An Arbitration Coprocessor Against Spatial Risk Transfer in Autonomous Agents

Background. Runtime safeguards for autonomous agents usually score each proposed action with a single risk value, and they usually read the same input stream as the agent they supervise. Two classes of failure follow. An agent can keep every affected party above its individual safety floor while concentrating the loss on the parties furthest from it, and an agent can reach a forbidden state through a sequence of steps that are each acceptable on their own. Neither pattern is visible to a supervisor that checks one scalar per action. Methods. We describe and evaluate a deterministic arbitration coprocessor placed in series on the actuation bus of an autonomous agent. The coprocessor never reads the agent’s raw input: it receives only schema-validated commands and measured telemetry through a one-way bus. For every candidate command it computes a bounded state tensor T in [0, 1]^(M x 4) whose rows are the affected nodes, ordered by topological distance, and whose columns are four closed-form quantities: integrity by interval arithmetic, topological autonomy with a cumulative drift filter, retained Shannon surprise, and causal voice against the physical deliberation latency of each node. Four parallel circuits act on this tensor and on two further command fields: an absolute floor comparator, a regression-slope detector of spatial risk transfer, a Kullback-Leibler divergence check against a reference held in read-only memory, and an infinity-norm bound on the coupling matrix. We derive closed-form decision boundaries for the floor and slope circuits over a one-parameter family of resource depletions, and closed-form blocking and evasion conditions for the drift filter. We then test every analytical prediction in a reproducible simulation with N = 2000 commands per cell, and evaluate the floor and slope circuits on two low-voltage distribution networks from the SimBench benchmark (96 and 110 buses), with AC power flow over a year of load and generation time series, calibrating on the first half of the year and reporting on the second. Results. Over a single continuous family of depletions indexed by depth D and asymmetry alpha, the floor circuit and the slope circuit cover disjoint regions of the plane, and their boundaries coincide with the closed-form predictions. At alpha = 1 there is a band, 17.3 < D <= 55.9, in which every node stays above its floor while risk grows with distance; a floor-only supervisor detects none of these commands and the slope circuit detects 99.65 % to 100 % of them. Under symmetric depletion the slope is exactly zero and only the floor circuit acts. On a heavy-tailed benign workload the calibrated arbiter blocks 2.85 % of legitimate commands while detecting 99.05 % of stealthy spatial transfers and 100 % of symmetric collapses; on five held-out seeds the false positive rate is 3.07 % (95 % CI 2.75 % to 3.43 %). Removing any one circuit drops detection of its own threat class to 0 % without changing the others. We prove that a drift filter built on the mean of normalized displacement vectors cannot accumulate collinear pushes, and that a filter built on net weighted displacement blocks a sequence of pushes of size 0.20 at the fourth cycle, as predicted. On the distribution networks the blind band persists: floors fire on at most 1.90 % of dispatches that concentrate flexible demand at the far end of the feeders. Measured against a reference allocation held in read-only memory, the excess slope detects 76.8 % and 90.5 % of far-first dispatches per command, and over a window of 20 to 40 decisions it detects more than 99.8 % of mildly biased dispatch, with a held-out false positive rate between 2.7 % and 3.1 %. Conclusions. Measuring the effect of an action on each affected party separately, and testing how that effect varies with distance, exposes a class of transfers that per-party floors cannot see. The analysis also delimits what the drift filter can and cannot detect: steps smaller than a computable size, or spaced further apart than a computable interval, escape it, so the filter complements absolute floors rather than replacing them. On physical networks the slope must be measured against a reference allocation, because the physics of the network already moves risk outwards.