Keeping Human Instructions in Force: SAI Adds Persistent Authority to LLM Agents

Introduction

LLM agents are increasingly asked to decompose tasks, call tools, and coordinate other agents. In many systems, a human operator still corrects the agent by adding another natural-language instruction to the conversation. That approach has two weaknesses: the instruction may be interpreted ambiguously, and its influence may fade as new plans and observations accumulate in the context. A paper on arXiv proposes Structured Authority Injection, or SAI, as a protocol-level response to this control gap.

What SAI changes

• Typed overrides instead of free text. Operator corrections are routed through schema-validated Model Context Protocol (MCP) tool calls. The intervention therefore has an explicit structure instead of relying entirely on the model to infer what a sentence means.
• Three override classes. SAI defines Constraint, Priority, and Strategy overrides. They represent different kinds of intervention and carry distinct persistence semantics, allowing a system to distinguish a hard behavioral restriction from a change in task ordering or execution approach.
• A ranked authority context. The protocol maintains an ordered set of authoritative instructions and prepends it to every LLM prompt. It also specifies an explicit precedence order, while keeping the authority channel inaccessible to the planning process itself.
• No model retraining required. The proposal does not require fine-tuning or access to model weights. It is intended for instruction-tuned LLMs that support MCP tool use, placing the main design burden in the agent protocol and context-management layer.

Findings and limitations

The authors evaluate SAI across nine LLMs and eight scenarios designed around agent failure modes. The reported results show fewer cases of ambiguous directive interpretation and less erosion of operator authority over repeated planning iterations. For some combinations involving the strongest models, the approach also reduces prompt overhead by as much as 38%. The result is not uniform, however: the paper notes substantial variation across models, so the protocol should not be treated as a guaranteed improvement for every agent stack.

Why it matters

SAI reframes human oversight as a communication and authority-management problem rather than merely a prompting problem. By separating the agent’s working plan from instructions that must remain binding, an implementation can make supervision rules more explicit and potentially easier to audit. The distinction may be useful in orchestration systems where an operator needs to revise an agent without repeatedly restating the same instruction.

The proposal is not a claim that structured messages make models perfectly controllable. A deployed system would still need to define override semantics carefully, handle conflicts between directives, and monitor whether the model follows the injected context. Since the measured benefit differs across models, validation in the target workload remains essential. SAI is best understood as a general design pattern for persistent human control, not as a universal guarantee.

Source: arXiv