Everything passes the gate.
Or it never happened.
Words in the chat never become facts in the record, except through deterministic code.
LLM agents fail workflows not because they cannot talk, but because nothing stops a wrong word from becoming a wrong record.
PRISM takes a position: rules that must always hold are enforced by code that cannot be persuaded.
A workflow is a contract. Not a script.
One declarative file defines what must be true at the end. How the conversation gets there stays free. Everything PRISM enforces comes from this file, and a malformed file refuses to load, naming the exact offending field.
Typed, validated, flat
Text, select, number, email, date. Every field carries its validators: length bounds, ranges, date windows. Validation is pure code. Even "today" is injected from outside, so every run is exactly reproducible.
The branching tree, declared
Any field can carry a show_when condition: equality, comparisons, all_of, any_of, nested arbitrarily deep, chained through other guarded fields. Four levels of branching, each appearing exactly when its condition holds.
Facts words cannot fake
An evidence field can only be satisfied by a real tool call: an upload, a diagnostic run, a lookup. Each one declares exactly which tools count. A typed description of a receipt is noted as text and worth nothing as evidence.
[ fig 03.3 · the upload that unlocks the payout ]
Verdicts, locked behind proof
A conclusion is a terminal judgment: a diagnosis, an adjudication. It can declare requires_evidence, and then the model literally cannot file it before the evidence exists. This is the anti-hallucination mechanism, in one line of YAML.
Verified or express
A verified workflow shows a summary and demands an explicit yes before anything commits. An express workflow submits the moment the record is complete. Consequential flows get the ceremony; low-stakes flows get the speed.
A first-class way out
Every workflow can declare when to hand off to a human and what that triggers. Escalating is always a legitimate terminal, never a failure state. The agent has an honest way to say: this needs a person.
Every turn, the same four beats.
The engine holds one immutable state: answers, evidence, three flags. Everything else is recomputed. Nothing is cached, nothing remembered, nothing inferred.
Recompute.
The active path is rebuilt from scratch: which fields are live given every answer so far. Recomputed, so it is always right.
Prune.
If a correction deactivated a branch, every answer and every piece of evidence on it is dropped, cascading to a fixpoint. Stale data cannot survive a branch switch, and every drop is logged.
Project.
The model gets its dashboard: the always-correct live picture of where the workflow stands. Then it talks, extracts, orders, clarifies. The conversation is its territory.
Gate.
Every consequential action lands in plain code that admits or rejects it. Same input, same verdict, every time.
One contract. Three granularities.
How much workflow context does a model need per turn? PRISM answers with layers. That is the prism in PRISM: one definition, projected at three resolutions.
The map.
Every field, its type, its options, its guard, what satisfies it. Compact, in the system prompt, once. Global awareness of the terrain.
The position.
Answered fields with values. The active branch. The exact list of what remains mandatory. Evidence collected. Confirmed or not, complete or not.
The magnifier.
A tool call pulls the full specification of any single field when the model needs it. Depth without paying for it every turn.
The research shows this layering matches the reliability of re-sending the entire workflow file every single turn. On these small workflows the token cost is comparable; the pre-registered hypothesis is that the projection pulls ahead on cost as workflows grow.
Four gates. Two kinds of no.
Every action the model takes lands in a gate before it touches state.
Answer gate.
Rejects answers to fields that do not exist or are off the active path, answers to evidence fields, conclusions missing their evidence, values that fail validation, anything after submission.
Evidence gate.
Registers evidence only from a tool the field actually names. Rejects evidence for inactive fields, non-evidence fields, or after submission.
Confirmation gate.
A yes attests to the record as it stood in that moment. Change one answer afterward and the confirmation voids itself. A stale yes can never carry data into a submission.
Commit gate.
Blocked while anything mandatory is missing, and it lists exactly what. Blocked until confirmed, where required. Idempotent afterwards: submit twice, get one record.
A field that does not exist, evidence via the wrong tool. Always rejected. There is nothing coherent to admit.
