From Circuits to Policies: A Review and Taxonomy of Decision Making and Strategy Selection in LLMs and LLM Agents

Abstract

Large language models and the agents built on them can reach the same outcome through different internal computations, reasoning trajectories, and system-level policies. Existing reviews typically treat mechanistic interpretability, reasoning, agent architectures, and safety separately, leaving no common framework for analyzing how a system represents alternatives, evaluates them, commits to one, executes it, and revises that choice. This article presents a structured review and a faceted taxonomy of decision making and strategy selection in LLMs and LLM-based agents. The framework separates system locus—model, harness, or their tested interaction—from temporal scope—a single forward pass or call, a reasoning episode, or an agent trajectory—and decomposes decision making into six functional stages from state representation to update or termination. Five claim-specific evidential relations distinguish behavioral observation, representation decoding, causal influence, controlled manipulation, and mechanistic explanation, while robustness is assessed separately across prompts, tasks, models, harness configurations, and independent replication. Across the literature, evidence is strongest for local mechanisms within individual model calls and substantially weaker for persistent strategies across agent trajectories. The central unresolved gap is cross-scope continuity: few studies follow the same decision variable from internal representation through commitment, executed action, and subsequent feedback. A July 2026 agent-security incident is used to illustrate how the framework converts observed coordination and constraint circumvention into testable causal hypotheses.

1. Introduction

LLMs are usually evaluated by their outputs, yet an output does not uniquely identify the computation or policy that produced it. The same correct answer may be produced by parametric retrieval [1], by a collection of shallow heuristics rather than an algorithm [2,3], by a procedure that genuinely unfolds over several steps, or by a rationalization written after the decisive computation has already fixed the answer [4,5,6]. Likewise, a successful agent trajectory can be produced by the internal state of the model, by the surrounding harness, or by an interaction between the two [7,8]. The scientific target of this article is therefore not behavior alone, but the selection process that narrows the possible computations, answers, tools, or actions.

This target has become more important as language models have moved from single-turn prediction to extended reasoning and to action mediated by tools [9,10]. Within one call, a transformer may reconcile parametric and contextual knowledge [11], route information through attention and MLP pathways reused across tasks [12,13], and convert a latent preference into a token. During reasoning, the same model may generate alternatives, encode the outcome before the trace has finished [14,15], commit earlier than the visible trace suggests [5], verify intermediate work, or justify after the fact [4]. In an agent, repeated calls are embedded in memory, retrieval, tool schemas, access controls, verifiers, and retry policies [8,16,17]. The effective decision maker is therefore neither a single neuron nor an unqualified “LLM agent”, but a coupled process spanning several loci and time spans.

This coupling leads to the central claim of the article, which we defend in Section 10. Interpretability research has become good at finding mechanisms inside a single model call, but it has not connected those mechanisms to what an agent does over a long task. Two gaps make this concrete. No study we examined takes one decision variable, such as the choice of a tool, and follows it from an internal component to the moment of commitment in a reasoning trace, to the action finally executed. And no mechanism found at the agent level has been shown to hold when the surrounding harness is changed. The rest of the article is built around these gaps: the taxonomy gives us the vocabulary to state them precisely, the scope-specific sections show how much evidence exists on either side of them, and the case study in Section 9 shows what such evidence would have been worth in a setting where it was missing.

1.1. Motivation: Behavior Is Not Decision Making

Behavioral evaluation tells us what a model did. It does not tell us what the alternatives were, what inside the model favored one of them, when the choice became fixed, or whether an intervention could change it. Those are the questions that claims about faithfulness, reliability, and control actually depend on, and behavioral tests miss them precisely where it matters most: unfaithful reasoning is hardest to detect on the answers a model gets wrong [6,18].

Three mistakes follow from ignoring this distinction, and they shape how we organize the article. The first is to treat information that can be read out as information the model uses. A probe may recover a goal the later computation ignores, and a subspace intervention may work through a path that carries no effect [5,19]; an agent can likewise represent that a tool is needed and still not call it [20]. The second is to treat a component that matters as the mechanism. Ablating a head can change an output without showing that the head implements the decision rule, and which circuit is recovered depends on the patching variant, the inputs, and the granularity of evaluation [21,22,23,24]. The third is to credit the model with what the surrounding system did. The harness shifts the beliefs an agent acts on [7], tool availability alone changes measured performance [17], and an attacker who edits a tool description can redirect the chosen action without touching the model at all [25]. Avoiding all three requires keeping three things apart: where a decision happens, which part of deciding is meant, and how strong the evidence is.

