Can a watchdog outside an AI agent keep its endless chains of actions safe without rechecking everything each time?

This explores whether a monitor that sits outside an agent's own loop can keep long, open-ended chains of actions within safe limits without re-checking everything. The corpus is clear on one half of this: the observer has to remember. It doesn't test the other half, cost, so the efficiency part is still open.

The clear part is that a watcher with no memory is useless here. Checking each action on its own can't express any rule that depends on what came before, so a guardrail can approve every step of a sequence that is unsafe as a whole. According to Can stateless checks ever catch sequence-level constraint violations?, only stateful monitors that track the combined behavior of several parties can verify the limits that stop individually allowed actions from adding up to a violation. So a stateful, out-of-band observer is required. What the corpus doesn't have is a note that measures what that state costs as sequences get longer.

The nearest thing to a theory of "efficiently" is What can a bounded observer actually learn from data?. It formalizes what an observer with limited compute can actually extract from data: the learnable structure counts, and the rest looks like noise. That paper is about datasets, not monitors, so this is my extension of it. A bounded observer will never track an unbounded sequence in full. It has to lean on regularities that hold across the whole sequence. If so, the efficient design is to watch the parts of a trajectory that carry structure, not every step.

Some of the corpus points to where those parts might be. Can trajectory structure replace hand-annotated process rewards? shows that tree shape, expert-aligned actions and the position of tool calls are enough to turn one final outcome score into a signal at every step, with no hand-labelled step scores. That is a training result, but it shows agent trajectories have landmarks that carry information cheaply. A monitor could focus on the same landmarks. Why do trajectories matter more than individual examples for in-context learning? is a hint in the same direction. It finds that sequential decision-making can be learned in context from full or partial trajectories of the same kind of task, so partial history can sometimes be enough. Neither note tests a monitor.

The corpus also raises a problem that comes before efficiency: efficient at checking whose rules? Who enforces invariants when agents cross organizational boundaries? points out that when agents hand work across organizations, the constraints come from up to four sources: the operator, the organization, the regulator and the standards body. They have different owners, may conflict, and may not all be visible to every party. An observer can be cheap and still enforce the wrong rules, or rules its own operator can't see. On the evidence here, an efficient outside observer needs memory, a way of watching structure instead of everything, and an owner for the rules it enforces. No note yet shows all three working together.