When an agent is about to change something, the standard defence is a second model that checks the proposal first — which only works if the two can be wrong independently. Usually they cannot, because the checker reads the same cached view the actor read. Across 849 unsafe proposals, a cross-model vote over shared evidence approved 62.9% of them; the same vote reading an independently replicated snapshot approved 22.9%. Changing the evidence source is worth about 41 points; changing the model, about 11. Then the same gates were pointed at a live service with a concurrent writer, where every check-then-act policy committed the same unsafe effects — and only re-checking the condition inside the write transaction reached zero.
The setup is one an agent platform will recognise. An actor proposes a state-changing action after reading some view of the world. A gate decides whether to execute it, defer it to a person, or refuse. The interesting question is what the gate gets to read.
The paper separates four things a gate can consult, and the separation is the whole paper. Two of them look independent and are not.
A second interface is not a second opinion when it is backed by the same replica, the same cache, the same extraction job or the same memory record. A stale upstream then makes different models agree on the same wrong state — which the paper calls a common-mode data failure, and which no amount of voting touches. Take a migration tool as the worked case: if an approval is revoked while both interfaces still hold the old value, two models can approve from identical stale bytes and a precondition check passes on the same stale bytes. Only a fresh read of an independently replicated source exposes the revocation.
So the experiment is a clean two-by-two on frozen proposals: change the verifier's model, change its evidence source, or both. Every cell is a two-call unanimous vote, so the number of calls is held fixed and only the diversity changes. Flip the switches.
Pooled over 849 unsafe proposals the four cells come out at 74.2%, 62.9%, 33.3% and 22.9%. Stated as paired per-scenario effects, changing the evidence source is worth −0.409 with a confidence interval from −0.479 to −0.331, and changing the model −0.113 from −0.215 to −0.038. Both help. One helps roughly four times as much, and it is not the one most teams reach for.
Six fault regimes were injected, and they do not behave alike. Reading across them is what turns the headline into a design rule rather than a slogan.
Where only the actor's own view is stale, everything works — even the worst cell sits at 16.3%, because the second interface is current. Where the two interfaces share a stale upstream, the shared-evidence cells collapse to 91.5% and 81.7% while the independent ones sit at 9.8% and 7.3%: that regime is the mechanism in its purest form. But when everything is stale and the guard is mostly unavailable, an independent source is no longer independent evidence of anything, and even the best cell approves 41.4%. Independence only buys you something when the independent thing is actually fresh.
There is one more result in this direction worth carrying. Given the same unsafe proposals and one bounded chance to replan, handing the actor a better view fixed some of it and nowhere near enough: 92.2% remained unsafe when replanning off the same lineage, 69.8% off the independent source, and the actor chose to abstain only 30.2% of the time. Better evidence for the actor is not a substitute for a gate.
Independent reads cost more than same-source reads, guards cost more than either, and a human costs most of all — the paper prices them at 1, 3, 2 and 10. So the real question is not which check is best but which check to buy for this action, and the controller picks from a library of small plans using only metadata a deployment can actually see: source identities and lineage, ages, noisy health flags, schema completeness, whether a guard is available, blast radius, reversibility and the last tool status. It never sees the true state or the fault regime. Pick a metric and compare the fixed policies against it.
Matched on budget, the controller beats the fixed policy it is matched to: at the cost of a cross-model vote it takes unsafe commits from 27.8% to 12.7% and raises safe automated coverage from 40.6% to 51.7%, and at the cost of an independent read it goes from 16.5% to 5.7%. Those are the paper's primary preregistered comparisons and both clear correction for multiple testing.
The part not to skip is what happens when you ask for a tighter risk target. At a nominal 5% the calibrated controller lands at 1.9% unsafe with 38.2% coverage and defers 31.4% of the time. Ask for 2%, or 1%, and no policy in the library passes the test — so the controller defers 99.9% of everything and coverage goes to zero. There is no smooth dial here.
The last arm drops the simulation. Twelve business contracts across three operation families — a schema migration, a snapshot promotion, a failed-job restart — run against a real local service over a real database, with a separate writer process competing, six injected conditions per contract, 216 episodes in total. Every effect is actually executed.
One condition breaks everything a prompt can do. Step through it.
In all 36 episodes of that condition, under every policy, the competing writer committed before the action. Every verifier-only policy then commits the same twelve unsafe effects, because no amount of checking beforehand says anything about the instant of the write. A precondition check helps only if it is in the same transaction as the effect: run as a separate preflight it still commits 16 unsafe effects, and the identical clauses re-checked inside the write transaction commit 9 — with the remaining nine being precisely the revoked approvals the partial guard does not express. Express the whole predicate inside the transaction and it reaches zero.
Read the two columns together and the ranking inverts the intuition. The independent-read vote is the best of the language-model gates at 5.6% unsafe — but it finishes only 40.7% of the work, because a cautious verifier rejects a great deal that was fine. The full atomic guard records no unsafe effects at all and completes 81.0%, the same as plain unchecked commits, in milliseconds rather than seconds. When the safety condition is expressible as code against the database, that is simply the better mechanism, and the model-based gate is what you fall back to when it is not.
One smaller result belongs next to it. When the service committed and then dropped the response, retries with the same request identifier replayed the stored answer for all 96 retried requests with no duplicate effect; without that, retried snapshot promotions duplicated audit rows and pointer switches in four cases. Idempotency keys are not a verification technique, and they closed a failure mode no verifier addressed.
Set how many state-changing actions your agent proposes in a day, pick the gate you have today, and read off how many unsafe writes land, how much work completes without a person, and what the verification costs in the paper's own units.
The move this argues for is not a bigger verifier. It is to give whatever checker you already run its own read path rather than a different model, and then to push the final condition out of the prompt and into the write itself — a transactional precondition where the predicate is expressible, an idempotency key on every retryable effect, and the language-model gate reserved for the conditions that genuinely are not code.