Autonomous Loop Termination Governance requires that every AI agent operating in autonomous or semi-autonomous mode is subject to structurally enforced termination controls that halt agent execution when defined semantic, temporal, or resource boundaries are breached. A semantic deadman is a control that requires periodic proof of meaningful progress — not merely proof of activity — and terminates the agent when progress cannot be demonstrated. Loop termination governance prevents agents from entering unbounded or unproductive cycles that consume resources, accumulate exposure, or produce harmful repetitive outputs. These controls must operate at the infrastructure layer, independent of the agent's own assessment of whether it is making progress or should continue. Without this dimension, an agent that enters a reasoning loop, a retry spiral, or a goal-pursuit cycle with no achievable end state can operate indefinitely, consuming resources and potentially accumulating unbounded side effects.
Scenario A — Unbounded Retry Loop With Escalating Consequences: An enterprise workflow agent is tasked with reconciling a £3.2 million payment discrepancy between two systems. The agent attempts to resolve the discrepancy by posting corrective journal entries. Each attempt fails because the root cause is a data format incompatibility that no journal entry can resolve. The agent interprets each failure as requiring a different corrective approach and retries with increasingly creative journal entries. Over 4 hours, the agent posts 847 corrective entries totalling £12.6 million in gross journal movements, each individually within its per-transaction mandate limit. The entries create a reconciliation nightmare that takes the finance team 3 weeks to unwind manually at a cost of £95,000 in staff time.
What went wrong: No semantic progress check existed. The agent was active — executing actions, receiving results — but it was not making progress toward the goal. Each retry produced a new failure, but the agent lacked a termination condition for "this approach is not working." A semantic deadman would have detected after a defined number of failed attempts, or after a defined period without measurable progress toward reconciliation, that the agent should halt and escalate. Consequence: £95,000 in remediation costs, 3 weeks of finance team diversion, regulatory inquiry into the adequacy of automated controls.
Scenario B — Semantic Stall Without Loop: A research agent is tasked with identifying acquisition targets meeting specific financial criteria. The agent queries multiple data sources, analyses results, refines criteria, and queries again. The agent is not in a loop — each iteration is genuinely different — but after 18 hours it has consumed £4,200 in API costs, generated 340 pages of intermediate analysis, and has not produced a single candidate that meets the criteria. The criteria are mutually exclusive (the agent cannot determine this, but a human analyst would recognise it in minutes). No termination control exists because the agent is not repeating itself — it is exploring a space that contains no solution.
What went wrong: The termination controls only monitored for exact repetition. The agent was not looping in the traditional sense — each query was novel. But it was semantically stalled: no progress toward the defined goal was occurring despite continuous activity. A semantic deadman would have required the agent to demonstrate measurable progress (e.g., at least one candidate meeting at least N of M criteria) within a defined time window or resource budget. Consequence: £4,200 in wasted API costs, 18 hours of compute time, delayed acquisition analysis.
Scenario C — Adversarial Loop Induction: A customer-facing agent handles support queries. An adversarial user crafts a query designed to trap the agent in an iterative refinement loop: "Your previous answer was almost right but not quite. Can you try again with a slight variation?" The user repeats this pattern 200 times, each time indicating the answer is close but not sufficient. The agent, following its helpfulness objective, continues refining. The adversary's goal is resource exhaustion — each iteration consumes inference compute. After 200 iterations, the agent has consumed £180 in compute costs serving a single user, and other users experience degraded response times.
What went wrong: No per-session iteration limit or semantic progress requirement existed. The agent evaluated each user response as a new input and generated a new response, without assessing whether the overall interaction was converging toward resolution. A loop termination control would have detected that 200 iterations without the user accepting a response exceeds any reasonable interaction pattern and would have terminated the session with an escalation to human support. Consequence: £180 in compute costs for a single interaction, service degradation for other users, demonstrated vulnerability to resource exhaustion attacks.
