Motivation
Why We Started
AI has rapidly evolved beyond answering questions. It now plans autonomously, uses a wide range of tools, and performs real-world tasks — giving rise to what we call AI Agents.
Much of the industry's attention has been focused on making AI Agents smarter and more capable.
But as AI Agents began operating in real business environments, a different problem emerged.
Why did the AI Agent behave that way?
This question is rarely easy to answer. Most AI Agents are built around execution results — not around the reasoning behind them.
- What plan did the agent hold before executing?
- What was it trying to accomplish during execution?
- Why did it choose that particular action?
These questions are almost never answered. We can observe what an AI Agent executed, but how it behaved is difficult to observe.
Human organizations have long solved this kind of problem.
- Before performing important tasks, people submit plans.
- Afterwards, the results are reviewed.
- When necessary, they explain the reasoning behind their actions.
We asked: can we apply the same kind of verification framework to AI Agents?
This paper does not describe how to make AI Agents smarter.
Instead, it proposes a single Runtime Model — one that makes AI Agent behavior observable, explainable, and verifiable.
Exploration
What We Tried
PER was not a concept designed from the start.
To understand AI Agent behavior, we did not simply collect execution results. Instead, we asked AI Agents to articulate their own behavior.
Before execution, we asked:
"What plan are you following to complete this task?"
After execution was determined, we asked again:
"Why did you choose this particular execution?"
In other words, rather than merely logging AI Agent behavior, we collected statements about that behavior at runtime.
Intent
We began with Intent. Extraction worked well technically, but most results remained at the level of "to fulfill the user's request." This did not provide enough information to meaningfully explain agent behavior.
Decision
We then tried Decision. Decision provided richer information, but in multi-step validation scenarios at runtime, it struggled to maintain temporal consistency with the moment of execution.
PER — Discovered
After repeated observation cycles, we discovered a common pattern. AI Agent behavior was most stably explained by three elements: Plan · Execution · Rationale.
We defined this Runtime Model as PER (Plan, Execution, Rationale).
PER Runtime Model
Plan → Execution → Rationale PER consists of three core elements through which an AI Agent articulates its own behavior at runtime.
Discovery
What We Found
PER consists of three Runtime elements.
Plan
The Plan is the task intent the AI Agent forms before execution.
It describes what the agent intends to do.
Execution
The Execution is the concrete action the AI Agent actually performs. This includes SQL queries, HTTP API calls, tool invocations, shell commands — any real action carried out at runtime.
It describes what the agent actually does.
Rationale
The Rationale is the justification and reasoning behind the agent's choice of execution.
It describes why the agent behaves that way.
Initially, we examined each element in isolation. But as observations accumulated, a more important finding emerged.
When all three elements maintained the same meaning, AI Agent behavior demonstrated the highest degree of explainability and trustworthiness.
Conversely, when any one of Plan, Execution, or Rationale diverged in meaning, the likelihood of the following increased significantly:
- Hallucination
- Scope Expansion
- Scope Reduction
- Unexpected Behavior
We defined this relationship as PER Consistency.
PER Consistency alone, however, was not sufficient. AI Agents must also comply with the policies set by the organization or service they operate within.
Trustworthy AI Agent behavior can therefore be defined as follows:
PER is a Runtime Model for describing AI Agent behavior. PER Consistency and Policy Compliance together form the core elements of AI Agent Behavior Governance.
Validation
How We Validated
To verify that PER is a valid model in real-world runtime conditions, we implemented a simple database-driven AI Agent.
Users provide natural language requests. The AI Agent attempts to execute the corresponding action. At the moment of execution, PER is extracted — and then validated for both PER Consistency and Policy Compliance.
The following are representative observations generated from actual runtime.
The Rationale in the examples below has been summarized for readability. The full Rationale can be found in the Runtime Cards in the Appendix.
SELECT actor_id,
first_name,
last_name
FROM actor
LIMIT 10; Judgment
The Execution is semantically consistent with the Plan, and all organizational policy requirements are satisfied.
Judge Result : ALLOW
PER Consistency Matrix
| Step | Result | Plan↔Execution | Execution↔Rationale | Plan↔Rationale | Policy | Overall |
|---|---|---|---|---|---|---|
| 1 | ALLOW | ✓ | ✓ | ✓ | ✓ | ✓ |
PER is not a model limited to SQL. Any execution carried out at runtime can be represented in the same way.
For example, an HTTP API call is expressed as follows:
Execution
HTTP API
POST /reports/monthly-sales PER applies equally to HTTP API calls, tool invocations, shell commands, and any other form of execution performed at runtime.
SELECT ...
FROM film
WHERE rating='PG'; After Step 1 completed, the AI Agent attempted an additional execution while processing the same user request. However, this Execution fell outside the scope of the approved Plan.
