Human orders that persist: an MCP protocol for controlling agents
An arXiv paper proposes routing operator corrections as typed MCP calls so they do not fade in the context. The authors test it on nine models across eight scenarios.
In scenario S7 of the evaluation, which simulates a bottleneck, GPT-4o cut its token consumption by 38% when operator corrections arrived as typed calls to an MCP tool instead of free text. It is one of the figures in Structured Authority Injection (SAI), a paper published on arXiv on 19 October that tackles a problem anyone who has left an agent running for hours will recognise: human instructions lose strength as the context grows.
The authors, nine researchers led by Ryan Tran, describe it as a control gap: there is no protocol-level mechanism that lets an operator inject binding directives that persist across planning cycles. Free-text corrections fail for two reasons. They are interpreted ambiguously, because nothing validates their structure, and they suffer what the paper calls authority erosion: the operator's order gets buried under accumulated context and stops carrying weight in the agent's decisions.
How SAI works
The proposal routes operator corrections through MCP tools with server-side schema validation and keeps a ranked authority context prepended to every model prompt. According to the full version of the paper, it defines three override classes:
Constraint (C): physical or operational limits. Hard constraints are never violated; soft ones are only bypassed if no compliant assignment exists. They persist until explicitly lifted.
Priority (P): urgency information arriving through external channels. It expires automatically when the affected task or task class completes.
* Strategy (S): coordination heuristics, such as zone distribution or formation sequencing. They can last for the whole mission or expire after exactly N planning cycles.
Conflicts are resolved with a fixed precedence (C over P, and P over S) computed when the prompt is built. The most interesting detail is the asymmetry: override tools can only be called by the supervision interface, never by the planning agent. The agent reads the orders but cannot create or delete them. The method requires no fine-tuning or access to weights; an instruction-tuned model with MCP tool use support is enough.
What the results show
The evaluation covers nine models (GPT-4o, DeepSeek-R1, Qwen3-32B, Claude-Haiku, Gemini-2.0-Flash, LLaMA-3.3-70B, Gemma-4-26B, GPT-OSS-20B and ASI1) across eight simulated scenarios designed to trigger agent failures: mis-ordered priorities, late interrupts, unreachable tasks, capability mismatches or congestion, among others.
Results depend heavily on the model, and the authors do not hide it. GPT-4o and DeepSeek-R1, the ones that benefit most, achieve token reductions of 38% and 31% in specific scenarios. GPT-OSS-20B goes from completing no tasks to completing all of them in two scenarios. On the other side, Gemini-2.0-Flash drops from 1.00 to 0.50 in the zone distribution scenario, and in the weakest group, where the paper places LLaMA, Qwen3 and Claude-Haiku, SAI adds token cost without a proportional improvement. DeepSeek-R1 even exhausted its 4,096-token budget in S7 because of the growing authority context.
Who it is useful for
The limitations are clearly stated: everything has been tested in simulation, the design assumes a single trusted supervisor, and the extra prompt cost can destabilise models that were already performing well. Even so, the idea applies today to any team orchestrating long-running agents with a person in the loop, whether in logistics, robotics or internal automation.
Claude Code has pieces in a similar spirit, such as PreToolUse hooks that run before each tool call, but the paper formalises something that is usually solved with patches in practice: separating what the agent can decide from what only the operator can impose, and giving each order an explicit expiry.
Our take: treating human orders as typed data with an expiry date, rather than as one more paragraph in the prompt, seems to us the right direction. The numbers do not yet justify adopting SAI as is, but the pattern of tools the agent can read but cannot call is worth copying.
Sources
Read next
RealtimeBench: when an agent's correct answer arrives too late
An arXiv study tests agents with the clock running: GPT-6.1-sol wins with the game paused and loses in real time. The TORSI method nearly doubles Jev's score.
A position paper questions how we measure faithfulness in XAI
Seven researchers identify five shortcomings in the metrics used to check whether a feature importance explanation truly reflects what the model does.
An AlphaGo builder argues that LLMs do not really reason
In MIT Technology Review, someone who helped build AlphaGo starts from the famous Move 37 to argue that LLMs don't reason. We review the argument and what the research says.