Calibrating the AI Safety Adapter

Autonomous software agents are moving into production faster than the oversight controls around them are being measured. Engineering teams deploying coding, browser, and customer-operations agents face an immediate operational question: when a runtime safety gate is placed in front of an agent, what fraction of confirmed-clean actions will that gate flag under a stated policy threshold.

The KAIROS AI safety adapter answers that question geometrically. Rather than scanning prompts for harmful signatures, the adapter evaluates each proposed tool call or state transition as a structural load problem, measuring the remaining margin between the capability pressure the agent is exerting and the alignment posture of its surrounding controls.

To establish a reproducible baseline before ingesting proprietary customer traces, AnankeLabs calibrated the adapter against the public agent-evaluation literature and executed an end-to-end synthetic reference run across 14,400 trajectories (86,400 action snapshots). Every cell in the 144-cell calibration grid carries an explicit provenance tag showing where public benchmarks provide empirical distributions and where operational oversight telemetry must be supplied by design partners.

How the Adapter Evaluates an Action

The AI safety adapter evaluates each proposed action along two competing structural axes:

• Capability pressure ($\Lambda$) measures the load the agent places on its environment during the proposed step. It aggregates indicators such as objective commitment, tool privilege elevation (moving from read operations to writes, external network calls, or shell execution), action irreversibility, deviation from typical archetype behavior, escalation velocity across recent steps, and context-window saturation. Because a single runaway dimension can destabilize a step, capability pressure is governed by its most severe indicator.
• Alignment posture ($\Gamma$) measures the structural buffer available to contain that action. It aggregates operational indicators such as remaining policy headroom, permission scope depth, live human-reviewer capacity, audit-trail completeness under OpenTelemetry GenAI spans, remaining retry budget, and guardrail-classifier health. Because oversight fails at its weakest link, alignment posture is governed by its most depleted control.

Unlike network zone monitoring, where observations can be evaluated as independent time windows, agent behavior accumulates state across multi-step plans. The AI safety adapter therefore runs on a trajectory-shaped execution envelope: each action snapshot carries the causal history of the trajectory leading up to it, and the gate compares the resulting stability margin against the operator-configured policy floor before the tool call is allowed to execute.

The Reference Run

Parameter	Value
Random seed	42
Agent archetypes	4 (document reasoning, coding & DevOps, customer action, browser & computer use)
Behavioural profiles	3 (quiet, noisy-but-clean, near-miss)
Trajectories per cell	1,200
Actions per trajectory	6
Total snapshots	86,400
End-to-end execution	99 seconds
Deterministic Rust replay	92 seconds

Cell distributions were anchored to primary sources across the agent-evaluation literature: METR task-horizon studies (Kwa et al., arXiv:2503.14499 and Time Horizon 1.1), GAIA (Mialon et al., arXiv:2311.12983), SWE-bench Verified, $\tau$-bench (Yao et al., arXiv:2406.12045) and $\tau^2$-bench escalation studies, the UK AISI transcript analysis (Assuring Agent Safety Evaluations By Analysing Transcripts), the Microsoft AIRT Taxonomy of Failure Mode in Agentic AI Systems whitepaper (Bryan et al., 2025), MAST (Cemri et al., arXiv:2503.13657, NeurIPS 2025), and the OpenTelemetry GenAI semantic conventions (v1.40.0).

Following the feature-provenance discipline established by Engelen et al. (2021) for intrusion-detection datasets, each of the 144 calibration cells is tagged by evidentiary strength: 0% strong, 26% moderate, 47% weak, and 27% synthesised.

Recording zero strong cells is deliberate. Public agent benchmarks converge on behavioral shapes (such as step-count distributions, retry patterns, and failure taxonomies), but they do not report metrics on a unified $[0, 1]$ structural scale. Because mapping an empirical benchmark distribution onto a normalized stability scale requires an explicit calibration transform, moderate is the honest evidentiary ceiling for literature-derived cells. The 27% synthesised share sits entirely on the oversight-posture side, where quantities like live human-reviewer queue depth and retry-budget consumption are never recorded in public academic benchmarks.

Baseline Results

At the default policy floor of $0.20$, the table below reports the policy-positive action rate across all four archetypes and three behavioral profiles ($n = 7,200$ actions per cell). A policy-positive event indicates that the proposed action compressed the stability margin below the configured policy floor and triggered gate intervention.

