MUSTER: Building Safer Enterprise AI Agents That Ask Less and Retry Less
AI agents are getting good enough to do real work inside companies. They can read documents, understand images, call tools, make decisions, and trigger actions. But once an agent is allowed to do something important, two problems become dangerous very quickly: How much private data should the agent be allowed to see? What happens if an action succeeds, but the agent loses the response and does…
Enterprise AI agents can now perform real work inside companies, handling tasks like reading documents, understanding images, calling tools, making decisions, and triggering actions. However, two problems arise when an agent is allowed to act on important matters. First, it is crucial to limit the amount of private data the agent is permitted to view.
Second, if an action is successful but the agent loses the response, it cannot determine if the action occurred. To address these issues, the author built a system called MUSTER.
MUSTER operates on the principle of asking for only the evidence necessary to change the outcome before taking action. After the action is completed, if the result is uncertain, MUSTER checks what happened before attempting again. This is demonstrated using an example where an employee named Ravi reports an incorrect Saturday pay.
The payroll system and site system hold different pieces of information. Instead of giving a central agent access to all these systems, each source keeps control of its own evidence. The payroll agent works with payroll data, and the site agent works with site-access evidence. The central MUSTER Control Plane does not have blanket access to raw source data.
Google Cloud enforces this boundary using IAM, allowing the Site Agent to read its protected Cloud Storage evidence, while the central Control Plane identity receives an actual access denial. The Site Agent sends the needed evidence content to Gemini for interpretation. After that, only validated and signed narrow facts are returned to MUSTER. MUSTER interprets the evidence but does not have authority to make decisions. The source attests to the facts, and deterministic MUSTER authorizes the actions.
One key aspect of MUSTER is minimizing data collection when uncertainty exists. For example, if Ravi's on-site duration is at least 508 minutes, MUSTER does not need to collect the exact duration, as any remaining uncertainty will not change the action. This results in the corrected weekly payroll instruction: PAY RAVI INR 5,100.00.
MUSTER is not claiming it independently proved Ravi worked; rather, it is stating that under the pinned policy and authorized facts, the consequence remains the same across remaining possibilities.
The second problem MUSTER addresses is what to do when an irreversible action is executed, but the response is lost. Instead of retrying, MUSTER records the situation as uncertain and checks the external state to reconcile the execution. This approach avoids creating problems by retrying an action that has already succeeded. MUSTER separates interpretation done by models like Gemini and Gemma from final authorization, ensuring that the LLMs do not make the final decision.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
