LLM agents treat missing safety evidence as permission, EpiSEM-Bench analysis warns

What the analysis claims

A technical write-up published on dev.to by Bohdan Hordii argues that modern LLM-based agents share a poorly examined safety flaw: they interpret a clean, error-free tool response as proof that an action is permissible. The post points to a benchmark it cites as EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence, listed on arXiv, which it says shows that leading foundation models fail passive safety alignment when they can only partially observe a situation — either inventing permissions that were never returned, or defaulting to execution unless something external constrains them.

A caveat up front: this account comes from a single blog post. The paper itself is not among the material available here, and the post describes the benchmark's results only qualitatively, without publishing scores or percentages.

The failure mode in practice

The post names the root assumption closed world semantics: if an API or CLI tool returns a successful payload with no error codes or warning banners, the agent concludes the operation is fine. The problem appears when a response omits safety-critical attributes — the post's examples include fields such as is_production, retention_lock, and regulatory_hold. Every token in the payload can be strictly true, yet the omission alone makes acting on it hazardous.

The worked example is an infrastructure orchestration agent asked to clean up orphaned volumes attached to worker nodes in a cluster. The list_volumes call returns volume IDs and disk sizes, but an upstream pagination bug or a deprecated schema strips out the protection_status attribute entirely. Seeing no explicit prohibition, the agent calls delete_volume on one of the IDs. That volume turns out to belong to a persistent state store under an active snapshot hold, and the result is a production outage.

The post contrasts this with classic zero-trust reasoning, under which absent evidence must count as absent permission. Agent loops, it argues, effectively invert the rule: missing evidence is read as a missing restriction.

Guardrails that demand evidence

Hordii's proposed remedy is to stop relying on the model's interpretation of a payload and enforce preconditions deterministically in code. The post sketches a Python design built on typed schemas: an EpistemicContext object in which safety-relevant facts — the environment, write-lock status, backup verification — start out unknown rather than assumed; an executability check that passes only when every critical invariant has been explicitly confirmed; and a safety gate that resolves any still-missing invariants by probing before a tool is invoked, raising a permission error and halting execution if the recovered facts don't line up.

The post pairs this with a two-phase architecture for agent systems: the planning agent may only submit execution plans to a separate guardrail service, and that service rejects any plan whose prerequisite facts lack deterministic proof.

The post's recommendations

Three engineering takeaways stand out:

• Do not trust silent tool outputs. If a payload does not explicitly serialize a resource's safety attributes, apply a strict fallback that flags it as unverified instead of reading silence as clearance.
• Decouple planning from execution. Route plans through a verification layer that demands proof of prerequisites before anything destructive runs.
• Rethink benchmarks. When evaluating models for autonomous DevOps or DevSecOps roles, test whether they ask targeted probing questions when context is missing, rather than measuring only passive refusal rates.

Why it matters

The scenario in the post requires no attacker and no ordinary model error. Pagination bugs, schema deprecations, and partial API responses are routine events in production systems, and agents are increasingly granted write access to those systems. If an agent treats an omitted protection flag as license to delete, the failure is quiet, fast, and expensive.

The deeper argument is about what the safety ecosystem actually measures. Refusal benchmarks test how models respond to evidence in front of them; this gap concerns judgment about evidence that isn't there. The post's position is that the dependable fix lives outside the model — in cheap, deterministic checks that force evidence to be recovered before execution. Readers should weigh the quantified claims with care until the underlying benchmark results are independently verifiable.