@inproceedings{yergattikar-2026-agents,
title = "Agents Out of Bounds: A Taxonomy of Architectural Drift and a Deployment-Ready Guardrail Framework for {LLM} Coding Agents",
author = "Yergattikar, Saurabh",
editor = "Wang, Yimu and
Choi, Yee Man and
Wu, Di and
Ouyang, Siqi and
Azadani, Mozhgan Nasr and
Fung, Yi R. (May)",
booktitle = "Proceedings of the 1st Workshop on Grounding Language Models: Learning Faithfully and Efficiently ({G}round{LM} 2026)",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.groundlm-1.76/",
pages = "1080--1090",
ISBN = "979-8-89176-478-1",
abstract = "LLM coding agents such as GitHub Copilot, Cursor, and Claude Code now author a large share of the code that teams merge, and they are active in an estimated 22{\%} of public GitHub projects. The output is fast and usually correct in the small. The trouble is that an agent optimizes for the task in front of it, not the global shape of the system. That cost is now measurable. Agent adoption causally raises code complexity by about 42{\%} and static-analysis warnings by about 30{\%}, and the most common reason an agent{'}s patch fails is a shallow grasp of the surrounding architecture. We call this widening gap between a system{'}s intended and realized architecture architectural drift. The obvious remedy, stating the rules in the prompt, does not hold at repository scale; the evidence is that only deterministic, executable enforcement conforms reliably. We make two contributions. The first is a taxonomy of LLM-induced architectural drift: five deterministically enforceable families plus one open frontier, each tied to the architectural primitive it corrupts and the model behavior that produces it. The second is GyroCompass, a deployment-oriented framework. It extracts a living architecture model from source, serves that model to the agent as planning-time context (prevention), and enforces it through a deterministic gate that, run in CI, cannot be bypassed (detection). On a labeled benchmark of 208 cases (104 violations, 104 realistic decoys) spanning Python and JavaScript/TypeScript, GyroCompass reaches 88.5{\%} recall at a 5.8{\%} false-positive rate, versus 57.7{\%} recall at 42.3{\%} false positives for a naive pattern baseline (McNemar p{\ensuremath{<}}0.001); on the original 54-case core it separates violations from look-alikes at 100{\%} recall and zero false positives. Head-to-head on matched subsets, a five-tool comparison (Semgrep, Bandit, CodeQL, pip-audit, import-linter) reaches at most 65{\%} recall. Extraction runs at over 800 files per second, cheap enough to apply on every commit, and its output matches independently constructed references at 0.95-1.0 component precision/recall across four repositories. In an added-line analysis of 1,779 commits of a 10k-star production repository whose maintainers document their layering rules for AI agents, violations of the documented intent continued to land, including after an agent-facing AGENTS.md stated the rules,which is the enforcement gap GyroCompass closes. On the prevention side, serving the architecture to a coding agent as context shifts its layering behavior, but the effect is model-dependent across three model families, which is itself why the deterministic gate, not prompt context, is the binding guarantee. We discuss the prevention/detection trade-off, lessons from instrumenting agent workflows, and what reliable guardrails ask of a team in practice. GyroCompass is a working system intended for real-world deployment; benchmark, harness, and analysis scripts are released."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="yergattikar-2026-agents">
<titleInfo>
<title>Agents Out of Bounds: A Taxonomy of Architectural Drift and a Deployment-Ready Guardrail Framework for LLM Coding Agents</title>
</titleInfo>
<name type="personal">
<namePart type="given">Saurabh</namePart>
<namePart type="family">Yergattikar</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 1st Workshop on Grounding Language Models: Learning Faithfully and Efficiently (GroundLM 2026)</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yimu</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yee</namePart>
<namePart type="given">Man</namePart>
<namePart type="family">Choi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Di</namePart>
<namePart type="family">Wu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Siqi</namePart>
<namePart type="family">Ouyang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Mozhgan</namePart>
<namePart type="given">Nasr</namePart>
<namePart type="family">Azadani</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yi</namePart>
<namePart type="given">R</namePart>
<namePart type="given">(May)</namePart>
<namePart type="family">Fung</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-478-1</identifier>
</relatedItem>
<abstract>LLM coding agents such as GitHub Copilot, Cursor, and Claude Code now author a large share of the code that teams merge, and they are active in an estimated 22% of public GitHub projects. The output is fast and usually correct in the small. The trouble is that an agent optimizes for the task in front of it, not the global shape of the system. That cost is now measurable. Agent adoption causally raises code complexity by about 42% and static-analysis warnings by about 30%, and the most common reason an agent’s patch fails is a shallow grasp of the surrounding architecture. We call this widening gap between a system’s intended and realized architecture architectural drift. The obvious remedy, stating the rules in the prompt, does not hold at repository scale; the evidence is that only deterministic, executable enforcement conforms reliably. We make two contributions. The first is a taxonomy of LLM-induced architectural drift: five deterministically enforceable families plus one open frontier, each tied to