Reference Monitors in Agentic AI Workflows: Governing Execution-Derived State Across Five Agent Frameworks

Agentic systems interpret instructions, formulate plans, invoke tools, delegate work, and adapt to execution results. These activities produce information that may influence subsequent authorization decisions. The resulting security problem does not require policy, execution, and evidence to merge. They may remain technically distinct while information produced by the governed workflow acquires authority-bearing significance without validation appropriate to that role. This paper compares traditional reference-monitor requirements with control mechanisms documented for LangGraph, OpenAI Agents SDK, Microsoft AutoGen, CrewAI, and Google Agent Development Kit. It distinguishes incomplete mediation from inadequate policy scope, untrustworthy authorization inputs, stale decisions, and insufficient execution evidence. A proposed threat-model matrix maps candidate boundary failures, bypass paths, restoration mechanisms, and acceptance tests across the five frameworks. The analysis treats framework hooks, guardrails, interrupts, confirmations, and execution isolation as potential control components rather than automatic evidence of complete mediation. Documentation claims are dated and version-qualified; proposed failure paths are not reported exploitable vulnerabilities. The paper further distinguishes local enforcement from end-to-end mandate integrity. The author’s retained E-01 result, in which history-aware accumulated-state checking satisfied the tested mandate without a new mechanism, supports testing existing controls under equivalent conditions before claiming that additional mechanisms are necessary. The proposed assurance objective is a demonstrable relationship between applicable authority, execution trajectory, and resulting consequence.