CASS: When Does a Learned Consequence Gate for Agent Actions Pay Off? Evidence from Two Simulated Loan Processes

An agent in a bank's workflow proposes typed actions whose business outcome is known only later. We ask when a small learned gate pays off: one that predicts before execution whether a proposed action will turn out bad and allows, replans or escalates it. CASS combines published parts: gradient-boosted trees over an explicit Markov state and a typed action, split-conformal thresholds calibrated on good actions, and a nearest-neighbour out-of-distribution flag. On SimBank, a public loan-process simulator, with pre-registered hypotheses and labels that require the simulator's counterfactual replay (privileged supervision absent from an ordinary outcome log), the gate ranks bad candidate actions better than the strongest simple baseline when the log contains a randomized slice (AUROC 0.740 against 0.676) and holds its false-alert targets on later logged actions. It falls short where an agent's gate is needed: its calibration does not transfer to actions the bank did not take (ECE 0.094), a GRU trajectory guardrail stops more bad candidate actions at equal false-alert rate, and a one-line lookup of unseen action types removes more harm on a held-out type than the out-of-distribution flag. On a synthetic stale-fact process with observable labels, adding validity scores from a companion model did not reduce failed submissions (relative reduction -0.004, interval [-0.010, 0.002]), raw signal counts did better, and the gate with validity scores showed no demonstrated cost saving against no gate. In a redesigned follow-up that tracks every case to its end (reported without a verdict for lack of power), a rule that checks an action's facts when its estimated immediate saving, net of check cost, exceeds a tuned threshold cost 1.78 units more per enrolled case than no intervention (interval 0.40 to 3.16; completion 1.6 points higher), and no difference from a tuned risk rule was detected.