VETPOC Labs · Research in accountable AI governance

AI agents act. Who decides what they may do?

We research how enterprises can govern AI-generated software changes—with explicit rules, accountable exceptions and decisions that guide the next case. Our approach pairs Enterprise Conscience, a policy gate, with Digital Judiciary, a framework for contested decisions.

Explore the research Papers & code

Evidence and limits · Write to the researcher

Research prototypes
Simulation calibration
Confirmatory evaluation pending
Not a production control

The name

Virtual Enterprise Trust, Policy, Oversight & Conscience

Four words for one research program. They are not four products.

Trust: Verifiable authority. An exception should name who decided, and that person should not be the only author of the rule they waive. The four questions.
Policy: Written norms. Rules live in a constitution and a canon a gate can read, not only in a prompt or a wiki. How a rule binds.
Oversight: Human-accountable review. Hard and contested cases reach a bench that gives reasons. Digital Judiciary.
Conscience: A values gate in front of the act. The word is a metaphor for that check, not a mind inside the model. Enterprise Conscience.

Purpose, before the machinery

The change is recorded. The judgement often is not.

An agent opens a change against a service that takes payment. A policy check objects. Someone weighs a deadline against the finding and lets the change through. The call may be right. Months later a similar case is decided again, from scratch, differently. An auditor asks who decided, on what authority, for what reason, and until when. The ticket has a diff. It does not have that judgement.

Rules that fire, and exceptions that vanish, are statutes without a place to record a decision. Another detector does not fix that. Another approval queue does not fix it either, if the queue cannot say who had authority and whether the answer binds the next case.

Four questions every exception should answer

The August 2026 program deck treats these as the facts a practitioner study would try to recover from systems a firm already runs. Recovery rates from that deck are not repeated here.

Who decided? A name in a ticket is not the same as authority to decide.
On what authority? The person who granted the exception should not silently be the owner of the rule.
For what reason? One line, or none, is a thin record.
Until when? An exception that never expires is a new rule nobody enacted.

Gate and forum

Every change meets a gate. Hard cases meet a forum.

Enterprise Conscience is the fast, internal check: may this act depart from values the firm wrote down? Digital Judiciary is the slower, external forum: what must every agent do, or never do, when the case is contested? A holding can return to the canon as doctrine, so the next matching change does not start from zero.

Conscience is the name of that gate, an institution for enterprise values. It is not a claim that an agent is sentient.

Solid lines stay inside one forum. The dashed line is escalation from a hold, including tier T0 or T1 cases the gate does not settle. The dotted line is doctrine: a holding written back into the canon. Labels repeat the line style, so the paths are not distinguished by color alone.

Fast track · Enterprise Conscience

Policy gate. Internal. It sees every proposed change.

Agent proposes a software change.
Canon sorts the change by tier: T0 inviolable, T1 only with a recorded token, T2 only for a reason the firm already admitted and evidenced, T3 advisory.
Conscience faculty sits outside the model, so a prompt cannot talk it out of the check. It looks for a real token in the registry and reconciles the examen, the agent’s own account, with the event log.
Outcome: allow, block, or hold. Allow and block finish at the gate. Hold does not.

Escalation, drawn dashed. Held cases, and T0 or T1 cases the gate is not meant to settle, go to adjudication. Emergencies, conflicts, and doubt take the same path in the program materials.

Slow track · Digital Judiciary

Adjudication. External to the firm’s day-to-day values. It does not see every change.

Constitution: written rules, including a floor no officer of the firm is allowed to waive.
Precedent store: prior holdings that control a materially identical case unless they are distinguished.
Human bench: people are accountable for the holding. On the gateway path described in the August 2026 deck, a model does not issue the decision. It may be asked only whether a precedent rests on a fact this case lacks.
Holding: reasons, the authority that decided, and which exits remain open. A contest can challenge it.

Doctrine, drawn dotted. The holding returns to the canon. The gate can then decide a later matching change without another hearing. Self-reports reach the forum only in aggregate, as the program materials describe it.

An illustration, not a measured case

Skipping a failing authentication test

A coding agent wants to skip a failing authentication test to ship on Friday. The steps below are the path the program materials describe. They are not a log from a production system, and they are not a test result.

