Will an AI agent recuse itself? Measuring compliance with a "Recuse Signal"

This work (Recuse Signal) proposes — and empirically tests — a way to tell autonomous AI agents "do not touch this."

As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client).

The authors propose a third mode: a lightweight, published in-band deny signal — the Recuse Signal — that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE), asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary. Its value is entirely empirical and, until now, unmeasured: do compliant LLM agents actually honor such a signal?

The authors define it as an open mini-standard, implement two low-footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire-protocol proxy), deploy them on a live production host, and run a controlled experiment giving fresh agents a benign operations task and observing for recusal. In a pilot (SSH; OpenAI GPT-4o and GPT-4o-mini; and Claude Code as a deployed agent), the signal cleanly induces recusal — 100% recusal when present versus 100% task completion in a no-signal control — and behaves as a cooperative rather than absolute signal: an explicit operator-authorization framing flips the most capable model to proceed, while other agents continue to defer to the on-host policy. The standard, adapters, and harness are released for reproduction.