[ai-control] Empirical data on agent compliance with in-band signals, and an adjacent Internet-Draft (Recuse)

[thamil vendhan <[e-mail]>]

Hi all,

I'm an independent researcher, new to this list. I've been working on
in-band, cooperative signaling to LLM agents over live operational
protocols (an SSH banner, a PostgreSQL NOTICE, a Kubernetes admission
warning, an HTTP header) — a server asking a connecting or already-running
automated agent to voluntarily withdraw. I'm sharing it here because it
shares AIPREF's design philosophy (in-band, machine-parseable, honor-based
signaling over existing protocols), and because I have empirical data that
may be useful to the group's framing.

Scope, up front, so there's no confusion: this is not
content-usage-preference work and is not within AIPREF's charter. AIPREF
and RFC 9309 govern how content is collected or used for AI. This work
governs a live operational session already in progress — an agent that has
authenticated to a server and is acting on it. I see the two as adjacent
and complementary, not overlapping.

Two things that might interest the group:

1. An empirical measurement of whether agents honor such signals. I ran a
controlled study (arXiv:2606.06460, five agents across three vendors). The
short version: at the "access door," compliance is real but strongly
model-dependent — recusal to a deny signal ranged from 55% to 100% across
the four frontier agents that received it; a fifth, open-weights agent
barely engaged the signal at all. A mid-task "halt" stopped 0 of 40 agents.
This may be relevant to the recurring question of how much weight a
voluntary preference signal can bear: in our data, a fair amount at first
contact (model-dependently), and little once the agent is committed to a
task. Happy to share methodology and data.
2. An adjacent Internet-Draft. I've written the signal up as an individual
Internet-Draft (draft-munirathinam-recuse-signal-00) — an individual
submission, not a WG document, which I intend to take through the
Independent Submission path rather than propose as AIPREF work. It cites
RFC 9309 and positions itself explicitly as complementary to AIPREF. I'd
genuinely welcome feedback on the framing, and on whether the empirical
angle is useful to the group.

I'm not looking to add scope to the WG — mainly to contribute data and
learn from the people defining this space. Happy to take any of this
off-list if that's more appropriate.

Thanks,
Thamilvendhan Munirathinam
[e-mail] · github.com/mthamil107/Recuse