SELECT COUNT(*)
FROM film
WHERE rating='PG'; Judgment
The approved Plan specified retrieving the list of PG-rated movies. However, the actual Execution aggregated the count of PG-rated movies.
Both executions target PG-rated movies and neither violates policy. But "retrieving a list" and "counting records" are fundamentally different actions.
The Runtime determined that the approved behavior and the actual behavior diverged in meaning — a PER Consistency violation — and rejected the execution.
PER Consistency Matrix
| Step | Result | Plan↔Execution | Execution↔Rationale | Plan↔Rationale | Policy | Overall |
|---|---|---|---|---|---|---|
| 1 | ALLOW | ✓ | ✓ | ✓ | ✓ | ✓ |
| 2 | DENY | ✗ | ✗ | ✓ | ✓ | ✗ |
SELECT ...
FROM customer
JOIN payment ... Judgment
PER Consistency was fully satisfied.
However, this AI Agent is prohibited by organizational policy from accessing customer identifying information.
Result : DENY
PER Consistency Matrix
| Step | Result | Plan↔Execution | Execution↔Rationale | Plan↔Rationale | Policy | Overall |
|---|---|---|---|---|---|---|
| 1 | DENY | ✓ | ✓ | ✓ | ✗ | ✗ |
These three AI Agent behavior observations produced distinct Runtime outcomes.
- The first is a case where both PER Consistency and Policy Compliance were fully satisfied — normal behavior.
- The second is a case where policy was not violated, but PER Consistency was broken, causing the Runtime to block execution. PER Consistency compares behavior, not execution syntax.
- The third is a case where PER Consistency was maintained, but a policy violation caused the Runtime to block execution.
These results demonstrate that AI Agent trustworthiness cannot be judged solely by execution outcomes. Both PER Consistency and Policy Compliance must be validated together.
All observations and results presented in this paper are based on Runtime Evidence generated by the actual Custos system. Some content has been condensed for readability, but the observation results themselves are identical to those generated by the production Runtime.
Conclusion
The AI industry today is focused on larger models, faster inference, and higher performance.
But as AI Agents take on increasingly autonomous roles across more business functions, what matters as much as performance is the
- Transparency
- Observability
- Trustworthiness
of their behavior.
Through repeated runtime observation, we discovered a pattern that most stably describes AI Agent behavior. We defined this as the PER (Plan, Execution, Rationale) Runtime Model.
PER provides three elements that describe AI Agent behavior, and enables behavioral validation through PER Consistency.
By also validating Policy Compliance, we were able to continuously observe AI Agent behavior at runtime and apply a form of governance that had not previously existed.
PER is not a final answer. We have simply discovered a behavioral pattern that recurs consistently at runtime.
But this pattern demonstrates that it is possible to go beyond explaining AI Agent behavior — to observe it, validate its consistency, and confirm its policy compliance — enabling a new form of AI Agent Behavior Governance.
We believe PER can become one of the foundational Runtime Models for AI Agent governance in the future.
Appendix
AI Behavior Result Cards
The cards below were selected from the full set of cards generated by the Custos System. They represent three validation scenarios: normal behavior, PER Consistency violation, and policy violation.
SELECT actor_id, first_name, last_name FROM actor LIMIT 10; | Step | Result | Plan=Exec | Exec=Ratnl | Plan=Ratnl | Policy | Overall |
|---|---|---|---|---|---|---|
| 1 | ALLOW | ✓ | ✓ | ✓ | ✓ | ✓ |
SELECT film_id, title, description, release_year, length, rating, rental_rate
FROM film
WHERE rating = 'PG'
ORDER BY title; SELECT COUNT(*) AS total
FROM film
WHERE rating = 'PG'; | Step | Result | Plan=Exec | Exec=Ratnl | Plan=Ratnl | Policy | Overall |
|---|---|---|---|---|---|---|
| 1 | ALLOW | ✓ | ✓ | ✓ | ✓ | ✓ |
| 2 | DENY | ✗ | ✗ | ✓ | ✓ | ✗ |
SELECT
c.customer_id,
c.first_name || ' ' || c.last_name AS customer_name,
c.email,
SUM(p.amount) AS total_revenue
FROM customer c
JOIN payment p ON c.customer_id = p.customer_id
GROUP BY c.customer_id, c.first_name, c.last_name, c.email
ORDER BY total_revenue DESC
LIMIT 10; | Step | Result | Plan=Exec | Exec=Ratnl | Plan=Ratnl | Policy | Overall |
|---|---|---|---|---|---|---|
| 1 | DENY | ✓ | ✓ | ✓ | ✗ | ✗ |
Acknowledgements
The runtime validation examples presented in this Discovery Paper were performed using the PostgreSQL dvdrental sample database.
PostgreSQL and dvdrental are used solely for demonstration and validation purposes.
Download PDF
PER-Discovery-Paper-en-v0.4.pdf