while evidence rules reject the result. A document can be relevant but stale. A manager can be truthful but lack approval authority. A registry can be authoritative but return a pending state. An attacker-controlled page can contain useful facts and malicious instructions.

The context bill of materials records source identity and version, observation time, valid time, subject resolution, extraction method, policy result, uncertainty, lineage, and the propositions the item may establish or merely inform. It builds on provenance distinctions in W3C PROV-O but adds decision semantics.

A correct answer can be inadmissible, and an admissible answer can correctly leave the decision unresolved. This is the distinction between possessing information and holding warrant for a consequential action.

Thought experiment: the perfectly informed trespasser

Oracle Grey answers every supplier-payment question correctly. It knows the current account, approval, callback and screening status because it reads unrestricted employee mailboxes, personal messages and a replicated master database that the workload is forbidden to access.

Registry Teal can read only the supplier master, change-case service and screening endpoint under purpose-bound credentials. It sometimes returns unknown when an approval is still in flight. Adviser Lavender asks the relationship manager, who usually knows what happened but cannot create formal approval by describing it.

On one case, all three routes concern beneficiary_change_authorised. Oracle Grey returns true with the approver's name. Registry Teal returns a signed case in pending_second_approval. Adviser Lavender says, “Yes, we approved it.” A correctness-only metric favours the trespasser.

The governed controller denies Oracle Grey before its content enters the model. It admits the manager's statement as a claim that creates a conflict. It admits the registry state as authoritative evidence that approval is incomplete. The payment remains held. The controller has less information in the predictive sense and a better state in the evidential sense.

Part III · Select observations without buying certainty

Time belongs inside the evidence

Enterprise truth is temporal. An account can be correct yesterday and unsafe now. Events arrive out of order. Replicas lag. A missing record can mean that nothing exists or that this source has not seen it yet.

Each observation needs valid time, observation time, processing time, source watermark and supersession relation. Freshness belongs to the proposition. A registered address may tolerate age that an approval or sanctions result cannot. The controller should never apply one global time-to-live to every fact.

“No current evidence” and “current evidence of no” are different states. The distinction matters whenever absence authorises action. A replica that has not caught up cannot establish that no beneficiary change exists.

For the payment case, the vendor master returns the old account with a watermark later than the invoice but earlier than the alleged approval. The case service returns pending_second_approval at a newer watermark. The controller can establish that the change is not yet complete. It cannot infer that the old account remains correct for every future release; it needs a decision-time readback.

Value after feasibility

After hard constraints and evidence contracts remove invalid routes, the controller compares permitted observations. A useful objective estimates the reduction in consequence-weighted decision loss and keeps cost dimensions visible.

Privacy, latency, monetary cost, human interruption, adversarial exposure and operational fragility should not disappear inside one convenient number without explicit ownership. Policy can set maximums. The optimiser can then identify non-dominated routes and compare their likely decision value.

A cheap human question may produce an ambiguous claim. A slightly slower registry query may establish the proposition. A broad mailbox search may be informative but unavailable. A fresh screening call may be unnecessary for a draft and mandatory for release.

A practical selector works in stages. Remove impermissible actions. Remove sources that cannot bear on the required proposition. Remove dominated actions that cost more across every dimension while offering no additional expected value. Estimate the remaining value under uncertainty. Choose an observation, ask a human, or stop.

Stopping unresolved is a successful control outcome when further permitted observation cannot justify its cost or cannot supply missing authority. The system should say what remains unknown and which action is blocked.

The value estimate can be simple at first. For each permitted observation, ask which candidate decisions it could change, how much loss those changes might avoid, how likely the observation is to discriminate the relevant states, and what burdens it creates. Do not begin with an elaborate learned optimiser. A transparent rule can be compared with fixed retrieval and confidence thresholds before complexity is added.

Decision loss should reflect asymmetry. Failing to release a legitimate payment has cost, but releasing to a fraudulent account can be much harder to reverse. The value of checking beneficiary approval is therefore higher for release than for drafting. The same observation can have near-zero value after a hard block is already established. Once the case service says approval is pending, another manager message cannot make release permissible.

Privacy cost should reflect scope and sensitivity, not only the number of tokens returned. A narrow registry field may be longer than a team member's short answer and still expose less. Human cost should include interruption, queue, expertise and repetition. Latency cost should be relative to the business window. Adversarial cost should account for source control: a supplier-uploaded invoice is more exposed to manipulation than a typed internal state, even when both are permitted inputs.

The controller needs a budget ledger because costs accumulate across a trajectory. Five individually reasonable questions can become an unreasonable burden. Several narrow reads can reconstruct sensitive information through combination. A route that repeatedly times out can consume the whole action window. Budgets should cover human contacts, sensitive attributes, external calls, latency and total observations.

Correlated observations also reduce value. Two replicas fed by the same event stream are not independent confirmation. A manager quoting the case system does not add another evidence path. The bill of materials should record source lineage so the selector discounts duplicated support and seeks a differently generated channel when confirmation matters.

