User Alignment Critic

What the User Alignment Critic does

The User Alignment Critic is a control point inside an agent workflow, not a general-purpose evaluator of every signal the planner has seen. It receives the proposed action and checks whether that action still matches the user’s stated goal, which helps stop the planner from drifting into an unhelpful or unintended step.

Because it works from metadata rather than the untrusted page content that shaped the plan, the critic acts as an isolation boundary. That design matters most when the planner has been exposed to content that could steer behaviour indirectly, since the critic can reject a step without having to trust the same source material.

How the critic is used in an agent loop

In practice, the critic sits between planning and execution. The planner proposes what to do next, the critic reviews that proposal against the user’s objective, and the system then either proceeds, blocks the step, or sends the planner back for revision.

This pattern is useful because it separates goal checking from content consumption. The planner may be influenced by retrieved text, prior context, or tool output, but the critic’s job is narrower: it checks alignment, not truthfulness, provenance, or factual correctness.

That distinction is important in agent design. A step can be perfectly aligned with the user’s goal and still be based on bad information, which means alignment review is a guardrail rather than a full safety or verification layer.

What the critic can and cannot decide

The critic is strongest when the decision is about intent, scope, and whether a proposed action remains inside the user’s request. It is useful for catching actions that are technically plausible but no longer serve the goal, or that expand the task in ways the user did not authorize.

Its limit is just as important. A User Alignment Critic does not establish where the proposal came from, whether the underlying information is reliable, or whether the action should be trusted because of provenance. That means it can reduce goal drift without solving source integrity problems.

So the critic should be understood as a semantic filter for action intent, not as a content validator. If the surrounding system needs provenance checks, tool trust checks, or content authentication, those must be handled separately.

Why the isolation boundary matters

The design value of this pattern is that it reduces the chance that untrusted content directly controls execution. By reviewing metadata and the proposed action rather than the triggering page text, the critic creates a narrower trust surface and gives the system a chance to interrupt bad planning before execution.

That separation also makes the control more predictable. Instead of asking a single model to both absorb untrusted context and judge whether to act, the architecture splits those concerns so the review step can stay focused on user intent.

In agent systems, that kind of separation is often more useful than adding more verbosity to the planner itself. The critic does not need to be omniscient; it only needs enough structure to decide whether the next step still belongs to the user’s objective.

Risk and Threat Considerations

The main risk is false confidence. A User Alignment Critic can stop goal drift, but it cannot prove that the proposed action came from trustworthy evidence, so a malicious or misleading source can still influence what the planner asks the critic to approve.

Failure mechanism: The planner is steered by untrusted content or poisoned context, then presents an action that appears aligned at the metadata level even though the underlying reasoning is compromised.

Impact: The system may approve an action that is aligned in form but unsafe in substance, allowing erroneous execution, policy bypass, or hidden manipulation of the agent’s next step.

Practitioner Guidance

What to watch for: Treat the User Alignment Critic as one control in a layered review chain, not as a substitute for provenance, tool authorization, or output validation. Its value is highest when the action decision can be cleanly separated from the source material that produced the plan.

Practitioner takeaway: Use the critic to answer, “Does this step still serve the user’s goal?”, then use separate controls to answer, “Should we trust the information behind it?”

Related resources from NHI Mgmt Group

• User-System-Alignment
• When do service accounts become a higher risk than ordinary user accounts?
• How should security teams govern infrastructure identities alongside user identities?
• What is the difference between managing user accounts and managing NHIs?