One-sentence Summary

Researchers at Tsinghua University propose an ACID-compliant agent system framework that reinterprets classical transactional properties as Semantic Atomicity, Semantic Consistency, Semantic Isolation, and Semantic Durability, and implement a data agent realizing these guarantees through transactional exploration-execution-validation cycles, transactional skill hubs, confidence divergence-based validation, semantic dependency-aware isolation, and transaction-aware semantic state management, achieving a $10.6\%$10.6% improvement over state-of-the-art agents including Claude Code on widely used benchmarks.

Key Contributions

• The paper introduces the concept of agentic transactions and an ACID-compliant agent system framework that reinterprets classical ACID properties as Semantic Atomicity, Semantic Consistency, Semantic Isolation, and Semantic Durability.
• It develops an ACID-compliant data agent that realizes these guarantees through transactional exploration-execution-validation cycles, transactional skill hubs, confidence divergence-based validation, semantic dependency-aware isolation, and transaction-aware semantic state management.
• Experimental results on widely used benchmarks show a 10.6% improvement over state-of-the-art agents including Claude Code, and the work also outlines open research directions for extending transactional principles across the full agent lifecycle.

Introduction

Large language model agents are shifting from single-round chat toward long-horizon production tasks that require iterative reasoning, code execution, and feedback-driven refinement over repository-level workspaces. This shift creates reliability challenges because agent workflows are long-running, dynamically generated, and often involve non-transactional external resources, so partial execution can propagate semantically invalid decisions or leave inconsistent workspace states. The authors address these limitations by introducing agentic transactions and an ACID-compliant agent system framework that reinterprets database-style atomicity, consistency, isolation, and durability as semantic properties for agent execution. Their ACID-Agent system models exploration-execution-validation cycles as commit-or-retry semantic transactions, uses confidence-based validation with evidence-guided retries for semantic consistency, provides isolated and versioned workspaces for semantic isolation, and preserves validated execution traces and transaction-aware memory for semantic durability.

Method

The authors define an agentic transaction as a bounded unit of agent execution comprising a finite sequence of LLM-driven interactions between an agent and its execution environment to accomplish a task. Formally, given a tool set and a skill set, an agentic transaction $\tau = \langle r_1, \ldots, r_n \rangle$τ=⟨r1​,…,rn​⟩ comprises $n$n steps. Each step $r_i = (c_i, a_i, f_i)$ri​=(ci​,ai​,fi​) consists of an LLM context $c_i$ci​, an agent action $a_i$ai​, and the resulting feedback $f_i$fi​. The transaction commits only if its execution satisfies the required task conditions and preserves all semantic invariants.

As shown in the figure below:

This figure presents a data-agent transaction. It begins with LLM-driven exploration of datasets and schemas, followed by iterative analysis steps that invoke tools, update the workspace, and refine decisions based on feedback. Each exploration-execution-validation cycle forms a semantic transaction unit whose effects are propagated only after validation. Failed units are discarded or recovered without affecting the committed state.

To achieve reliable execution, the authors propose an ACID-compliant data agent system.

As shown in the figure below:

The system architecture is designed around four core properties: Semantic Atomicity, Semantic Consistency, Semantic Isolation, and Semantic Durability.

Semantic Atomicity The authors propose two mechanisms for semantic atomicity: an offline skill hub that embeds transactional safeguards into reusable skills, and an online staged-execution framework that enforces commit-or-retry semantics via validation gates.

• Offline Skill Hub Creation: Tools and skills become first-class transactional objects. The skill hub packages existing repositories as agent skills with standardized CLIs and validates their behavior through LLM-generated test suites. A workload- and data-aware skill router dynamically adjusts feature importance for skill retrieval.
• Online Semantic Transaction Execution: When existing skills are unavailable, the agent trajectory is modeled as a sequence of exploration-execution-validation cycles.
  • Confidence-Guided Data Exploration: The exploration sub-agent iteratively generates read-only exploration code. Observations are summarized into exploration memory. To avoid redundancy, LLM confidence-based validation compares the current exploration observation with and without previous observations. A large confidence divergence indicates heavy dependence on prior observations, triggering termination if redundant exploration exceeds a threshold.
  • Confidence-based Consistency Validation: This verifies the reliability of agent decisions and generated code by integrating execution errors, confidence divergence, and LLM-based reflection signals. Violations beyond predefined thresholds trigger a retry, discarding failed execution steps by isolating their intermediate contexts.

Semantic Consistency Data agents often exhibit execution inconsistency under workflow and model uncertainties.

As shown in the figure below:

Repeated runs show substantial variance and occasional intent violations. To address this, the authors develop complementary offline and online mechanisms.