1.2. Relation to Prior Surveys

This subsection sets out why no existing family of reviews offers a vocabulary spanning system locus and temporal scope while grading the evidence behind each claim. Prior synthesis work falls into five families, summarized in Table 1, grouped by what each takes as its unit of organization, because that choice determines which comparisons a review can support.

Table 1. Comparison of prior review families and their coverage.

Family	Unit of Organization	Loci Covered	Evidence It Reaches	Out of Scope
Mechanistic interpretability [26,27,28,29,30,31]	Method and level of description within one forward pass	Component	Probing and causal localization, up to mediated explanation	Extended policy; the harness; how a component result predicts a trajectory
Reasoning and computation at inference time [9,10,32,33,34,35,36,37]	Algorithm, training recipe, and inference procedure	Trace, occasionally component	Behavioral comparison, sometimes probing or ablation	Whether a decoded state is used; when commitment occurs; grading of evidence
Agents, planning, and orchestration [8,16,38,39,40,41,42,43]	Architecture and system component	Trajectory, harness	Task success and ablation of system parts	Attribution between model and harness; internal state of the agent
Strategic and multi agent reasoning [44,45]	Game, role, and strategic construct	Trajectory	Observed play and outcome statistics	Whether a policy is represented internally and causally used
Safety, security, and transparency [46,47,48,49,50]	Threat model and governance concern	Harness, trajectory	Attack success and defense coverage	Why an action was selected; internal mechanism of the failure
This article	System locus, temporal scope, functional stage, evidential relation, and robustness profile	Model, harness, and their tested interaction across calls, episodes, and trajectories	Behavioral, representational, causal, control, and mechanistic relations	Prevalence estimates; new empirical results

1.2.1. Review Scope and Literature Collection

This review is based on a structured, non-systematic synthesis of the literature on decision making and strategy selection in LLMs and LLM-based agents. Searches covered major publication venues and repositories, including ACL Anthology, OpenReview, arXiv, NeurIPS, ICLR, AAAI, ACM, IEEE, Springer, and Elsevier, and they were complemented by backward and forward citation chaining. Studies were included when they provided empirical or conceptual evidence about how a model or agent represents decision-relevant state, evaluates alternatives, selects or commits to an action or strategy, executes it, or updates subsequent behavior. The review aims to capture the main methodological families and representative findings rather than provide the completeness guarantee of a systematic review.

1.2.2. Added Value Beyond Classification

The taxonomy does more than group papers by topic. It limits the conclusion licensed by a result and identifies the next discriminating experiment. For example, a probe of tool identity within one model call establishes a model-side representation but not a persistent tool-use policy, while a tool-schema ablation establishes a harness effect but not an internal strategy change. The representative examples in Table 2 show how the facets expose these different conclusions and their missing evidential links.

Table 2. Representative applications of the decision-making taxonomy.

Example	System/Scope	Decision Function	Evidence	What Can Be Concluded
IOI circuit	$S_M/T_1$	Represent, evaluate, select, read out	C2+C4; limited $R_P$	A localized pathway mediates much of a controlled name-selection behavior.
Function vectors	$S_M/T_1$	Represent task; condition generation	C1+C3	A transferable activation state encodes and can steer a task operation.
Trace-faithfulness tests	$S_M/T_2$	Commit and read out	C0–C2, claim-dependent	A visible rationale can diverge from, or causally contribute to, answer formation.
Reflexion	$S_H/S_C$ at $T_3$	Evaluate, update, stop	C0+C2	Harness-provided feedback changes later actions and task success.

1.3. Research Questions

This subsection states the five questions that organize the article. The three gaps identified in Table 1 are the absence of a common frame across loci, the conflation of a claim with the strength of its support, and the missing attribution between model and harness. They translate into five questions.

• Where in the model–agent system is a decision variable represented and transformed?
• Which stage of the decision cycle does a study explain?
• What evidential relation supports the claimed representation or mechanism?
• Which findings generalize across tasks, prompts, models, seeds, and system configurations?
• How can component-level explanations predict reasoning- and trajectory-level policy?

