What Is Cognitive Serializability?
Cognitive serializability is a correctness condition for writes that an AI agent derives by reasoning over inputs that can change while it reasons. A set of committed agent writes is cognitively serializable if the writes can be placed in a serial order and, for each one, there is a single logical point at which every value the agent was shown (database rows, retrieved evidence, policy and delegated authority) was still unchanged. It extends database serializability, which orders the transaction an agent submits but does not check whether the inputs behind it still hold.
Updated
What is cognitive serializability?
Jun He and Deying Yu of OpenKedge.io define the term in When AI Agents Commit: Cognitive Serializability Across Data, Evidence, Policy, and Authority (arXiv, July 2026). Their starting point: "Unlike application logic that reads and writes within one ACID transaction, an agent may reason for seconds before submitting an operation." So "A serializable database commit may therefore be valid inside the DBMS but no longer justified by the state used to derive it." Isolation such as PostgreSQL SERIALIZABLE orders database operations, "not remote evidence selection, policy epochs, or external authorization premises."
The running example is a supply-chain agent that reads inventory, a vendor certificate, spending policy and a manager's approval before it orders. Any of them can drift before commit: a concurrent order changes inventory, the issuer revokes the certificate while its bytes still hash correctly, or the approval expires.
Two strengths are defined. Strict Cognitive Serializability requires every input the agent reasoned over to be unchanged at the write's serialization point. The weaker Effect-Compatible Cognitive Admission lets the same write commit after inputs change, if a registered check accepts it against all current inputs and current policy together, "without claiming to serialize the original stochastic derivation."
How cognitive serializability works
The paper's framework, Taming Cognitive Transactions (TCT), splits the work between an untrusted reasoner and trusted infrastructure:
- 1.Capture. Every input shown to the agent passes through a trusted mediator and is recorded as a typed dependency. A document returned as the current version gets two: one for its content, one for why it was current. Unchanged bytes do not prove a certificate is still in force.
- 2.Seal. The proposed write, its dependencies, the policy in force and the authority it needs are sealed into one hashed envelope.
- 3.Guard, then validate. At commit, the gate takes every guard before reading protected state, rechecks each dependency, and obtains grants from external issuers, which hold their reservations until the commit is durable.
- 4.Commit with a receipt. The effect and a receipt commit together, and the agent's beliefs update from the receipt, not from its intent.
The weaker profile depends on checking inputs jointly. An illustrative case, with numbers constructed for this page: an agent proposes a 30-unit order when exposure is 20 and the cap is 100. While it reasons, exposure rises to 55 and the cap drops to 80.
| Check | Exposure | Cap | Rule: 30 + exposure ≤ cap |
|---|---|---|---|
| At derivation | 20 | 100 | 50 ≤ 100, pass |
| Exposure change alone | 55 | 100 | 85 ≤ 100, pass |
| Cap change alone | 20 | 80 | 50 ≤ 80, pass |
| Both, at commit | 55 | 80 | 85 ≤ 80, fail |
Each change passes on its own, and the order is still invalid. That is why the paper treats independent per-input approvals as insufficient unless a registered certificate shows they imply the joint check.
Why cognitive serializability matters in real-time systems
It is the time-of-check to time-of-use problem stretched across a model call. The paper cites classic TOCTOU races as the motivation for "the requirement that a successful check remain protected through use." For an agent, the check is the reasoning itself, and it can take seconds; see agentic TOCTOU.
The guarantee is conditional: "Omitting an effect-relevant dependency places that execution outside the safety theorems; omission is not guaranteed to fail closed." The authors scope it to high-consequence writes, such as financial settlements, where an unjustified durable effect is worth the coordination cost. Their PostgreSQL prototype "prevented all injected anomalies and added 3.22 ms mean commit overhead"; production evaluation is future work.
The paper's first mechanism, the only one that needs nothing from an external issuer, applies when an input and the write live in one transactional store, so the dependency is read and updated in the same ACID transaction. Tacnode holds that kind of decision state, such as limits, holds and approval records, with full transactions, so a check and the write it gates can commit together. Inputs owned by other systems still need the issuer's own reservation.
FAQ
Related terms
Isolation levels control how database transactions see each other's concurrent changes, from READ UNCOMMITTED to SERIALIZABLE. Anomalies, defaults, examples.
A race condition occurs when a system's outcome depends on the timing of concurrent operations, letting interleaved reads and writes corrupt shared state.
Stateful governance controls AI agent actions with policies that read changing state, such as budgets or inventory, and keeps each decision valid to commit.
A state footprint is the state an agent task reads and writes across its context, the orchestrator and external systems, used to find conflicts between agents.
A decision ledger is an append-only record of automated decisions: what was decided, on what inputs, under which policy and authority, and what changed.
Idempotency means an operation has the same effect whether applied once or many times. Covers its math origin, HTTP methods, and API idempotency keys.