Conservation Invariants: Why Permissions & Human Approval Aren't Enough for Autonomous AI

Most enterprise engineering teams approach AI agent governance through the lens of classical Identity and Access Management (IAM): "Is this agent authorized to call issue_discount up to ₹500?"

Role-Based Access Control (RBAC) and tool-scoping policies are necessary. But they answer only one question: Is the agent authorized to attempt this transition? They provide zero guarantee that the resulting business state satisfies the domain's required conservation invariants.

When software moves from deterministic microservices to stochastic LLM agents, a new failure mode emerges: an operation can be syntactically valid and fully authorized, yet still produce an invalid business state across system boundaries.

In traditional software, changing data is straightforward: Current State + Action → New State. The local database or monolithic ERP checks domain constraints and rejects writes if balance drops below zero.

However, modern AI agents do not live inside a single accounting database. They orchestrate actions across fragmented enterprise SaaS tools and subledgers that have no awareness of each other:

Shopify applies the ₹400 discount because it only checks local cart rules. It cannot see that the enterprise marketing campaign budget stored in Postgres only has ₹300 remaining. The agent holds valid API keys for both systems, but neither system communicates cross-silo.

The Runtime Solution: State Projections & Exception Routing

To solve this, the MudraForge runtime executes a State Projection Engine before committing any side effect:

1. Authoritative State Ingestion: The runtime queries the source of truth for each participating entity.
2. State Diff Simulation: It calculates the decision-time model: Order ₹10,000 → ₹9,600 | Budget ₹300 → -₹100.
3. Invariant Assertion: The runtime asserts assert(PromoBudget >= 0) outside the LLM.
4. Self-Correction or Escalation: If violated, it returns structured feedback for autonomous agent re-planning (e.g., auto-adjusting to ₹300) or escalates to a human holding explicit Exception Authority in Adesha.

When organizations realize AI models make mistakes, the common reflex is: "Just add Human-in-the-Loop (HITL)."

Consider an agent proposing a ₹20 withdrawal from a controlled account holding ₹10 available balance, where overdraft facilities are strictly prohibited by banking policy:

If the system routes this transaction to a manager dashboard and the manager clicks "Approve", the committed balance is still -₹10. Human approval cannot make broken arithmetic valid. Human authority cannot authorize a state that domain physics forbids.

Pre-Escalation Invariant Filtering: In MudraForge, domain invariants are evaluated before human review. If an action breaks basic arithmetic or regulatory rules, the runtime rejects or triggers autonomous replanning immediately. Human attention is reserved exclusively for transitions that are already mathematically valid and require discretionary business judgment.

In classical computing, Time-of-Check to Time-of-Use (TOCTOU) races occur over milliseconds. In agentic workflows, human review latency stretches this vulnerability window from seconds to hours:

To govern autonomous mutations safely across their entire lifecycle, MudraForge enforces five deterministic execution control paths:

In enterprise systems, a business transaction rarely updates operational, settlement, and general ledgers simultaneously. Different systems legitimately reach their states at different times.

Consider an agent paying a vendor ₹50,000 when a network timeout occurs during the bank transfer call. In naive implementations, the LLM reasoning loop observes an error and concludes: "The payment failed. Let me retry the transfer." If the bank actually processed the transfer before timing out, the retry causes a ₹100,000 double-payment disaster.

In MudraForge, network timeouts lock the transaction in an UNKNOWN state machine. The agent is immediately stripped of retry authority. The runtime engages the provider's authoritative reconciliation mechanism via deterministic idempotency keys and compensating sagas before any further action is permitted.

The runtime does not invent business semantics. The enterprise business owner defines what states mean; the execution runtime enforces that those states are obeyed.

When autonomous agents are granted authority to mutate real-world enterprise databases, safety is not an LLM prompt engineering problem. It is an execution runtime guarantee:

Treating these five questions as one is where catastrophic production failure begins. At MudraForge, this separation is the cornerstone of our execution runtime boundary.