Questions one to three fix the coordinates along which we read every study using the facets introduced in Section 2. Questions four and five are the two claims that the current literature is least equipped to support, and they return as the open problems of Section 10.

2. Conceptual Framework and Faceted Taxonomy

Answering the questions from Section 1 needs three things: a definition of a decision, a way to locate it, and a way to characterize the evidence for it. We define a decision and a strategy first. We then introduce independent facets for system locus, temporal scope, functional stage, evidential relation, and robustness. A claim about one head and a claim about a harness verifier can differ in system locus while operating over the same temporal scope; conversely, model-internal computation recurs within a single call, a reasoning episode, and an agent trajectory. This separation makes the review families in Table 1 comparable and turns gaps in the literature into visible empty combinations.

2.1. What Counts as a Decision?

This subsection defines the four elements a decision claim must specify before it can be located within the facets. We call a decision any transition that changes or narrows the distribution over future outputs or actions [51]. Four elements make such a claim meaningful: a choice set of at least two candidates, clearest when a fact stored in the parameters competes with one supplied in context [11,52]; a state that carries the choice, whether an activation direction, a set of heads, a token, or a memory record; a temporal boundary after which the outcome is fixed, often earlier than the visible trace suggests [4,5,53]; and a consequence for what the system emits or does.

A causal claim requires more than observation, for example, manipulation by patching [21], steering with specificity controls [54,55], or a causal variable validated against a hypothesized abstraction [29,56]. Two cautions apply: replication across models and prompts is not automatic [57,58], and changing the output does not identify the pathway the change traveled through.

This operational definition is compatible with traditional decision theory, which represents choices through actions, states of the world, consequences, preferences or utilities, and beliefs under uncertainty. Those constructs specify what a behaviorally rational choice would be; this review asks the complementary question of how an LLM-agent system represents and implements the choice. Behavioral work has tested whether GPT exhibits economic rationality [59]; personalized decision modeling combines utility optimization with textualized-symbolic reasoning [60]; and DecisionFlow constructs actions, attributes, constraints, and a latent utility function before selection [61]. These studies connect outcome-level choice with the internal mechanisms emphasized here.

2.2. What Counts as a Strategy?

This subsection argues that a strategy claim requires evidence of routing between procedures, not merely of behavioral variety. We call a strategy a temporally extended, condition-sensitive procedure or policy used to pursue an objective, close to how the term is used for goal directedness [62].

Several things reported as strategies fail this test: a surface reasoning style is a property of the trace, a single feature is a state rather than a procedure, a prompt format is an input intervention, and a single action is at best an outcome. Systems can also look procedural while implementing something else: apparent arithmetic algorithms can decompose into collections of narrow heuristics [2], surface heuristics can override represented constraints [63], and visible backtracking can be causally reduced without materially changing answer accuracy [64].

Evidence for strategy selection must show routing, not variety: latent procedures that recur and can be told apart internally [65], task dependent switching that can be controlled [66,67], or learning dynamics by which a procedure is installed and obstructed [68]. At the agent locus, goal directedness must be evaluated rather than assumed [62]; goal drift counts only when visible internally before it appears in behavior [69]; and strategic play licenses a policy claim only when tied to something internal [70,71]. A strategy attributed to the model may instead belong to the harness [7] or the orchestration regime [42]. Separating these cases is the task of the system-locus facet.

2.3. Facet S: System Locus

System locus identifies where causal responsibility resides, independently of duration.

Model locus ($S_M$). The decision-relevant computation is attributed to weights, activations, neurons, sparse features, attention heads, MLPs, residual-stream directions, or decoding within the language model [12].

Harness locus ($S_H$). The decision is made or constrained by software around the model: context construction, retrieval, memory, available actions, permissions, verifiers, retry logic, stopping rules, and safety controls [8].

Coupled locus ($S_C$). The effect depends on an interaction between model state and harness configuration. This label is used when a factorial or mediation design tests both sides rather than attributing unexplained behavior to the coupled system by default.

2.4. Facet T: Temporal Scope

Temporal scope identifies how much computation the claim follows.

Forward pass or single call ($T_1$). The claim concerns computation within one model invocation. These claims are often the easiest to intervene on and the hardest to connect to anything outside that call.

Reasoning episode ($T_2$). Candidates appear, one is committed to, intermediate work is verified or abandoned, and the trace terminates. Commitment can occur before the visible text suggests, so the trace that is read is not always the trace that decided [4].

