Tool-using LLM agents are shifting the unit of computation from explicit human-issued commands to model-driven tasks with stateful consequences. Yet today's agent runtimes still expose tools as isolated RPCs. This interface gives runtimes a convenient integration point, but it lacks a task-scoped execution boundary for commit, rollback, recovery, and audit across multi-step agent workflows. We argue that this mismatch calls for a runtime containment boundary rather than another per-call guardrail. This paper introduces Cordon, a transactional runtime system for staging and validating irreversible agent effects before commit. A semantic transaction is a task-level execution boundary that binds tool intents and runtime-tracked result lineage to reversible local state, staged external effects, delegated authority, and audit metadata. Cordon implements this abstraction with a transaction manager that tracks derived result objects, executes reversible mutations in shadow state, stages outward-facing actions in an effect outbox, and records recovery metadata. The runtime then validates the composed execution flow before it commits state or releases external effects. Our evaluation across adversarial and benign workflows shows that Cordon exposes cross-step violations missed by existing defenses. It also reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.

翻译：工具使用型LLM代理正将计算单元从显式的人类指令转变为具有状态后果的模型驱动任务。然而，当前的代理运行时仍将工具暴露为孤立的RPC。该接口为运行时提供了便捷的集成点，但缺乏针对多步代理工作流的任务级执行边界，无法实现提交、回滚、恢复与审计。我们认为，这种不匹配需要一种运行时包容边界，而非另一种每次调用的护栏。本文介绍了Cordon——一个在提交前暂存并验证不可逆代理效果的运行时事务系统。语义事务是一种任务级执行边界，它将工具意图及运行时追踪的结果血缘绑定到可逆的局部状态、暂存的外部效果、委托权限及审计元数据。Cordon通过事务管理器实现该抽象：追踪派生结果对象，在影子状态中执行可逆变更，在效果发件箱中暂存面向外部的操作，并记录恢复元数据。运行时在提交状态或释放外部效果之前验证组合后的执行流。我们在对抗性工作流与良性工作流上的评估表明，Cordon能够暴露现有防御机制遗漏的跨步骤违规行为，并在保持良性任务完成率的同时，以可接受的审批与延迟开销减少不可逆效果故障。