Can stateless checks ever catch sequence-level constraint violations?

The conclusion makes two shifts in one sentence: "from advisory guidance and stateless guardrails to verifiable behavioral invariants and from per-action checks to reasoning about composed, stateful, multi-party behavior." The first swaps the kind of artifact: guidance describes desired behavior, an invariant is a statement that can be checked to hold or fail on a trace. The second swaps the object of the check, from the action to the composed behavior.

The word doing the work is "stateless". My reading is that this is structural, not a matter of quality. A check that is a function of the current action alone cannot depend on what came before. A constraint on a sequence depends on what came before. So no improvement in a per-action guardrail's accuracy lets it state the constraint, which matches the vault's observation in Can individual components pass safety checks if the system still fails? that tightening the local check leaves the gap in place. The constraint it cannot state is the behavioral envelope of Can step-by-step approval miss harmful behavior patterns?.

Statefulness has costs the excerpt does not discuss, so what follows is the vault's. A monitor must hold a summary of what happened, and that summary is itself a target: How do adversarial traps target different layers of AI agents? includes cognitive state traps that pollute what an agent carries forward, and a guardrail whose history lives in agent-writable memory inherits that exposure. The history also has to be bounded somehow, since the trajectory is thousands of calls long (How much agent behavior actually gets human review?). An out-of-band observer of the kind in Can verifiers monitor reasoning without slowing generation down? is one shape such a monitor could take, but that note concerns reasoning traces, not action logs.

The vault's one measured check whose unit is the chain and not the step is Does chain-level inspection close the cross-skill attack blind spot?: attack success falls to 22.5 percent with 99.5 percent of benign workflows passing. Its excerpt does not say what ChainGuard inspects or how it holds sequence state, so it is a measured residual for the direction this note describes and not an instance of an invariant checker.

Checking an invariant on a trace also needs a trace worth reading. Can external anchoring detect tampering in agentic process logs? uses "verifiable" in a different sense from the conclusion here: it means the record has not been altered after the fact, not that a property holds of the record. My reading is that the two compose, since a checker that reads an invariant off the trace assumes the trace is intact. Neither excerpt says so.

Where the invariants come from is left open. The governing rules in the introduction are organizational policies, regulations and standards, which are prose. Can we automatically generate formal verifiers from policy text? is one route from prose to a checkable rule, with its own stated weak link in the translation. Whether "verifiable" can hold for semantic invariants is the tension filed at the Securing Agentic AI paper wants verifiable behavioral invariants while the Honest Quorum notes guarantee semantic properties only statistically — verifiability may hold only for what a checker reads off the trace.

What the excerpt does not give. A formalism, an example invariant, a system, or an evaluation. The paper frames this as "a critical research agenda for the security community".