On October 23 I gave a talk at Knowledge Bases and Agents for CERN, a week-long workshop at CERN in Geneva. The slides are now online.
Agents that used to answer questions about infrastructure are now being used to operate it, including restarting services, resubmitting jobs, and changing configurations on their own. Until recently, a human read each suggested command before running it, and most mistakes were caught at that step. Once the agent runs commands itself, there is no such step, so a single wrong action can do damage that is hard to undo, and an agent caught in a retry loop will repeat it. Prompts and command allowlists only partly help because they restrict which commands an agent may issue. Whether a permitted command is correct in the current state is never checked.
The talk argues for mediation, where the agent decides what should be done but never does it itself. Instead, it proposes actions in a small typed language, with each action declaring its target, its effect, the resources it conflicts with, and what should happen if a step fails. A small trusted mediator holds the credentials and checks every proposal against the current system state and policy, either running the action or refusing it with a reason the agent can use to repair its plan. This means that an agent stuck in a loop can only keep proposing.
The talk draws on two of our papers. In Rebooting Microreboot (ARCS 2026), agents recover cloud services using seven typed actions, which are validated and executed by a Rust microkernel. In simulation, harm caused by the agent dropped from 77% of incidents with raw tool access to 24% with typed actions, and to 4% once a verifier agent was added. In our online experiments it went from 90% to zero. The cost is paid in recovery time: services that restart themselves quickly recovered about 2.3× more slowly. In Don't Trust the Code, Check Its Effects (PACMI 2026, with Jinhao Hu and Ashvin Goel), we apply the same idea to drivers produced by untrusted code generators and identify six conditions an interface has to satisfy before its effects can be mediated. The lesson for operations is to mediate at the level where intent is still visible, such as a restart request. Below that level, the mediator has to reconstruct intent from low-level writes, which is much harder.
There are still several open questions, and the talk ends with three of them: which operations can be described precisely enough to mediate, who writes and checks the specification, and where humans should step in. I have also included the backup slides that I prepared for the discussion.
Many thanks to the organizers for a week of really good discussions.
Cite
Laurent Bindschaedler. Agents Propose, Mediators Act: Safe Actions for Operations Agents. Talk, Knowledge Bases and Agents for CERN, Geneva, October 2026. https://binds.ch/blog/agents-propose-mediators-act-cern-2026
@misc{bindschaedler2026mediators,
author = {Bindschaedler, Laurent},
title = {Agents Propose, Mediators Act: Safe Actions for Operations Agents},
howpublished = {Talk, Knowledge Bases and Agents for CERN, Geneva},
month = oct,
year = {2026},
url = {https://binds.ch/blog/agents-propose-mediators-act-cern-2026}
}