Structured Authority Injection Wants Human Overrides to Stick in LLM Agents

TL;DR

• A new arXiv paper proposes Structured Authority Injection (SAI), which routes human corrections to LLM agents through typed, schema-validated MCP tool calls instead of free-text prompts.
• SAI defines three override classes (Constraint, Priority, Strategy) and needs no fine-tuning or access to model weights.
• The authors tested nine LLMs across eight failure-mode scenarios and report up to 38% lower prompt overhead in the strongest models.
• The catch: the authors say the benefit varies substantially across models.

A Protocol For Orders That Don’t Fade

Tell an agent to stop doing something, and it might listen. For a while. The paper behind Structured Authority Injection starts from that uncomfortable gap.

The authors argue that LLM-based agents are increasingly used as autonomous orchestrators in distributed and multi-agent systems, yet “no protocol-level mechanism allows human operators to inject binding directives that persist across planning cycles.” Their fix is a protocol, not a retrained model.

Here’s how it works. An operator’s correction goes out as a typed, schema-validated Model Context Protocol (MCP) tool call. SAI also maintains a ranked authority context that gets prepended to each LLM prompt. The overrides travel through a directed authority channel that the planning process can’t access.

There are three override classes: Constraint, Priority and Strategy. The evaluation covered nine LLMs and eight scenarios built around agent failure modes. In the strongest models, the authors report prompt overhead lower by up to 38%.

Sticky Notes Versus Deadbolts

Picture a fridge door. Free-text overrides are sticky notes on it. They work on day one, then the takeaway menus pile up, a magnet slips, and nobody can say which note was the important one. SAI is closer to a deadbolt fitted to the door frame: it doesn’t compete with the clutter, because it sits in a different place.

That’s the real idea here. The paper says free-text overrides suffer from ambiguous interpretation, since nothing validates them against a schema, and from authority erosion, as operator instructions lose influence within accumulating context. Both problems come from treating a human command as just more text in the pile. SAI stops doing that.

Is that the right call? I think so, at least in direction. A typed call either validates or it doesn’t, and a ranked authority context gives the model a clear signal about whose words outrank whose. Asking nicely in a prompt has never been a control mechanism. It’s a hope.

The competitive framing matters too. Unlike approaches that need model weight fine-tuning or custom architectures, SAI works purely at the protocol level on instruction-tuned LLMs that support MCP. For a team running someone else’s model through an API, that’s a far lower barrier. You can’t retrain what you don’t own.

But I’d read the 38% number with care. It’s tied to the strongest models, and the authors themselves say the performance benefit of SAI varies substantially across models. The source material doesn’t spell out what the weaker models showed, so a reader shouldn’t assume a uniform win. A protocol that helps your best model and does little for the one you actually deploy is a research result, not a safety guarantee.

Still, I’d rather see this problem attacked at the protocol layer than patched with another paragraph of capital letters in a system prompt.

Why Free-Text Overrides Wear Thin

Current LLM agents rely on free-text human overrides. The paper’s background is blunt about the result: prompt ambiguity, and context dilution across multi-step execution. A correction typed at step two has to compete with everything the agent reads and generates by step twenty.

That matters more as agents take on longer jobs. The authors frame the target as long-horizon, multi-agent workflows, where an agent orchestrates other agents and a human may only step in occasionally. If the intervention fades, the human is effectively out of the loop without anyone deciding that.

The three override classes map to different kinds of intervention. A Constraint, a Priority and a Strategy are separate categories, so the system doesn’t have to guess what sort of instruction it’s holding. The source doesn’t detail how each class behaves in testing, so it’s best not to over-read them.

What the paper does establish is the design. Typed directives, schema validation, an authority channel the planner can’t touch, and a ranked context attached to each prompt. No weights, no fine-tuning. Whether that design holds up outside the authors’ eight scenarios is a separate question, and the preprint alone can’t answer it.

Three Things Worth Tracking

First, the spread across models. The authors flag that SAI’s benefit varies substantially, so the useful follow-up is a breakdown of which models gain, which don’t, and why. Without that, “up to 38%” is a ceiling, not an expectation.

Second, independent replication. Nine LLMs and eight scenarios is a reasonable start for a preprint. Do the results hold on other failure modes, or in messier real deployments? Outside testers will tell us more than the original authors can.

Third, whether anything adopts it. SAI depends on MCP support and instruction-tuned models, so the practical test is whether agent builders wire typed overrides into their tooling. If they do, the next argument will be about who gets to issue Constraint, Priority and Strategy directives, and that’s a governance fight, not a technical one.