一句话：TraceCaps 将密码学溯源胶囊与单调累积风险分结合，在智能体每一步内联地允许、警告或阻断工具调用。
LLM 智能体已深度嵌入软件工程流程（规划、编码、测试、CI/CD），但其失败频发，包括提示注入、不安全工具调用、供应链污染与记忆投毒。现有防御（静态分析器、溯源存证、提示护栏）多在事后审计，缺乏密码学保证与运行时强制。本文提出 TraceCaps：为每一步智能体动作（提示、记忆、工具调用）附加可密码学验证的溯源胶囊，胶囊对事件做哈希与签名、链接父节点并嵌入风险特征；同时计算单调持久化的风险分，通过策略阈值在运行中内联地对工具动作执行放行、警告或阻断，并借助累加器防止后续良性步骤进行“风险洗白”。在 SWE-bench 上的早期演示表明，TraceCaps 能暴露不安全行为并通过风险累积实施运行时治理，指向可执行的智能体安全。作者称这是首个将溯源与风险绑定于单一密码学底座的方法，标志着从被动审计转向运行时强制安全。
Large Language Model (LLM) agents are increasingly embedded in software engineering (SE) workflows—planning, coding, testing, and CI/CD. Failures are frequent: prompt injection, unsafe tool use, supply-chain contamination, and memory poisoning. Existing defences —such as static analysers, provenance attestation, and prompt guardrails—are insufficient: they typically audit after-the-fact or operate without cryptographic guarantees or runtime enforcement. We propose TraceCaps, a runtime approach that (i) attaches cryptographically verifiable provenance capsules to each agent step (e.g. prompt, memory, tool call), and (ii) computes a monotone, persistent risk score that gates tool actions inline via policy thresholds (allow, warn, block). Capsules hash and sign events, link to parents, and embed risk features; an accumulator prevents “risk laundering” by subsequent benign steps. Early demonstrations on SWE-bench illustrate how TraceCaps can expose unsafe behaviors and apply runtime governance through risk accumulation, pointing toward enforceable agent safety. To our knowledge, TraceCaps is the first approach to bind provenance and risk into a single cryptographic substrate, pointing toward a shift from passive audit to runtime, enforceable safety in agentic SE workflows.
@inproceedings{CatarinoMMA26,
title = {TraceCaps: Inline Provenance and Risk Enforcement for Agentic Software Engineering},
author = {Andre Catarino and Claudia Mamede and Rui Melo and Rui Abreu},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3786582.3786832}
}