the architectural primitive it corrupts and the model behavior that produces it. The second is GyroCompass, a deployment-oriented framework. It extracts a living architecture model from source, serves that model to the agent as planning-time context (prevention), and enforces it through a deterministic gate that, run in CI, cannot be bypassed (detection). On a labeled benchmark of 208 cases (104 violations, 104 realistic decoys) spanning Python and JavaScript/TypeScript, GyroCompass reaches 88.5% recall at a 5.8% false-positive rate, versus 57.7% recall at 42.3% false positives for a naive pattern baseline (McNemar p\ensuremath<0.001); on the original 54-case core it separates violations from look-alikes at 100% recall and zero false positives. Head-to-head on matched subsets, a five-tool comparison (Semgrep, Bandit, CodeQL, pip-audit, import-linter) reaches at most 65% recall. Extraction runs at over 800 files per second, cheap enough to apply on every commit, and its output matches independently constructed references at 0.95-1.0 component precision/recall across four repositories. In an added-line analysis of 1,779 commits of a 10k-star production repository whose maintainers document their layering rules for AI agents, violations of the documented intent continued to land, including after an agent-facing AGENTS.md stated the rules,which is the enforcement gap GyroCompass closes. On the prevention side, serving the architecture to a coding agent as context shifts its layering behavior, but the effect is model-dependent across three model families, which is itself why the deterministic gate, not prompt context, is the binding guarantee. We discuss the prevention/detection trade-off, lessons from instrumenting agent workflows, and what reliable guardrails ask of a team in practice. GyroCompass is a working system intended for real-world deployment; benchmark, harness, and analysis scripts are released.</abstract>
<identifier type="citekey">yergattikar-2026-agents</identifier>
<location>
<url>https://aclanthology.org/2026.groundlm-1.76/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>1080</start>
<end>1090</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Agents Out of Bounds: A Taxonomy of Architectural Drift and a Deployment-Ready Guardrail Framework for LLM Coding Agents
%A Yergattikar, Saurabh
%Y Wang, Yimu
%Y Choi, Yee Man
%Y Wu, Di
%Y Ouyang, Siqi
%Y Azadani, Mozhgan Nasr
%Y Fung, Yi R. (May)
%S Proceedings of the 1st Workshop on Grounding Language Models: Learning Faithfully and Efficiently (GroundLM 2026)
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-478-1
%F yergattikar-2026-agents
%X LLM coding agents such as GitHub Copilot, Cursor, and Claude Code now author a large share of the code that teams merge, and they are active in an estimated 22% of public GitHub projects. The output is fast and usually correct in the small. The trouble is that an agent optimizes for the task in front of it, not the global shape of the system. That cost is now measurable. Agent adoption causally raises code complexity by about 42% and static-analysis warnings by about 30%, and the most common reason an agent’s patch fails is a shallow grasp of the surrounding architecture. We call this widening gap between a system’s intended and realized architecture architectural drift. The obvious remedy, stating the rules in the prompt, does not hold at repository scale; the evidence is that only deterministic, executable enforcement conforms reliably. We make two contributions. The first is a taxonomy of LLM-induced architectural drift: five deterministically enforceable families plus one open frontier, each tied to the architectural primitive it corrupts and the model behavior that produces it. The second is GyroCompass, a deployment-oriented framework. It extracts a living architecture model from source, serves that model to the agent as planning-time context (prevention), and enforces it through a deterministic gate that, run in CI, cannot be bypassed (detection). On a labeled benchmark of 208 cases (104 violations, 104 realistic decoys) spanning Python and JavaScript/TypeScript, GyroCompass reaches 88.5% recall at a 5.8% false-positive rate, versus 57.7% recall at 42.3% false positives for a naive pattern baseline (McNemar p\ensuremath<0.001); on the original 54-case core it separates violations from look-alikes at 100% recall and zero false positives. Head-to-head on matched subsets, a five-tool comparison (Semgrep, Bandit, CodeQL, pip-audit, import-linter) reaches at most 65% recall. Extraction runs at over 800 files per second, cheap enough to apply on every commit, and its output matches independently constructed references at 0.95-1.0 component precision/recall across four repositories. In an added-line analysis of 1,779 commits of a 10k-star production repository whose maintainers document their layering rules for AI agents, violations of the documented intent continued to land, including after an agent-facing AGENTS.md stated the rules,which is the enforcement gap GyroCompass closes. On the prevention side, serving the architecture to a coding agent as context shifts its layering behavior, but the effect is model-dependent across three model families, which is itself why the deterministic gate, not prompt context, is the binding guarantee. We discuss the prevention/detection trade-off, lessons from instrumenting agent workflows, and what reliable guardrails ask of a team in practice. GyroCompass is a working system intended for real-world deployment; benchmark, harness, and analysis scripts are released.
%U https://aclanthology.org/2026.groundlm-1.76/
%P 1080-1090
Markdown (Informal)
[Agents Out of Bounds: A Taxonomy of Architectural Drift and a Deployment-Ready Guardrail Framework for LLM Coding Agents](https://aclanthology.org/2026.groundlm-1.76/) (Yergattikar, GroundLM 2026)
ACL