Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees
Abstract
Recursive LLM agents can broaden their search by spawning specialists. Some branches later request tools that send data or deploy code. When should a branch receive authority to act? We distinguish sandbox spawning, in which external controls prevent the specified harm, from capability activation, in which a selected branch crosses an irreversible-action boundary. Progressive Risk Vesting (PRV) holds a trajectory-level risk budget in escrow and debits it as branches are activated. We prove an anytime harm bound for adaptively generated trees. Branch outcomes may be dependent, but each local certificate needs to remain valid conditional on the full pre-activation history, including the information used to select the request. When activation gates, branch charges, and compute constraints are held fixed, delayed vesting preserves every policy available under irrevocable spawn charging. Marginal risk estimates can still fail after branch selection. In a stylized branching model, trajectory harm changes as the authority reproduction number ℛA crosses one. As local risk p approaches zero, trajectory harm is proportional to p below criticality, proportional to √p at criticality, and retains a positive floor above it. A finite-type occupancy model yields risk and compute shadow prices. For nested fanout modes with decreasing marginal value per unit risk, these prices produce a threshold rule. Branching calculations and a split-sample experiment illustrate the results. These synthetic studies do not estimate safety in deployed agents. The analysis suggests a design rule: search broadly in the sandbox and grant recursive authority sparingly, with an explicit risk charge.
Related
- Freely Generated Categorical Structures and Automatic Differentiation, PhD Thesis (Introduction and Conclusion)
- Forward recursive aggregator systems and the forward Epstein-Zin recursive paradigm
- Recursive construction of spectral basis and its application to matrices
- Recursive overlap Bernoulli distributions and an entropy concavity conjecture
- Well-ordering principles over recursive comprehension
BibTeX
@misc{wang2026spawn,
title = {{Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees}},
author = {Molly Wang},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2609.01035},
eprint = {2609.01035},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.01035},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees
AU - Molly Wang
PY - 2026
DA - 2026/09/01
PB - arXiv
DO - 10.48550/arxiv.2609.01035
UR - https://arxiv.org/abs/2609.01035
AB - Recursive LLM agents can broaden their search by spawning specialists. Some branches later request tools that send data or deploy code. When should a branch receive authority to act? We distinguish sandbox spawning, in which external controls prevent the specified harm, from capability activation, in which a selected branch crosses an irreversible-action boundary. Progressive Risk Vesting (PRV) holds a trajectory-level risk budget in escrow and debits it as branches are activated. We prove an anytime harm bound for adaptively generated trees. Branch outcomes may be dependent, but each local certificate needs to remain valid conditional on the full pre-activation history, including the information used to select the request. When activation gates, branch charges, and compute constraints are held fixed, delayed vesting preserves every policy available under irrevocable spawn charging. Marginal risk estimates can still fail after branch selection. In a stylized branching model, trajectory harm changes as the authority reproduction number ℛ_A crosses one. As local risk p approaches zero, trajectory harm is proportional to p below criticality, proportional to √p at criticality, and retains a positive floor above it. A finite-type occupancy model yields risk and compute shadow prices. For nested fanout modes with decreasing marginal value per unit risk, these prices produce a threshold rule. Branching calculations and a split-sample experiment illustrate the results. These synthetic studies do not estimate safety in deployed agents. The analysis suggests a design rule: search broadly in the sandbox and grant recursive authority sparingly, with an explicit risk charge.
ER -