Twenty-seven percent of agent workflows have structural flaws — dead-end nodes, unreachable exits, paths that trap execution forever. Fifty-five percent violate a human-gating policy. These defects exist before a single input arrives.
Xavier, A, Jolly, and Xavier (arXiv:2603.20356) build Agentproof, a static verifier for agent workflows across four major frameworks: LangGraph, CrewAI, AutoGen, and Google ADK. The system extracts an abstract graph model from each framework's workflow definition and applies structural checks plus temporal safety policies compiled into finite automata.
The findings from 18 curated workflows are stark. Over a quarter contain topology-level defects detectable without running the workflow. Over half fail a basic safety property: the requirement that a human must approve certain actions before they execute. These are not runtime failures — they are design flaws, present in the specification, that no amount of testing on normal inputs would catch unless the test happened to exercise the flawed path.
This is the key distinction: runtime guardrails catch bad behavior when it happens. Static verification catches bad structure before anything happens. A runtime guardrail that checks for human approval only fires if the agent reaches the action. If the workflow graph has an alternative path that bypasses the guardrail node entirely, the guardrail never fires. The defect is invisible to runtime testing unless the specific input that takes the bypass path is encountered.
The performance is adequate for practical use — verification completes in under one second for graphs up to 5,000 nodes. Fifteen temporal policies fit the domain-specific language. The tool catches what runtime tools miss by operating at a different level of abstraction: not “what does the agent do with this input?” but “what could the agent possibly do with any input?”
The 55% human-gating failure rate suggests that the majority of deployed agent workflows have paths that could bypass human oversight. Not because the developers intended it, but because graph topology is not something humans review reliably by inspection.