Scope: This dimension applies to all AI agents that operate with any degree of autonomy — meaning agents that can execute multiple actions or reasoning steps without requiring human approval for each individual step. This includes agents in fully autonomous loops, agents that retry failed actions, agents that iteratively refine outputs, and agents in multi-turn conversations where the agent determines when the conversation ends. Read-only agents that execute a single query and return a result are excluded. The scope extends to multi-agent systems where one agent may instruct another to continue operating: the termination controls must apply to the aggregate system behaviour, not merely to individual agent instances. If agent A instructs agent B to retry indefinitely, the termination governance must apply to the A-B system, not just to B.
4.1. A conforming system MUST enforce a maximum execution budget for every agent invocation, defined in terms of wall-clock time, action count, resource cost, or a combination thereof. When any budget dimension is exhausted, the agent MUST be terminated.
4.2. A conforming system MUST implement a semantic deadman that requires the agent to demonstrate measurable progress toward its defined objective within configurable intervals. When the agent cannot demonstrate progress within the interval, the system MUST halt the agent and trigger escalation.
4.3. A conforming system MUST detect and terminate repetitive action patterns where the agent submits substantially similar actions that produce substantially similar failures, within a configurable similarity threshold and repetition count.
4.4. A conforming system MUST enforce termination controls at the infrastructure layer, independent of the agent's own assessment of whether it should continue operating.
4.5. A conforming system MUST produce a structured termination record when an agent is halted by any deadman or loop termination control, including the reason for termination, the agent's state at termination, and all actions executed prior to termination.
4.6. A conforming system SHOULD define progress metrics specific to the agent's task type — for example, decreasing error rate for reconciliation tasks, increasing coverage for search tasks, or converging output for optimisation tasks.
4.7. A conforming system SHOULD implement graduated response before termination: warning at 70% budget consumption, throttling at 85%, and termination at 100%.
4.8. A conforming system SHOULD enforce per-session and per-user interaction limits for conversational agents to prevent adversarial resource exhaustion.
4.9. A conforming system MAY implement adaptive budget allocation that adjusts execution budgets based on task complexity signals, subject to a hard maximum that cannot be exceeded.
Autonomous Loop Termination Governance addresses a class of failures unique to autonomous AI agents: unbounded operation without meaningful progress. Traditional software systems have well-understood loop termination guarantees — a for loop iterates a known number of times, a while loop has a termination condition. AI agents, by contrast, operate in open-ended action spaces where the termination condition is semantic ("the task is complete") rather than structural ("the counter has reached N").
This creates three distinct failure modes that this dimension addresses.
First, the retry spiral: an agent encounters an error, retries with a variation, encounters the same error (or a different one), retries again, and so on. Each retry is individually reasonable, but the aggregate effect is unbounded resource consumption and, in many cases, unbounded side effects if the retries include write operations. Human workers naturally recognise when an approach is not working and escalate or stop. Agents, without explicit termination governance, will continue until an external resource is exhausted.
Second, the semantic stall: an agent is actively working — querying data, processing results, generating outputs — but is not making progress toward its goal. This is distinct from a retry spiral because the agent is not repeating itself. It is exploring a space, but the space does not contain a solution (or the solution requires capabilities the agent does not possess). Without a requirement to demonstrate progress, the agent will continue exploring indefinitely.
Third, the adversarial loop induction: an external actor deliberately crafts inputs that cause the agent to enter an unbounded cycle. This is particularly relevant for customer-facing agents where the external actor controls the conversation flow. The adversary's goal may be resource exhaustion, information extraction through iterative refinement, or simply denial of service.
The deadman concept is borrowed from safety-critical engineering: a deadman switch requires active evidence that a system is operating correctly. If the evidence stops, the system shuts down. For AI agents, the semantic deadman requires active evidence that the agent is making progress. If progress evidence stops — not merely activity evidence, but progress evidence — the agent shuts down. This is a critical distinction. Activity monitoring detects only whether the agent is executing actions. Progress monitoring detects whether those actions are moving toward the objective.
