Routing fragility in agentic AI: classification-dependent enforcement and the case for framing invariance

Agentic LLM systems increasingly perform real-world actions via tool use, including file access, code execution, and network calls. Most current safety enforcement pipelines rely on upstream intent classification to determine whether actions are permissible. This paper identifies routing fragility, the structural condition where enforcement reliability is tightly coupled to intent classification accuracy, as an architectural vulnerability in tool-integrated systems. In this work, I demonstrate routing fragility empirically through a case study of a frontier model that refused to decrypt an encrypted archive under one prompt framing, then attempted the identical action without hesitation when the same action was recontextualized as "verification," using standard prompt engineering with no jailbreak or adversarial techniques. I propose framing invariance, the property that safety decisions remain stable under narrative reframing, as a testable evaluation metric for enforcement quality, applicable to any enforcement architecture. I further propose action normalization as a mechanism for achieving framing-invariant decisions, where proposed actions are stripped of contextual narrative and evaluated independently of user framing. While prior work has focused on architectural solutions like tool-choice restriction and guard-agent approaches, this paper concentrates on formalizing the diagnostic problem and establishing evaluation criteria that any enforcement system should satisfy. Future work will address architectural solutions that implement these criteria.