Answering an inactive field, concluding early, committing prematurely. Governed by one switch:
The violation is rejected and the model receives the precise machine-readable reason. It course-corrects.
The violation is admitted but flagged. Run a pilot where the agent behaves exactly as it would unguarded, and read precisely what would have gone wrong, before you turn enforcement on.
Attempted versus admitted.
Every accepted action, every rejection with its reason, every branch cleanup, every voided confirmation, every commit: appended to one structured, append-only log. It is the artifact your compliance team actually wants.
[ fig 06 · one demo session, verbatim shape ]Blocked is not hidden. Everything the gates reject stays visible with its reason. A shield with a flight recorder, not a filter that quietly rewrites behavior.
Measured like an engineering artifact.
PRISM is benchmarked in a research paper targeting an EMNLP 2026 workshop: five agent configurations sharing one identical engine and turn loop, so the only difference is what the model sees and whether the gates enforce.
Unguided
No projection, no enforcement. The raw-agent floor.
Wizard
Only the single next field, with enforcement. Maximum hand-holding, minimum awareness.
Brute force
The whole workflow file re-sent every turn, with enforcement. Maximum context, maximum cost.
Awareness only
Full three-tier projection, gates only log.
Full PRISM
Three-tier projection plus enforcement.
The boundary does real work.
Full PRISM clearly outperforms both no guidance and guidance without enforcement: 71.0% strict success against 0.0% prompt-only and 51.4% with enforcement off. Awareness alone is not enough.
A compact projection, not a bigger prompt.
On these small workflows, re-sending the whole specification every turn stays competitive on both reliability and cost. The pre-registered hypothesis is that a compact projection wins as workflows grow in size and branching; this pilot does not yet test that regime.
The shield holds absolutely.
With enforcement on, admitted violations are zero by construction, and the log proves the counterfactual: prompt-only attempted 2,403 rule-violating actions and admitted 1,108. A stronger model attempted far fewer than a weaker one. Neither attempted zero.
More prompting does not fix process.
Results hold across different turn budgets, and naively nudging a stalled model mostly fails or backfires. Deterministic structure is what moves reliability.
3,961 evaluation cells at N = 233 per cell: four inexpensive production models from three providers (three on the full grid, one on a subset), five configurations, scripted multi-turn scenarios with corrections, distractions, contradictions and adversarial pushes.
PRISM was not invented on a whiteboard. It is the distilled core of a production booking system that has been running with real businesses; the research prototype re-implements that architecture cleanly and measures it.
What PRISM is not.
A runtime layer that works with any LLM through a narrow adapter interface. Anthropic, OpenAI and Gemini adapters exist today. Better models converse better; the guarantees do not depend on the model.
The guarantee is about the committed record: no rule-violating action is ever admitted. Nothing wrong is recorded, submitted or paid. The model may still phrase something imperfectly in conversation.
PRISM makes the model's environment unforgiving of error and fully observable. Same model, same conversations, dramatically different committed outcomes.
Deliberately minimal: typed fields, guards, evidence, conclusions, confirmation, commit. That minimality is why it can be deterministic, auditable and fully verifiable.
Everything the gates reject is visible in the log with its reason. Blocked is never hidden.
PRISM versus prompt-only agents.
| Prompt-only agent | Agent on PRISM | |
|---|---|---|
| Where the rules live | In the system prompt, as hope. | In code that cannot be persuaded. |
| Under pressure | Compliance is probabilistic. Sometimes it folds. | The gate returns the same verdict every time. |
| Mid-flow corrections | Stale answers linger, or everything restarts. | Dead branches pruned automatically, survivors kept, all logged. |
| Verdicts | Producible without the verifying step. | Locked until the evidence actually exists. |
| Audit trail | A chat transcript. | An append-only ledger of attempted versus admitted. |
| Duplicate submits | Two orders on a retry. | A recorded no-op. One record, ever. |
Kick the tires.
Watch it hold under pressure in a live booking, or bring us your workflow and get a technical walkthrough of the contract we would write for it.