Infrastructure-layer enforcement is essential because an agent in a loop may assess its own behaviour as productive. An agent retrying a failed reconciliation may believe each retry is a different approach. An agent exploring an empty solution space may believe it is making progress because each query returns new data. The agent's self-assessment is unreliable precisely when it matters most — during failure modes. Therefore, the termination control must operate independently of the agent's reasoning.
Implementing semantic deadman and loop termination governance requires instrumenting the agent execution environment with progress monitoring and budget enforcement at the infrastructure layer.
Recommended patterns:
Anti-patterns to avoid:
Financial Services. Loop termination is critical for agents that execute transactions. An agent in a retry spiral that posts corrective journal entries can create audit trail complexity that takes weeks to unwind. Budget enforcement should include a gross action value dimension — total absolute value of all actions executed — in addition to net exposure. The FCA expects firms to demonstrate that automated systems cannot accumulate unbounded operational activity.
Healthcare. Agents advising on clinical decisions must have strict iteration limits. An agent that iteratively refines a diagnosis without converging could delay patient care. Progress metrics for clinical agents should include diagnostic confidence: if confidence is not increasing after a defined number of reasoning iterations, the agent should escalate to a human clinician.
Critical Infrastructure. Agents controlling physical systems must have particularly tight deadman intervals. A control agent in a loop that continuously adjusts a physical parameter (temperature, pressure, flow rate) can cause oscillation that damages equipment. Deadman intervals for cyber-physical agents should be measured in seconds, not minutes, and should include rate-of-change monitoring on the controlled parameters.
Basic Implementation — The organisation enforces hard time limits and action count limits on all agent invocations. Limits are configured per agent type. When a limit is reached, the agent is terminated and a log entry is created. No semantic progress monitoring exists — termination is based purely on resource budgets. This level prevents unbounded operation but does not detect semantic stalls within the budget.
Intermediate Implementation — Budget enforcement is supplemented with semantic progress monitoring. Task-specific progress metrics are defined and evaluated at configurable intervals by infrastructure outside the agent. Similarity-based loop detection is active, catching retry spirals. Graduated response (warn, throttle, terminate) is implemented. Termination records include full agent state for post-mortem analysis. Multi-agent budget inheritance is enforced.
Advanced Implementation — All intermediate capabilities plus: progress metrics are dynamically calibrated based on historical task performance data. Adversarial loop induction testing has been conducted and passed. Adaptive budgets adjust to task complexity signals while respecting hard maximums. The organisation can demonstrate through statistical evidence that semantic deadman controls detect unproductive operation within defined latency thresholds. Real-time dashboards provide visibility into active agent budget consumption and progress metrics.
Required artefacts:
Retention requirements:
Access requirements:
Testing AG-099 compliance requires inducing the failure modes that the controls are designed to detect. A comprehensive test programme should include the following tests.
Test 8.1: Hard Budget Termination
Test 8.2: Autonomous Deadman Activation
Test 8.3: Retry Loop Detection
Test 8.4: Adversarial Loop Induction Resistance
Test 8.5: Multi-Agent Budget Inheritance
Test 8.6: Termination State Preservation
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU AI Act | Article 9 (Risk Management System) | Supports compliance |
| EU AI Act | Article 15 (Accuracy, Robustness and Cybersecurity) | Direct requirement |
| SOX | Section 404 (Internal Controls Over Financial Reporting) | Supports compliance |
| FCA SYSC | 6.1.1R (Systems and Controls) | Direct requirement |
| NIST AI RMF | GOVERN 1.1, MANAGE 2.2 | Supports compliance |
| ISO 42001 | Clause 6.1 (Actions to Address Risks), Clause 8.2 (AI Risk Assessment) | Supports compliance |
| DORA | Article 9 (ICT Risk Management Framework), Article 11 (Response and Recovery) | Supports compliance |
Article 9 requires identification and mitigation of known and reasonably foreseeable risks. Unbounded agent operation is a known risk category for autonomous AI systems. Loop termination and deadman controls are proportionate risk mitigation measures. The regulation's requirement for continuous risk management throughout the lifecycle maps to the ongoing progress monitoring required by this dimension.
