Concordat: Typed Sessions for LLM Agents
Agents now take consequential actions (refunds, cancellations); typed session rules enforce who-may-do-what before the call.
The explainer · 3-minute read · 251 words
The claim
Typed sessions enforce an agent's rules at run time, instead of trusting the prompt.
The problem
Agents now take consequential actions like refunds and cancellations.
Their rules usually live in the prompt text.
The model follows those rules only as reliably as it chooses.
How it works
Concordat treats the agent as an object with a finite-state protocol.
Each turn offers the model only tools that are legal in the current state.
Calls outside that set are rejected before any side effect.
Human-only decisions can only be requested, never taken by the model.
Subclass agents are rejected if they could bypass the parent protocol.
Figures
What changes
On tau-bench airline tasks, the standard agent skipped confirmation in 13 of 50 tasks with GPT-4.1.
With Claude Haiku 5.5 it skipped in 29 of 128 task-runs.
The Concordat agent made zero such violations, with no significant task-success cost.
Limits
tau-bench's own reward missed most of these violations.
The evaluation covers 50 airline tasks and simulated pressuring customers.
Protocol design still needs human care; the library only enforces it.
Source · arXiv wire