What is execution control for AI agents?
Execution control decides, before an AI agent's action produces a real-world effect, whether that action may happen now: whether it stays within what was approved, whether the execution proposing it is still valid, and whether the same effect has already happened or its outcome is still unknown.
Why AI agents need it
AI agents no longer only answer questions. They issue refunds, change orders, update ERP records and send commands to robots. Each of these actions leaves a real-world effect: money moves, a record changes, an object is picked up. Once it has happened, it cannot simply be taken back.
Most of the expensive failures involve no attacker at all:
- A refund request times out. The agent assumes it failed and tries again. The customer is refunded twice.
- A plan changes halfway through, but an instruction from the old plan still goes out.
- A task is reassigned to a second robot while nobody knows whether the first robot already did it.
- An agent holds a perfectly valid permission, and uses it far beyond the task it was given.
These are not failures of intelligence. A smarter model still cannot know whether a request that never answered was executed.
The three questions
- Is it within what was approved? The request that actually goes out must match the approved action. Approve a €100 refund for order 48213, and €1,000, or another order, is refused.
- Is the execution still valid? Retries, failover, replanning and reassignment create new executions. A replaced or cancelled one cannot act, even if its credentials still work.
- Has the same effect already happened, or is it unknown? If it happened, it must not happen again. If nobody knows yet, it waits until the facts are established.
The decision is one of three: allow, hold (find out first) or block.
Rules that make the difference
A timeout is not a failure
An unknown outcome is a reason to find out, never permission to try again. Evidence comes from the target system: a status query, a receipt, a callback, a sensor reading.
A new approval does not skip old uncertainty
A new task, a new execution, another agent or a fresh approval can all be valid, and still wait, because an earlier attempt at the same action is unresolved.
Late answers update facts, not authority
A confirmation that arrives after an execution was replaced can establish what happened. It never makes the old execution valid again.
"It didn't happen" needs two proofs
Seeing no result now is not enough. It must also be established that the earlier request can no longer take effect later.
Not "each kind of action only once"
The same effect never happens twice. A new refund the customer asks for later is a different effect and goes through normally.
How it differs from what you already have
| Control | Question it answers |
|---|---|
| Identity and access (IAM) | Who are you? |
| Policy engines, AI gateways, MCP gateways | What are you generally allowed to call? |
| Idempotency keys | Was this exact request already sent? |
| Workflow engines | How do I resume a workflow after a failure? |
| Execution control | May this specific real-world effect still happen now, and has it already happened? |
Idempotency keys protect against the same request being sent twice. Agents often create a new request for the same effect, after replanning, through another tool or from another workflow. Execution control tracks the effect itself, not the request.
Frequently asked questions
Does execution control replace IAM or an AI gateway?
No. Identity and policy remain inputs. Execution control answers a different question: whether this specific action may happen now, and whether it already happened.
What happens when evidence is not available?
The effect stays unknown and is surfaced for a person to decide, rather than being retried automatically.
Does it replace a robot's functional safety?
No. It controls discrete tasks: no repeated tasks, no stale commands, stop when unsure. It does not interrupt a physical action already in progress.
Does it stop agents from reading sensitive data?
No. It controls actions, not data access. For data sent to external AI, see AI data masking.
Related: Execution Guardian · Execution Gateway · Technology · What is AI data masking?
Start with one real action.
Pick one workflow where an AI agent can cause a real business or physical effect. We map where execution control should sit.