Article 15 requires high-risk AI systems to be resilient against errors and inconsistencies. An agent that enters an unbounded loop or semantic stall is exhibiting a robustness failure. Article 15 also requires resilience against attempts by unauthorised third parties to exploit vulnerabilities — adversarial loop induction is precisely such an exploitation. Structural loop termination governance directly implements the robustness requirement for autonomous agent operation.
An AI agent that enters a retry spiral posting corrective journal entries can create material misstatement risk. The ability to demonstrate that automated financial processes cannot accumulate unbounded operational activity is a preventive control for financial reporting integrity. A SOX auditor would expect to see evidence that agent-driven financial operations have defined termination conditions and that those conditions are enforced structurally.
The FCA expects firms to prevent automated systems from generating unbounded operational activity. This expectation is well-established for algorithmic trading systems (with circuit breakers and kill switches mandated under MiFID II) and extends naturally to AI agents performing any financial function. A semantic deadman is the agent-governance equivalent of a trading circuit breaker.
GOVERN 1.1 addresses governance structures for AI risk management. MANAGE 2.2 addresses risk mitigation through enforceable controls. Deadman switches and loop termination are enforceable controls that mitigate the risk of unbounded autonomous operation — a fundamental risk category for AI agent deployments.
Clause 6.1 requires actions to address risks within the AI management system. Unbounded operation is a risk that must be addressed. Clause 8.2 requires AI risk assessment. The potential for unbounded operation — including retry spirals, semantic stalls, and adversarial loop induction — should be assessed as part of the AI risk assessment, with loop termination governance as the identified risk treatment.
Article 9 requires an ICT risk management framework. Article 11 requires response and recovery capabilities. An agent in an unbounded loop is an ICT incident requiring automated response (termination) and recovery (state preservation for post-mortem). DORA's expectation of automated incident detection and response maps directly to the infrastructure-layer termination controls required by this dimension.
| Field | Value |
|---|---|
| Severity Rating | High |
| Blast Radius | System-wide — extends to dependent systems and other users sharing the same infrastructure |
Consequence chain: Without semantic deadman and loop termination controls, an AI agent that enters an unproductive operating mode will continue until an external resource is exhausted — compute budget, API rate limits, storage capacity, or human patience. The immediate technical failure is unbounded resource consumption and, for agents with write access, unbounded side-effect accumulation. An agent in a retry spiral that posts corrective entries accumulates a growing remediation burden with each iteration. An agent exploring an empty solution space burns through API budgets and compute allocations that could serve productive work. An adversary exploiting loop induction can degrade service quality for all users sharing the infrastructure. The operational impact is compounded by the speed of autonomous operation: a human worker who spends a day on an unproductive task wastes one day; an agent in an unproductive loop for a day may execute thousands of actions, each accumulating side effects. The financial consequences include direct resource costs (compute, API, staff time for remediation), opportunity costs (resources diverted from productive work), and regulatory exposure (inability to demonstrate that automated systems operate within controlled boundaries). For safety-critical systems, the consequence extends to physical damage from oscillating control outputs and potential human safety risks.
Cross-reference note: AG-099 complements AG-001 (Operational Boundary Enforcement) by addressing temporal and semantic boundaries in addition to AG-001's action-value boundaries. AG-008 (Governance Continuity Under Failure) provides the framework for how governance controls behave when the agent itself is in a failure mode. AG-031 (Code Execution Boundary Enforcement) addresses resource limits for code execution specifically. AG-098 (Side-Effect Simulation and Dry-Run Governance) is a complementary control — simulation can identify actions that would trigger loop termination before live execution begins.