A new framework aims to stop AI agents from getting away with plausible-sounding excuses for what they just did.
Researchers describe Explanation-Bound Tool Execution (EBTE), a mediation layer that sits between an AI agent and the tools it calls. Rather than trusting an agent's free-text rationale for an action, EBTE converts that rationale into a typed claim and checks it against server-held facts about intent, policy, payload, risk and freshness. If the claims do not match, the action is denied or flagged for review instead of executed. Across 136 authored test scenarios the system matched every specified outcome, blocked all 96 designated contradictions, and passed 232 additional consistency checks, while a stripped-down draft-only version blocked all 48 hard test cases without disrupting legitimate soft-review and draft actions.
The more revealing result is a side experiment with an actual hosted model attempting 224 tasks. The model's stated reasoning matched an independent read of what it actually did only 53 to 74 percent of the time across three separate samples, a gap that held up on revalidation of the same records. That inconsistency is the real argument for a system like EBTE: agent rationales are not a reliable account of agent behavior, so gating execution on server-verified facts rather than self-reported explanations closes an actual security gap.
It is worth noting the strong results come from conformance tests the researchers wrote themselves, and the real-world discrepancy rate, as low as 53 percent in one sample, is a useful gut check on how much you should trust an AI agent's own account of itself.