{
  "id": 4652059,
  "title": "MUSTER: Building Safer Enterprise AI Agents That Ask Less and Retry Less",
  "url": "https://urgent.news/2026/08/31/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-31T14:06:47.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/satish_9177/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less-2m0f"
  },
  "original_language": "en",
  "account": "Enterprise AI agents can now perform real work inside companies, handling tasks like reading documents, understanding images, calling tools, making decisions, and triggering actions. However, two problems arise when an agent is allowed to act on important matters. First, it is crucial to limit the amount of private data the agent is permitted to view. Second, if an action is successful but the agent loses the response, it cannot determine if the action occurred. To address these issues, the author built a system called MUSTER.\n\nMUSTER operates on the principle of asking for only the evidence necessary to change the outcome before taking action. After the action is completed, if the result is uncertain, MUSTER checks what happened before attempting again. This is demonstrated using an example where an employee named Ravi reports an incorrect Saturday pay. The payroll system and site system hold different pieces of information. Instead of giving a central agent access to all these systems, each source keeps control of its own evidence. The payroll agent works with payroll data, and the site agent works with site-access evidence. The central MUSTER Control Plane does not have blanket access to raw source data.\n\nGoogle Cloud enforces this boundary using IAM, allowing the Site Agent to read its protected Cloud Storage evidence, while the central Control Plane identity receives an actual access denial. The Site Agent sends the needed evidence content to Gemini for interpretation. After that, only validated and signed narrow facts are returned to MUSTER. MUSTER interprets the evidence but does not have authority to make decisions. The source attests to the facts, and deterministic MUSTER authorizes the actions.\n\nOne key aspect of MUSTER is minimizing data collection when uncertainty exists. For example, if Ravi's on-site duration is at least 508 minutes, MUSTER does not need to collect the exact duration, as any remaining uncertainty will not change the action. This results in the corrected weekly payroll instruction: PAY RAVI INR 5,100.00. MUSTER is not claiming it independently proved Ravi worked; rather, it is stating that under the pinned policy and authorized facts, the consequence remains the same across remaining possibilities.\n\nThe second problem MUSTER addresses is what to do when an irreversible action is executed, but the response is lost. Instead of retrying, MUSTER records the situation as uncertain and checks the external state to reconcile the execution. This approach avoids creating problems by retrying an action that has already succeeded. MUSTER separates interpretation done by models like Gemini and Gemma from final authorization, ensuring that the LLMs do not make the final decision.",
  "summary": "AI agents are getting good enough to do real work inside companies. They can read documents, understand images, call tools, make decisions, and trigger actions. But once an agent is allowed to do something important, two problems become dangerous very quickly: How much private data should the agent be allowed to see? What happens if an action succeeds, but the agent loses the response and does…",
  "key_points": [
    "MUSTER system limits agent's data access and verifies action outcomes",
    "Each data source controls its evidence, central system has no blanket access",
    "MUSTER minimizes data collection when uncertainty exists, avoiding unnecessary data gathering"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}