---
title: "Steerability via Constraints: A Substrate for Scalable Oversight of Coding Agents"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.02389v1"
permalink: "https://feed.astralor.com/items/itm_0c7d02a286334a5c6e43bdf3"
published: "2026-07-02T16:24:47.000Z"
score: 55
channel: "ai"
tags: ["AI Security","Coding Agents","Backdoor Detection","constraint-based supervision"]
---

# Steerability via Constraints: A Substrate for Scalable Oversight of Coding Agents

## At a glance

This paper proposes using constraints (access control, network policies, coding conventions) to oversee code-generation agents, replacing costly and unsafe unconstrained approaches. Controlled experiments show that a constrained substrate improves backdoor detection recall from 54.5% to 90.9% in Python codebases, with substrate and tools contributing independently. The approach benefits languages with weaker guarantees (like Python) and extends to Rust.

## Key points

- Unconstrained coding agents introduce security risks and degrade codebase scalability, escalating human review costs.
- Classical engineering constraints (ACLs, network policies, coding conventions) transfer directly to agents at lower token cost than recent scaffolding.
- Controlled experiment with a small reviewer (Gemma 4 e4b) achieves 90.9% recall on backdoor detection using constrained substrate + ~200 LoC CLI.
- Gains are largest for languages with fewer default guarantees (Python); principles extend to Rust and others.

## Full text

Coding agents are capable; human oversight is the bottleneck. Unconstrained agents introduce security risks, erode codebase scalability, and make human review increasingly costly. We argue that the same methods used for decades to manage large human engineering teams: access control, network policies, strict coding conventions enforced by tooling; transfer directly to coding agents, and are cheaper (in token) than recent agentic scaffolding. We sketch a start-to-end system on this principle, and report a controlled experiment in scalable oversight: a small reviewer (Gemma 4 e4b) inspects a Python codebase containing 11 inserted backdoors. Recall rises from 54.5% (unconstrained, no tools) to 90.9% (constrained substrate plus a ~200-LoC `docs` CLI), with substrate and tools contributing independently. We choose Python deliberately: substrate-level oversight gains are largest where the language gives the fewest guarantees by default; the principles extend to languages like Rust.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_0c7d02a286334a5c6e43bdf3