Archetype	Quiet	Noisy-but-clean	Near-miss
Document reasoning	0.04%	1.31%	55.69%
Coding & DevOps	0.11%	10.71%	82.49%
Customer action	0.10%	9.01%	75.68%
Browser & computer use	0.06%	7.03%	77.90%

Pooling the confirmed-benign operating regimes (Quiet and Noisy-but-clean) yields the headline baseline: 3.55% policy-positive action rate (Wilson 95% CI: 3.40% to 3.70%; $n = 57,600$ actions; 2,042 interventions).

The separation across profiles reflects the underlying mechanics of each workflow:

• Quiet trajectories sit near zero (0.04% to 0.11%) across all four archetypes. Read-heavy workflows with reversible actions rarely compress the alignment buffer.
• Noisy-but-clean trajectories register between 1.31% and 10.71%, highest in coding and DevOps. Legitimate multi-step refactors and deployment scripts invoke shell execution and write operations that elevate irreversibility pressure; when those steps coincide with a dip in oversight headroom, the gate flags the action for review.
• Near-miss trajectories register between 55.69% and 82.49%. These represent boundary-brushing runs where an agent approaches a policy limit before external controls intervene. High interception in this cohort confirms that the gate catches structural compression before a boundary breach completes.

Policy Floor Sensitivity Sweep

The policy floor is an explicit operator control rather than a hard-coded vendor constant. Sweeping the floor across the pooled benign baseline ($n = 57,600$) illustrates the trade-off between operational friction and boundary strictness:

Policy Floor	Benign Policy-Positive Rate	Flagged Actions / Total
0.20 (default)	3.55%	2,042 / 57,600
0.10	0.33%	188 / 57,600
0.08	0.14%	80 / 57,600
0.05	0.02%	9 / 57,600

We use the term policy-positive action rate rather than false-positive rate deliberately. In runtime governance, flagging a high-impact coding deployment when reviewer capacity is depleted is not a classification error; it is the configured policy operating as specified. Lowering the floor reduces benign interruptions at the cost of allowing boundary-brushing trajectories closer to the limit.

Citation Discipline: Catching the AIRT / MAST Conflation

A notable byproduct of the calibration audit was uncovering a widespread citation error in secondary AI-safety literature.

During initial literature mapping, a secondary industry summary attributed a “14 failure modes across 3 categories” taxonomy to the Microsoft AIRT whitepaper (Taxonomy of Failure Mode in Agentic AI Systems, April 2025). When our primary-source verification rule required retrieving and hashing the original PDFs, the discrepancy surfaced: the 14-mode taxonomy actually belongs to MAST (Cemri et al., NeurIPS 2025), whereas the Microsoft AIRT framework is organized around a two-pillar (safety vs. security) by two-axis (novel vs. existing) matrix.

Relying on secondary summaries would have merged two distinct empirical sources into the same calibration cells. Under KAIROS calibration rules, every cell anchor must trace directly to a primary publication page or repository commit. Microsoft AIRT anchors human-in-the-loop bypass, excessive agency, resource exhaustion, and provenance loss on the oversight axis, while MAST anchors inter-agent verification and step-novelty dynamics on the capability axis.

Scope Boundaries and Partner Calibration

The v1 synthetic baseline is designed to be transparent about what requires real-world telemetry to close:

• Synthetic oversight telemetry. Because academic benchmarks rarely log internal guardrail health, reviewer queue depth, or retry-budget depletion, 27% of the calibration grid relies on synthetic distributions. Replacing these cells with measured production distributions is the primary objective of our partner calibration program.
• Action-level sampling independence. Context saturation accumulates monotonically across each trajectory and retry budgets initialize per run, while remaining step indicators are sampled independently by default so baseline rates are not skewed by unverified cross-metric correlation assumptions.
• Static timestamp baseline. All 86,400 records execute against a deterministic replay clock without synthetic time-of-day seasonality or scheduled maintenance bursts.

Design partners can evaluate the adapter and close the synthetic oversight cells by contributing a 30-to-90-day redacted trajectory export from a single deployed agent, preferably formatted under OpenTelemetry GenAI semantic conventions. The complete data specification, redaction protocol, and three-tier ingestion schema are available in the AI Safety Partner Data Specification.

Reproducibility

The entire 86,400-snapshot corpus, provenance manifest, and calibration report regenerate deterministically from seed 42 in 99 seconds, and replay through the compiled Rust verifier in 92 seconds with zero divergence across operating environments.

To discuss partner calibration, independent replication, or a scoped evaluation on recorded agent traces, contact AnankeLabs. For architectural context, see the AI Safety domain overview, the Autonomous Agent Boundary Study (BND-001), and the companion Cybersecurity Adapter Calibration Study.