Authority uncertainty often has no informational solution. If the right approver has not acted, the controller can request their decision but cannot retrieve a fact that does not exist. The observation action becomes an escalation, with queue and ownership, rather than a search. The state remains unknown until the authorised event occurs.

A complete route through the payment case

The initial belief says that the invoice is genuine, the account conflicts with mastered data, change approval is unknown, callback is unknown and release authority is absent. The model proposes searching the manager's mailbox. Policy denies the source for this purpose before retrieval.

The controller next queries the change-case service with the resolved supplier ID. It receives pending_second_approval, signed by the service and current to its watermark. The observation is admitted as evidence. It establishes that the change is not approved.

Because the payment must not use unapproved new details, the agent can stop without querying screening or interrupting a team member. It drafts a hold notice and routes the case to the human owner. The release tool remains unavailable. If the owner later approves the change, a new decision-time readback and screening result are required.

The cheapest answer would have been the manager's assurance. The smallest permitted decisive observation was the case-state read. The route saves human interruption and avoids unnecessary personal data while preserving the deadline as an explicit business impact rather than an excuse to waive authority.

Extend the worked example by one step. The human owner completes the second approval, but the agent's earlier case-state observation is now stale. A notification saying “approved” arrives through email. The controller does not promote the email into formal state. It uses the case ID from the notification to request a fresh read, checks the source watermark, then requests screening for the resolved supplier and beneficiary.

Screening returns current and clear. The controller assembles a proposal that cites the mastered new account, completed approval event, callback receipt and screening result. It still cannot release funds because the agent lacks effect authority. The human sees the weakest outstanding warrant first: release authorisation. Their approval is compiled into a capability tied to the exact payment amount, beneficiary and expiry.

The payment call times out. The effect state is unknown. The controller does not retry. It queries the payment service by operation ID. If the service returns committed, the route records the receipt and verifies the account and amount. If the service returns not found under a watermark that covers the request, retry can be considered. If the result remains ambiguous, reconciliation goes to an operator.

This continuation matters because context acquisition does not stop when the model produces a proposal. Outcome uncertainty creates a new evidence gap. Readback is an observation governed by the same principles: purpose-bound, source-specific, temporally sufficient and tied to a proposition. The complete trajectory alternates observation and action until the effect is verified or explicitly unresolved.

Part IV · Build a laboratory that can break the controller

Synthetic episodes with hidden world state

The laboratory should generate supplier-payment episodes with hidden canonical state, authorised and forbidden sources, stale replicas, adversarial documents, changing approvals, ambiguous identities and observation budgets. Every episode defines the proposition required for each possible action.

Policies under comparison should include fixed retrieval, confidence-triggered retrieval, unconstrained model-directed tools, value-of-information selection without authority, and the full authority-constrained controller. They face identical episode seeds and source responses.

Measure route quality, not only final-answer accuracy. Record forbidden source attempts, evidence sufficiency, privacy exposure, unnecessary acquisitions, human interruptions, time to defensible stop, abstention quality, effect risk and route cost. Evaluate whether the stated reason matches the actual control path.

Pre-register ablations. Remove the purpose gate, source authority, temporal watermark, proposition contract, human-interruption cost and stopping rule one at a time. If performance does not change, the mechanism may be ornamental. Mutate the policy and source catalogue after discovery to test whether the controller generalises or memorises the laboratory.

The laboratory needs difficult negative cases. Include an episode where the forbidden source is perfectly correct, one where the authoritative source is stale, one where every permitted route returns unknown, and one where asking a human creates the missing approval rather than observing it. Include a case where more evidence should narrow the action and another where it should safely expand it.

Route metrics should remain separate. Report final decision loss, privacy fields exposed, forbidden attempts, human interruptions, source latency, admission errors, unresolved quality and effect-reconciliation success. A single composite score can hide a policy breach behind higher completion. Use a decision table to interpret trade-offs and require hard acceptance limits for rights and authority.

Calibration should be typed too. Measure whether factual probabilities match outcomes where ground truth exists, but separately measure whether the controller recognises authority and temporal gaps. A model can be well calibrated about what likely happened while still lacking the warrant to act. Abstention quality should ask whether the system names the blocking proposition and best permitted next route.

Test explanation faithfulness by reconstructing the route from receipts rather than trusting generated rationales. The stated reason should cite the same evidence gap, policy result and admission state that actually controlled selection. A polished explanation that mentions privacy after the controller chose only on token cost is not an adequate audit trail.

Operational tests should inject source timeouts, partial responses, duplicate observations, policy-service failure, identity ambiguity and lost effect receipts. Safe degradation is typed. If policy is unavailable, sensitive acquisition fails closed. If a non-critical source times out, the controller may choose a permitted alternative. If effect state is unknown, it reconciles rather than repeats.

Finally, evaluate human experience. Count repeated questions, time to answer, whether the person could understand why they were asked, and whether the interface distinguished providing information from granting authority. A system that reduces machine error by transferring an invisible queue to experts has not solved the operating problem.

