Overview
MI9 offers a clear, deployable governance design with strong synthetic results, but production readiness depends on full ATS instrumentation, performance tuning, and adversarial hardening.
Citations0
Evidence Strength0.70
Confidence0.80
Risk Signals11
Trust Signals
Findings with numeric evidence: 4/4
Findings with evidence refs: 4/4
Results with explicit delta: 6/6
Reproducibility
Status: Code + data available
Open source: Partial
At A Glance
Cost impact: 60%
Production readiness: 60%
Novelty: 55%
Why It Matters For Business
MI9 turns opaque agent decisions into actionable runtime controls, reducing undetected risky behaviors while keeping false alarms low, which helps prevent costly operational and compliance incidents.
Who Should Care
Summary TLDR
MI9 is a vendor-neutral runtime governance layer for agentic AI. It defines six coordinated components—an Agency-Risk Index (ARI), an agent-semantic telemetry schema (ATS), continuous authorization monitoring (CAM), an FSM-based conformance engine, goal-conditioned drift detection, and a four-level graduated containment system—to observe, score, and intervene in live agent behaviors. Evaluated on 1,033 synthetic multi-domain scenarios, MI9 reports a 99.81% detection rate and very low false positives, but results are synthetic and depend on full instrumentation of agent internals. The authors open-source prompts and scripts for their evaluation.
Problem Statement
Agentic AI (models that plan, revise goals, use tools, and spawn subagents) can develop risky behaviors only visible during execution. Pre-deployment controls and infra-level monitoring miss cognitive events like goal changes, tool-chaining, and delegation. Organizations need a runtime layer that observes agent semantics and can intervene without breaking ongoing operations.
Main Contribution
A unified runtime governance framework (MI9) integrating telemetry, authorization, conformance, drift detection, and containment.
Agency-Risk Index (ARI) to tier agents by autonomy, adaptability, and continuity.
Key Findings
MI9 detects nearly all simulated governance violations on evaluated traces.
MI9 achieves very low false alarms while keeping high detection.
Results
| Metric | Value | Baseline | Delta | Split / Dataset | Evidence | Evidence Ref |
|---|---|---|---|---|---|---|
| Detection Rate | 99.81% | OT 93.98%; LS 68.52% | +5.83% vs OT; +31.29% vs LS | 1,033 synthetic scenarios | Table 4; Sec. 5.1 | Table 4 |
| False Positive Rate | 0.0121% | OT 0.0242% | -0.0121pp vs OT | 1,033 synthetic scenarios | Table 4; Sec. 5.1 | Table 4 |
What To Try In 7 Days
Instrument one agent to emit ATS events (cognitive, action, coordination).
Compute ARI for that agent class and set a governance tier.
Write 2–3 FSM rules for high-risk sequences (e.g., approval before execution) and test on replayed traces.
Agent Features
Memory
Planning
Tool Use
Frameworks
Is Agentic
Yes
Architectures
Collaboration
Reproducibility
Risks & Boundaries
Limitations
Evaluation uses synthetic LLM-generated traces, not live production logs.
Effectiveness requires rich agent instrumentation; opaque APIs create blind spots.
When Not To Use
You cannot instrument agent internals to emit ATS events.
Ultra-low-latency systems where any runtime intervention would break correctness.
Failure Modes
False negatives when causally related events reorder beyond buffering windows.
Blind spots for agents implemented via opaque third-party APIs.