Credit AI Agent Can Only Change Its Harness: Gate Admitted 144 of 7,449 Edits

A self-learning LLM agent in a credit pipeline can adapt to a new interpretation of the rules. But if it rewrites itself, the supervisor loses what it is supposed to verify: a named change, a recorded test, a signed approval. The authors of a new arXiv paper propose a hard constraint. Only the agent's harness may evolve, while the model weights stay frozen. In a simulation of 7449 candidate edits, the admission gate let through 144, and none worsened error on held-out history. A control version with the kind of check an unconstrained system uses let through 309 harmful changes.

What exactly is allowed to change

The paper defines the harness as three layers: the instruction text, the tool-calling logic, and the composition of primitives. Everything else is untouchable. The point is that any adaptation becomes a diff with a reason and an attached test. A reviewer does not need to analyze model behavior; they read a specific edit.

A two-loop engine is built on this constraint. All candidates pass through a single admission gate, which writes a hash-chained record before deployment. The record cannot be altered retroactively while keeping the chain intact. For an auditor, this is a ready-made trail: what changed, why, and which test it passed.

What the simulation showed

The main caveat: the gate was measured on a simulated agent, and the edits were proposed not by a language model but by a fixed-seed search. This tests the admission mechanism, not the behavior of live LLMs. The experimental design: three families of supervisory rule reinterpretation, three severity levels, 10 runs per cell, or 90 runs per configuration.

• The gate admitted 144 of 7449 candidate changes.
• None of the admitted edits worsened error on held-out history.
• In every cell with low and medium severity, the false-positive rate returned to the oracle level without an increase in missed flags.
• When the gate was replaced with a standard check ("fewer errors on fresh traces"), 309 harmful changes were admitted.
• In that mode, missed flags exceeded 10% in 49 of 90 runs.

The last point shows the failure mechanism. False positives in such a system did not fall because the agent became more accurate. It simply loosened the filter, and errors on fresh traces dropped at the cost of missed problem cases.

There is also a non-obvious result. When candidates were scored against pre-shift labels, the gate rejected all of them. A new interpretation of the rules has to be encoded as a rule that relabels the history. Otherwise the check compares the agent against outdated ground truth and blocks correct edits.

Where the gate hits a ceiling

The agent fixed parametric shifts and scope shifts locally. A structural shift could be fixed only by replacing a primitive. At the highest level of structural severity, the gate's fixed tolerance blocked the correct replacement in half of the runs. The conservatism that protects against harmful edits costs useful ones here. The tolerance will apparently have to be tuned separately for structural changes.

The authors also map the mechanisms to EU AI Act requirements for high-risk credit scoring. Separately, they note that the US model risk management guidance of April 2026 excludes agentic AI from its scope. The regulatory framework for such systems in the US remains empty, and auditability has to be built in-house.

How to apply this in practice

A team deploying agents in scoring or compliance should fix the boundary of what can change in advance: instructions, tools, and composition of primitives live in the repository, and the weights are outside the editable zone. Every change should have a reason, a test, and an entry in an immutable log before rollout. The admission criterion should be computed on history relabeled under the new rule, and missed flags should be tracked separately, not just false positives. The tolerance for replacing primitives needs separate calibration, and the team should agree beforehand on who decides when the gate blocks a correct edit. The results come from a simulation, so a run with real LLM proposals is needed before production.