• Offline Consistency Enhancement: Successful execution workflows are materialized into reusable agent skills with semantic validation logic. Additionally, consistency-oriented benchmarks are envisioned to measure stability and guide targeted fine-tuning.
• Online Consistency Validation: A confidence-based validation mechanism quantifies LLM confidence as the exponential of the average token-level log probability.
  • Decision Confidence Divergence: For critical decisions, the system measures confidence divergence between explored decisions and executed decisions. Low divergence indicates the executed decision lacks stronger evidence support.
  • Code Confidence Divergence: For code generation, decision-relevant code spans are identified via static analysis. Low confidence divergence between code generated with and without exploration evidence indicates insufficient grounding.

Semantic Isolation The system requires isolation over semantic dependencies among agents, contexts, workspaces, and operations.

• Agent-Level Isolation: Isolation selection is formulated as a semantic parameter tuning problem. Independent sub-agents operate on exclusive resources with fully parallel execution. Collaborative sub-agents maintain independent workspace branches and synchronize via structured context exchange. Competitive sub-agents execute in isolated virtual environments, with the final result selected from the most promising trajectory.
• Operation-Level Isolation: The skill hub enforces execution isolation through effect annotations, versioned workspaces, snapshot-based execution, and optimistic validation.

Semantic Durability

• Transaction-Aware Semantic State Management: To handle evolving semantic states that exceed context windows, the authors propose a transaction-aware evolving memory maintained as a knowledge graph. Insertion, merging, splitting, and deletion operations are performed by a specialized LLM, with training supervision derived from agent trajectories.
• Execution Tracing and Recovery: An append-only workspace records provenance information, LLM interactions, tool invocations, and versioned artifacts, enabling faithful reconstruction of execution environments and version-aware failure recovery.

Experiment

The experiments evaluate an ACID-compliant data agent on KramaBench, a benchmark with multi-step data science tasks over heterogeneous real-world files, comparing ACID-Agent against Claude Code and a DA-Agent ablation across multiple LLM backbones using task quality, efficiency, and consistency metrics. The main results show that ACID-Agent consistently improves task scores and reduces run-to-run variance, though it requires additional code steps and token consumption due to exploration and retry mechanisms. Ablations confirm that the semantic transaction unit and failed-step isolation are important, and comparisons with majority-voting Claude Code indicate the gains come from the harness design rather than increased inference budgets.

Agentic transactions extend ACID guarantees to LLM-driven workflows that combine non-deterministic reasoning with heterogeneous, potentially non-transactional effects. The proposed semantics constrain committed outcomes and recoverable effects rather than requiring deterministic execution traces. Representative techniques include commit-or-retry semantic units, confidence-based validation, dependency-aware isolation, and provenance-aware recovery. Atomicity is treated as a dependency-aware set of model invocations, tool calls, and external actions whose effects become visible only after required operations and postconditions succeed. Consistency and isolation rely on validation-based control and dependency-aware policies to handle semantically invalid interference and non-deterministic execution.

On KramaBench, ACID-Agent achieves higher overall scores than Claude Code under both tested LLM backbones, with gains in most domains. The improvement is accompanied by substantially more code steps and, for the GLM configuration, higher token use and cost, reflecting exploration and retry overhead. With the Qwen backbone, ACID-Agent improves the overall score by 10.6 percentage points and slightly surpasses Claude Code using the larger GLM backbone. ACID-Agent uses more than twice as many code steps as Claude Code in both backbone configurations. Most domain scores improve under ACID-Agent, with the largest gains in biomedical and environment, while archaeology scores remain unchanged.

In the environment domain, ACID-Agent attains a higher average score than Claude Code while also showing lower run-to-run score variability. This consistency gain is accompanied by greater execution effort, including more code steps and moderately higher token consumption and cost. ACID-Agent records a materially higher mean score and lower variance than Claude Code across three runs. The improved consistency comes with a larger number of code steps, slightly higher token use, and roughly double the cost.

In the environment domain ablation, the full ACID-Agent records the highest score among the compared variants, outperforming the ReAct-style DA-Agent and the majority-voting Claude Code baseline. Removing failed step isolation lowers the score substantially, which supports the claim that failed-state propagation can contaminate later execution. The full agent also beats the majority-voting baseline while consuming fewer tokens, suggesting the improvement comes from the agent design rather than a larger inference budget. The full ACID-Agent achieves the strongest environment-domain result and outperforms the majority-voting baseline with lower token consumption. Removing failed step isolation substantially reduces the score relative to the full agent, indicating that letting failed states update context harms subsequent execution.

The experiments evaluate ACID-Agent, which extends ACID guarantees to LLM-driven workflows, against Claude Code on KramaBench under two LLM backbones and examine consistency in the environment domain. ACID-Agent achieves higher overall and most domain scores, with lower run-to-run variability in the environment domain, though it requires more code steps and can increase token and cost overhead. An ablation shows the full agent outperforms a ReAct-style baseline and a majority-voting Claude Code baseline, and removing failed step isolation substantially reduces performance, indicating that preventing failed states from contaminating later execution is a key source of the gains rather than increased inference budget.