Trustworthy Agentic AI Requires Deterministic Architectural Boundaries

Alignment training alone cannot ensure security in high-stakes AI applications. The paper argues that relying on learned behaviors through training is fundamentally insufficient for scientific workflows where errors could have serious consequences. Instead, deterministic architectural controls—similar to security mechanisms in traditional software systems—are necessary prerequisites.

The core problem is structural, not a training deficiency. Because autoregressive language models process all tokens uniformly, they cannot reliably separate commands from data through training alone. This means no amount of additional guardrails or alignment techniques can overcome this architectural limitation without fundamental redesign.

The "Lethal Trifecta" creates an impossible security challenge. When AI systems combine untrusted inputs, access to privileged data, and the ability to take external actions, security becomes an "exploit-discovery problem"—defenders must find every possible attack, while attackers only need to find one. This asymmetry makes training-based defenses inherently inadequate.

Deterministic mediation requires three specific architectural mechanisms. The proposed Trinity Defense Architecture uses: (1) finite action calculus with reference-monitor enforcement to control what actions are possible, (2) mandatory access labels to prevent data leakage across different scopes, and (3) privilege separation to isolate perception from execution—similar to proven security architectures in other domains.

Current agentic AI is not ready for consequential scientific deployment. The paper concludes that without unforgeable provenance tracking and deterministic architectural guarantees, deploying agentic AI in domains like drug discovery, clinical research, or infrastructure management poses unacceptable risks that cannot be mitigated through better training alone.