How much safety can you actually get from a runtime contract?
Runtime contracts are not a theoretical idea—they have been tested in real agent systems, and the numbers are strong. In one evaluation, a runtime enforcement system called AgentSpec blocked unsafe executions in over 90% of code-agent cases, eliminated all hazardous actions in embodied-agent tasks (like robots), and enforced 100% compliance in autonomous-vehicle scenarios [1]. That means for a typical coding agent, fewer than 1 in 10 dangerous actions gets through; for physical-world agents, the system stopped every tested hazard.
Another framework, Agent Behavioral Contracts (ABC), measured how many violations it caught that a baseline (no contract) would miss. Across 1,980 sessions, contracted agents detected 5.2 to 6.8 'soft' violations per session—things like policy breaches or minor rule infractions—that uncontracted agents completely missed [2]. The effect was statistically strong (p < 0.0001), meaning it's very unlikely to be chance. So the practical answer: you can depend on runtime contracts to catch a large majority of unsafe actions, and to surface many subtle issues that would otherwise slip through.
What are the limits and caveats?
The biggest caveat is that the rules themselves are often generated by LLMs, and those rules are not perfect. In one test, rules generated by OpenAI's o1 model for embodied agents achieved 95.56% precision (most rules were correct) but only 70.96% recall (about 29% of actual hazards were not covered by the rules) [1]. That means a contract is only as good as its rule set—if you miss a rule, you miss the hazard. So while the enforcement mechanism is highly reliable, the rule-writing step still needs human oversight.
Another limitation is that contracts don't eliminate all risk. The ABC framework achieved 88–100% hard constraint compliance (like 'never delete a file outside the sandbox'), but not always 100% [2]. And recovery from violations varied by model: frontier models recovered 100% of the time, but across all models it ranged from 17% to 100% [2]. So if a contract detects a violation, it may not always be able to recover the agent to a safe state—especially with weaker models. This means you should design contracts with fail-safe mechanisms, not assume they'll always fix the problem.
Why are runtime contracts worth depending on despite the imperfections?
The alternative—relying only on training-time safety (like RLHF)—is structurally insufficient for agents that execute code or interact with the real world. A 2026 audit of 52 documented AI-agent incidents found that many safety failures happen at runtime, not because the model was 'unsafe' but because it took actions that were contextually dangerous [3]. Runtime contracts add a layer that can block those actions before they happen, and they do it cheaply: overhead is under 10 milliseconds per action in the ABC framework, and in milliseconds for AgentSpec [1][2]. That's a tiny cost for a big safety gain.
The three studies converge on the same conclusion from different angles: AgentSpec shows high enforcement rates across domains, ABC shows high violation detection and drift bounds, and the position paper argues that runtime contracts are the right unit of safety, backed by evidence from computer security and experimental sciences [1][2][3]. They don't replace training-time safety, but they add a dependable, verifiable layer that makes agents safer in practice. So for an AI safety engineer, the answer is: yes, you can depend on runtime contracts as a primary safety mechanism, but you must invest in rule quality and keep human oversight in the loop.
About These Sources
This answer is built on 3 studies (all preprints) — published from 2025 to 2026, 3 from 2024 or later — selected as the most relevant from 3 studies that passed quality screening, drawn from 35 papers retrieved from a database of over 500 million.
Sources used in this answer
AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
AgentSpec, a runtime enforcement DSL, blocked unsafe executions in over 90% of code-agent cases, eliminated all hazardous actions in embodied-agent tasks, and enforced 100% compliance in autonomous-vehicle tests, with millisecond overhead; LLM-generated rules achieved 95.56% precision and 70.96% recall for embodied agents.
Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents
Agent Behavioral Contracts (ABC) detected 5.2–6.8 soft violations per session that uncontracted baselines missed (p < 0.0001), achieved 88–100% hard constraint compliance, bounded behavioral drift to D* < 0.27, and had recovery rates of 17–100% across models, with overhead under 10 ms per action.
Agent Safety Should Be a Runtime Contract
A position paper arguing agent safety should be a runtime contract, supported by a survey of 52 AI-agent incidents, a false-completion audit of 31 cases, and a trajectory-schema audit of 12 public agent systems, showing that training-time safety alone is insufficient.