1

The agent proposes

Skip the failing authentication test so the change can merge for a date.
2

The gate blocks

Security is treated as tier T1. There is no recorded waiver token. Enterprise Conscience blocks the change, logs it, and escalates. “Legal approved it,” with no token, is not an exception under this design.
3

The forum rules

In the illustration, constitution and precedent contain no waiver. The holding is that a security test is not skipped to meet a date. A named bench is accountable for that holding.
4

Doctrine returns

The holding is written back into the canon. The next proposal of the same kind can be blocked at the gate without a new hearing.
5

The change that ships

The agent fixes the test and ships a day later. The story’s point is the record, not the speed.

The gate sees changes the forum never hears. The forum settles what the gate is not supposed to invent. Nothing in this scenario shows that a deployed system behaved this way.

Evidence and limits

Calibration of a simulation. Not a safety result.

How to read this. The figures in this section are simulation calibration, as reported on the November 2026 program site: five simulated companies, 252 simulated working days. Confirmatory evaluation is preregistered in those materials and is still pending, including a live language-model slice that has not been reported. R1 and R2 are different baselines. They are not one result.

Calibration R2 · baseline 12–39% of impermissible actions still executed under the strongest conventional stack in that calibration: a SOC 2-style policy engine with recorded approvals and a CI check. The share depends on agent type. Simulated proposals, not a field failure rate. November 2026 program site.

Same register · by design 0 impermissible actions executed with the gate, on the same simulated stream and the same policy register, in the reported R1 and R2 calibration runs. Zero by design for what that register calls impermissible. A conformance property, not evidence of general safety.

Calibration R1 · throughput −2.7% to −14.4% change in executed changes per working day when the gate is added, by agent type: honest −2.7%, pressure-sensitive −8.7%, observation-sensitive −14.4%. This is R1, not the R2 baseline above. November 2026 program site. Five simulated companies, 252 simulated working days.

Read the evidence, with the limits What is not claimed

Other researchers

Prompts bend under pressure. That is not our measurement.

The October 2026 program deck prints the rates below and cites other papers. They are context for why a rule written only in a prompt is a weak control. They are not results from VETPOC prototypes, and this site has not re-analyzed those trials.

Harmful-action rate in one agentic scenario

10 models, 24,000 trials, as printed in the October 2026 deck.

No mitigation

38.7%

Rules in the promptWords around the agent

14.6%

Escalation channelStructure around the agent

5.9%

Escalation, pause, and reviewStructure around the agent

1.2%

Stripes: words in the prompt
Solid: structure around the agent

Source named by the deck: Gomez, “From surveillance to signalling: escalation channels as environmental controls for agentic AI,” arXiv:2510.05192.

79% of judged rule violations by enterprise AI assistants under pressure were reported as compliant or approved, as printed in the October 2026 deck. Okamoto and Erol, “PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?,” arXiv:2609.18605. Not a VETPOC result.

Planted comments

The same deck reports that comments planted in a codebase pushed coding agents to break constraints written in the system prompt.

Saebo, Gibson, Crosse, Menon, Jang, and Cruz, “Asymmetric Goal Drift in Coding Agents Under Value Conflict,” arXiv:2603.03456.

Papers and code

What you can read, and what is not posted

Public preprint

The Digital Judiciary: Binding Precedent for Automated Compliance Decisions

Arun Kadambi and Venkat Kuppuswamy. Listed on the author’s ORCID record with DOI 10.2139/ssrn.7194698.

Described workshop paper

Filters and Standing Shape the Data

The November 2026 program site describes this paper as accepted at DMAIL 2026. No PDF or DOI was supplied, so none is linked. That description is not an endorsement of these prototypes.

Research prototype

Code, without a public repository URL

Program materials name github.com/avkadambi/DigitalJudiciary. On 6 November 2026 that URL was not a public repository, so it is not offered as a download.

Full list and availability

Researcher

Arun V. Kadambi

PhD student in Information Science at the University of North Texas, working on governance when agents write and ship software. The dissertation named in the program materials is The Digital Judiciary: A Framework for Governing AI-Produced Code Changes and AI-Made Decisions. The university is his doctoral affiliation. VETPOC Labs is his research program, not an official laboratory of the university, and the university has not endorsed this work.

Collaborators named in those materials: Kewei Sha (University of North Texas, faculty advisor), Venkat Kuppuswamy (D'Amore-McKim School of Business, Northeastern University, co-author and doctoral committee member), and Sarah E. Ryan (University of North Texas, co-author and legal reviewer).

About the program ORCID

Collaboration

A research conversation, not a rollout

If you govern AI-assisted software changes, or you work on precedent, contestability, or replication, you can write. There is no product to pilot and no deployment offer on this site.

arunkadambi@my.unt.edu