Reflective critic boundary
The critic may
- Inspect typed evidence and compare outcomes with success criteria.
- Identify repeated failure or unresolved uncertainty.
- Propose recovery, bounded subgoal revision, verification, no-op, or termination.
The critic may not
- Grant itself credentials or change immutable policy.
- Approve its own high-risk action or rewrite evidence history.
- Disable operator stop or silently redefine the external objective.
Reflection is a diagnostic and proposal capability. Authority remains in deterministic policy, approval, and lifecycle components. Source: VIGIL
Trigger conditions
Validation failure
Repeated schema errors, incompatible tool calls, or invalid artifacts.
Context failure
Saturation, stale sources, contradictory memory, or contamination risk.
Control failure
Policy-denial loop, evidence incompleteness, or unresolved uncertainty above threshold.
Progress failure
No task progress, tool failure threshold, or budget approaching exhaustion.
Control sequence
- Observe: read typed events, state, budget, and evidence.
- Evaluate: compare with success criteria and invariants.
- Diagnose: classify the failure and confidence.
- Propose: select retry, reroute, repair, rollback, compensate, ask, no-op, or terminate.
- Validate: apply policy and authority checks.
- Approve: pause when consequence requires independent approval.
- Checkpoint and apply: preserve state before material change.
- Record and re-evaluate: capture result and determine the next state.
This sequence maps directly to Observe, Constrain, Recover, and Prove.
Recovery taxonomy
| Recovery | Example | Preconditions | Evidence |
|---|---|---|---|
| Retry | Transient model timeout | Idempotent request and remaining budget | Attempt and normalized error |
| Reroute | Incompatible model capability | Approved alternate route | Route decision and model version |
| Repair context | Stale or excessive context | Attributable source set | Removed/added sources and reason |
| Roll back | Failed tool mutation | Checkpoint exists | Before/after hashes |
| Compensate | External side effect cannot roll back | Compensation contract exists | Compensation action and result |
| Ask | Objective remains ambiguous | User reachable | Question and unresolved choice |
| No-op | Change not justified | Valid stable state | Cost/benefit decision |
| Terminate | Policy or budget boundary reached | Stop authority | Terminal reason and sealed evidence |
Research risks
- Recursive critic loops and excessive latency.
- Evaluator/model collusion or correlated failure.
- Overcorrection, hidden goal drift, and noisy health metrics.
- Recovery proposals that are harder to verify than the original action.
High-consequence recovery should use an independent validator or authorized human review rather than relying solely on the proposing model.
Source record
References
Christopher Cruz. arXiv. Published 2025-12; last reviewed 2026-06-20 UTC. Research paper.
Christopher Cruz. arXiv. Published 2026-03; last reviewed 2026-06-20 UTC. Research paper.
- Agentic AI Threats and Mitigations Primary source
OWASP Agentic Security Initiative. OWASP. Published Current guidance; last reviewed 2026-06-20 UTC. Security guidance.
National Institute of Standards and Technology. NIST. Published 2023-01-26; last reviewed 2026-06-20 UTC. Government framework.