PRIME Makes AI Agents Account for Every Conclusion

Introduction

Large language model agents are increasingly used to review vulnerability reports, compliance records, and other structured submissions. The challenge is not merely retrieving facts. An agent must determine whether the available evidence is sufficient for a particular conclusion, especially when a requirement can be satisfied through several alternative routes.

That distinction is where models often fail. They may accept a record after a mandatory check has failed, or stop at a weaker conclusion without exploring another route that could still satisfy the requirement. A paper on arXiv introduces PRIME, short for Precommitted Rules for Inference from Minimal Evidence, as a way to place tighter boundaries around this reasoning process.

How PRIME works

• Evidence routes are fixed in advance. Before checking starts, PRIME defines the evidence combinations that can support each conclusion. For example, a requirement might accept either a severity rating paired with a curator-reviewed advisory or a link to a published advisory. The agent cannot simply redefine the standard after seeing convenient fragments of evidence.
• A separate ledger controls authorization. An external program records the outcome of each check. It rejects any conclusion that is not licensed by the rules and the recorded results, even if the language model proposes a more favorable answer.
• The system can pursue stronger outcomes. If the current evidence supports only a limited conclusion, PRIME points to checks that could establish a stronger one, or performs those checks itself. This turns refusal into a recoverable state rather than the endpoint of the workflow.
• The guarantee has explicit conditions. The paper’s strongest claim assumes that the requirements are correct, checks can be performed at known locations, and enough budget remains when the process stops. PRIME therefore does not compensate for defective business rules, ambiguous sources, or missing information.

Results and implications

The evaluation covered 480 public-record tasks. An agent that was shown the requirements alone reported an unjustified conclusion on 26.7% of the tasks. PRIME reported none. A refusal-only strategy produced an average score of 30.1 for justified conclusions, while PRIME’s guidance and additional checks raised the average to the reported maximum of 59.2 out of 100.

The significance of the work is architectural. Instead of asking the language model to be the final judge of its own reasoning, PRIME separates responsibilities. The model can search, read documents, and suggest the next action; a rule-based component determines whether the evidence actually licenses the proposed conclusion. That separation can make audit trails more explicit in security review, compliance approval, and enterprise workflows.

The approach is not a universal solution. Its reliability depends on maintaining complete evidence routes and accurately locating the required checks. Practical deployments will still need policies for conflicting records, changing sources, and prioritizing checks when the available budget is limited. Even so, PRIME offers a concrete pattern for making agent decisions more verifiable: precommit to what counts as evidence, record what was checked, and refuse conclusions that the record cannot support.

Source: arXiv