KedgeFlow: A Programmable Control Plane for Enterprise AI Agents

What it is

KedgeFlow (He and Yu, OpenKedge.io; arXiv 2610.14810v1) is a specification, not a product. It splits agent action execution, in the style of OpenFlow, into an untrusted Agent Plane, a trusted Control Plane (admission, grants, outcomes) and a privileged Enforcement Plane (gateway and resource adapter). Only the enforcement plane holds target mutation credentials. The page text available here ends partway through Section 3, so the message formats and the proofs are not covered.

How it works

• Grant and root: Admission freezes the proposal (action, target, expected resource version). The Grant Authority signs a grant bound to that exact request. The grant points to an execution root, a single-use allowance that is preserved across replacement grants ("generations"). Retrying or replacing an unclaimed grant therefore never creates a second allowance.
• Gateway order: The gateway (1) authenticates the caller, (2) checks the grant against the exact request, (3) claims the root atomically in shared state (etcd), (4) exchanges for a target-only credential, and (5) rechecks current policy and ownership before authorizing dispatch. The adapter then makes a fixed native call with a target-side guard such as a resource version.
• Uncertain outcomes: If the result is unknown, the gateway records Unknown and the root stays consumed. A later query correlates observations with that attempt and never redispatches or issues fresh authority.
• Descriptors: A versioned tool descriptor is bound into the grant by digest. It carries the consequence tier, conflict domain and compensation metadata, so a substituted descriptor fails validation.

Preconditions / Affected

The two safety properties (at most one claim per allowance, and every dispatch linked to a matching grant, claim and authorization) are conditional on all of these:

• Issuers, policy administration, the authority store, the gateway, the credential broker and the target-side checks are uncompromised.
• Authority state cannot be rolled back.
• Complete mediation: every route to the effect enforces the boundary. Direct APIs, shell credentials, remote sessions, subagents, admin clients and inherited tokens must be inventoried and restricted. An agent-side hook or a localhost-only gateway does not close these routes.
• The target's guard must be enforced atomically with the mutation. An operation ID alone does not provide that.

Caveats

• Claim test: The 6,560-attempt result comes from three etcd members on a single host. Admission, identity and evidence are scripted fixtures, and the target is a mock. The adversarial tests use a scripted component, so they measure the execution boundary, not an LLM attack-success rate.
• Policy correctness: Deliberately permissive policy still authorized an undesirable effect. Execution authorization does not make a bad approval safe, and a compromised issuer or policy admin defeats the guarantees.
• Cross-allowance coordination: The paper's own example is two agents draining different nodes of a three-node service that needs two available. Each approval is valid alone, but both together break availability. Exact binding and root consumption do not stop this, because they do not coordinate distinct allowances. It needs shared reservations, which are untested.
• Outcome reconciliation: The reconciliation library was tested only against scripted observations, not a deployed target-query service.
• Untested: native crash recovery, exactly-once effects at real targets, interoperability between independent implementations, and enforcement of every production access route. Only three bypass routes were tested locally.

What to do

Nothing is directly deployable from this page. The usable takeaway is an audit checklist for any agent-to-production design. Ask whether approvals bind exact parameters, whether permission use is recorded in shared atomic state, whether a lost response is treated as "unknown" rather than "retry", and whether the agent runtime can reach the target by any path outside the gateway.