Agentic Harnesses: LLM-Driven Verification Layers for Robot Autonomy
2026-08-10 • Robotics
RoboticsArtificial Intelligence
AI summaryⓘ
The authors explain that robots often follow plans without checking if those plans are safe or ethical. They created a system using large language models (LLMs) that act like judges to review robot plans before execution. This system decides if plans should be accepted, changed, or checked by humans, helping prevent unsafe or biased actions. Their approach caught most risky plans and made very few errors, especially between clear accepts and rejects.
robot autonomylarge language modelsplanning verificationchain-of-thought reasoningmixture of expertsself-consistencyadversarial attacksmiddlewareaction permissibilityhuman-in-the-loop
Authors
Rohan Bhagra, Mahantesh Halapannavar, Uddhav Bhattarai
Abstract
Advances in advanced artificial intelligence tools have sparked research in robot autonomy, but the development of such systems has largely focused on execution rather than verifying the feasibility actions planning models propose. Like general-purpose LLMs, robotics planning models carry risks: biased toward user-specified goals, they may suggest actions misaligned with scientific ethics, they may be unsafe due to an inability to "remember" prior safety risks, or they may be vulnerable to adversarial attacks on the autonomy ecosystem. We propose a LLM-driven verification layer between planning and execution to evaluate action permissibility. Our LLM-as-a-Judge ensemble combines chain-of-thought reasoning across models and synthesizes those expert judge outputs, mirroring a combination of a mixture of experts and self-consistency approach. This layer serves as middleware, gating plans from the server's planning module before they reach the MCP server and therefore the robot's low-level controls: plans are approved, rejected for reformulation, or escalated for human review. With this system, we achieve near 85% precision across accept/escalate/reject categories 97% containment of adversarial attacks, with negligible errors between accepting and rejecting tasks, and errors mostly manifesting at the escalate boundary.