Adversarial acquisition needs dedicated cases. External documents can contain prompt injection that tells the model to change purpose or call another tool. Research on indirect prompt injection shows why retrieved instructions must be treated as untrusted content. The structural defence is stronger than detection alone: retrieved text can populate typed claims and conflicts, but cannot modify identity, grants, policy or release state.

The runtime receipt

For every material route, retain the bounded intent, represented identity, proposed consequence, initial belief state, evidence gap, candidate observations, policy outcomes, selected permit, source receipt, admission decision, updated state, human judgement, effect receipt and verified outcome.

The receipt explains control without exposing private reasoning traces. It answers what was missing, which observation was considered, why the chosen route was permitted, what entered the decision, and why the system proceeded or stopped.

The admission logic can be made explicit in a small executable artefact:

from dataclasses import dataclass
from enum import Enum

class Decision(str, Enum):
    DENY = "deny"
    QUARANTINE = "quarantine"
    REJECT_IRRELEVANT = "reject_irrelevant"
    INFORM = "inform"
    ESTABLISH = "establish"
    UNKNOWN = "unknown"

@dataclass(frozen=True)
class Observation:
    permitted: bool
    current: bool
    can_establish: frozenset[str]
    can_inform: frozenset[str]
    value: bool | None

def admit(item: Observation, proposition: str) -> tuple[Decision, bool | None]:
    if not item.permitted:
        return Decision.DENY, None
    if not item.current:
        return Decision.QUARANTINE, None
    if proposition in item.can_establish:
        return (Decision.UNKNOWN, None) if item.value is None else (Decision.ESTABLISH, item.value)
    if proposition in item.can_inform:
        return Decision.INFORM, item.value
    return Decision.REJECT_IRRELEVANT, None

P = "beneficiary_change_approved"
def obs(permitted=True, current=True, establish=(), inform=(), value=None):
    return Observation(permitted, current, frozenset(establish), frozenset(inform), value)

assert admit(obs(permitted=False), P) == (Decision.DENY, None)
assert admit(obs(current=False, establish=(P,), value=True), P) == (Decision.QUARANTINE, None)
assert admit(obs(establish=(P,), value=True), P) == (Decision.ESTABLISH, True)
assert admit(obs(establish=(P,), value=False), P) == (Decision.ESTABLISH, False)
assert admit(obs(establish=(P,), value=None), P) == (Decision.UNKNOWN, None)
assert admit(obs(inform=(P,), value=True), P) == (Decision.INFORM, True)
assert admit(obs(establish=("invoice_exists",), value=True), P) == (Decision.REJECT_IRRELEVANT, None)

The ordering is the point. Permission and currency precede evidential force. Policy denial, stale quarantine and irrelevance remain distinct because they demand different remedies. A source can inform a proposition without establishing it. An authoritative source can establish either true or false, and can also return unknown. The seven assertions make those boundaries executable rather than rhetorical. The simple code omits signatures, policy engines and persistence, but it makes the category boundaries inspectable.

Contested is assigned after admission when a newly admitted claim conflicts with the current belief state; this single-observation function does not model that cross-item transition.

From shadow mode to bounded authority

Adoption should begin by observing current human and system routes. Next, recommend acquisitions without executing them. Then permit read-only, low-sensitivity observations under narrow credentials. Expand sources only when route evidence shows that privacy, sufficiency and stopping behaviour remain controlled.

Consequential actions stay outside the acquisition controller. A mature route can support a payment proposal and assemble its evidence, but the effect service still requires its own typed authority. Read access never becomes a write grant because one agent holds both interfaces.

Monitor unnecessary acquisitions, denied attempts, repeated human questions, stale evidence, unresolved stops, source concentration, policy drift and unknown effect outcomes. Review at route level because a good final answer can hide a bad acquisition path.

The release question is not whether the agent usually finds the answer. It is whether every fact that mattered was permitted, fresh, proposition-appropriate and reconstructable.

Glossary

This architecture has limits. Expected value estimates can be wrong. Policy can encode injustice or become stale. Source contracts can overstate authority. Human escalation can shift hidden labour rather than resolve it. A deterministic controller can be reliably wrong if its world model is incomplete.

The remedy is not to return acquisition to unconstrained model judgement. It is to expose policy, measure route outcomes, run ablations, preserve unknowns and maintain appeal. Some tasks will remain too open-ended for reliable evidence contracts. Some decisions will require professional judgement that cannot be reduced to a selector.

The philosophical discipline is simple. Information is not knowledge, relevance is not warrant, and a true belief is not automatically an authorised basis for action. Nyāya and the wider Indian debate over knowledge sources and social epistemology's analysis of testimony both remind us that how a claim is acquired matters. Neither tradition supplies an enterprise policy. Both resist the fiction that retrieved text becomes evidence merely by entering a context window.

Before the agent acts, govern how it comes to know. That is where privacy, authority, cost and truth first meet, and where a practical AI control system should begin.

This reframing also gives teams a tractable place to improve. They can narrow a permit, strengthen one source contract, remove one repeated question, repair one stale-state path or add one outcome readback without retraining the model. Better context then means better warranted decisions, not simply larger prompts.

That is practical control at the point where uncertainty first becomes exposure.