When Can the Runtime Take Over? A Decision-Level Audit of LLM Agent Control

LLM agents divide control between models and software runtimes, but runtime executability alone does not justify replacing a model-mediated decision. Continued model mediation can add inference work, whereas premature runtime takeover can violate unresolved behavioral obligations. We introduce Control Substitution Audit (CSA), a decision-level protocol for evaluating whether a specified runtime policy can replace an attributed model contribution under fixed boundary-visible information and a behavioral contract. CSA connects attribution of the reference model’s contribution to direct runtime intervention and executed contract checking, while reporting policy coverage and downstream outcomes separately. In six selected edit conditions executed in Writer, accepted perturbation replays support model-to-commit attribution, and all six matched direct runtime substitutions satisfy their exact contracts. On a separate controlled set, broader deterministic support increases direct-action coverage from 4/22 to 15/22 and reduces recorded proposal-model tokens by 47.1%, but introduces one direct contract violation; execution completion remains 21/24 in both policy arms. These results characterize takeover as policy- and condition-relative: reduced model work or completed execution alone does not establish valid substitution.