Concordat uses session types to block unsafe AI agent tool calls without prompts

Concordat models conversation protocols as finite-state machines and rejects tool calls that violate the protocol before they execute. On tau-bench airline tasks, agents on GPT-4.1 and Claude Haiku 5.5 made unauthorized changes in 13 of 50 and 29 of 128 runs under customer pressure, while Concordat agents made zero with no drop in task success.

• Agents without Concordat violated protocol in 13/50 tasks on GPT-4.1 and 29/128 on Claude Haiku 5.5
• Concordat allowed zero unauthorized changes with no loss in task success
• Protocols are state machines exposing only tools valid in each state
• Subclasses cannot weaken protocol guarantees — checked at class definition