Agent trajectory ($T_3$). The decision spans repeated calls in an environment: goals are maintained or drift, beliefs update, tools are selected, and actions are corrected. Whether an agent is pursuing a goal at all must be established rather than assumed [62].

The two facets can be crossed. A model-internal state may be measured at $T_1$ or reconstructed repeatedly at $T_3$, while a harness verifier may act once during $T_2$ or repeatedly across $T_3$.

2.5. Facet B: Functional Stage

This subsection defines the six stages into which the decision cycle is decomposed. System locus and temporal scope tell us where and over how much computation a decision is studied; stage tells us which part of it a study explains. Most claims address one stage while implying, untested, that the others behave in a particular way.

State representation. What the system currently believes about the goal, the task, and its own progress, as when belief states are learned explicitly rather than assumed from behavior [72].

Option generation. The candidates put forward before any of them is chosen, made explicit when a method generates and holds open several partial solutions at once [73].

Evaluation. How candidates are scored for correctness, risk, or progress, for instance, when a model’s hidden state predicts whether its own answer will turn out right before that answer is checked [15].

Selection and commitment. The point at which one candidate stops competing with the others, which studies show can occur earlier than the point at which the model starts to explain itself [5].

Execution and readout. Turning the committed state into an output or an action, including the control that keeps an agent’s later actions consistent with what it committed to [74].

Update or termination. Revising, correcting, abstaining, or stopping, as when a model is taught to step back from a line of reasoning it has already started [75].

The stages are functional roles, not assumed chronological modules. They may overlap, recur, run concurrently, or be implemented jointly by the same components, and nothing in the framework requires a transformer to traverse them in order; whether they are separable at all is one of the open problems of Section 10. A study that reports success at one stage, for example, accurate evaluation, is silent by default on every other stage; treating the six as a package rather than as six separable claims is a form of the first inference error of Section 1.

2.6. Facet C: Evidential Relation

Facet C distinguishes the relation established between an observed variable or mechanism and a decision. The labels are claim-specific rather than a strict total ordering.

• C0, behavioral observation. The decision is inferred from outputs, actions, tool calls, or trajectory changes. This shows what the system selected, but not why.
• C1, decision-relevant representation. Probes, lenses, representation analysis, or sparse features reveal information associated with the decision [14]. Decodability shows that information is available internally, but not that it causally determines the choice.
• C2, causal influence. Ablation, activation patching, causal tracing, or related interventions test whether a state or component influences the selected outcome [21]. Such effects must be distinguished from general capability degradation or intervention artifacts.
• C3, controlled manipulation. Steering, representation editing, or targeted interventions predictably alter the selected action or strategy [54]. This demonstrates controllability, but the manipulated direction need not be the natural mechanism used by the model.
• C4, mechanistic explanation. Mediation, necessity–sufficiency tests, causal variables, or validated circuits explain how decision-relevant information contributes to the pathway from state to action [56].

C0–C2 often provide increasing causal specificity for the same claim, but successful C3 steering does not by itself establish the natural mechanism required for C4. A study may therefore receive more than one label, such as C1+C3, without implying that every intermediate relation has been established.

2.7. Robustness Profile

Robustness is treated separately because causal specificity and generalizability are different properties. The dimensions are reported independently:

• $R_P$: Prompts, samples, or seeds.
• $R_T$: Tasks or task variants.
• $R_M$: Models, scales, or architectures [57].
• $R_H$: Harness configurations.
• $R_I$: Independent replication or external validation.

Any combination may be reported, and independent replication on one model does not imply task or model transfer. Thus, Facet C asks what has been established about the role of a variable in producing a decision, whereas the robustness profile states under which tested changes that relation remains valid.

2.8. Detailed Taxonomy Map

Figure 1 combines the facets into a single map of methods for studying decision making. Facets S and T identify system locus and temporal scope. Facet B identifies which function is being studied, including state representation, option generation, evaluation, commitment, execution, and subsequent correction or termination. Facet C specifies what relation to the decision the applied method can establish, while the robustness profile records the conditions under which that relation generalizes.

Figure 1. Detailed taxonomy of decision making in LLM-agent systems. The method-level map separates system locus ($S_M$, $S_H$, or tested interaction $S_C$) from temporal scope ($T_1$–$T_3$); C0–C4 are claim-specific evidential relations and robustness is reported as a non-ordinal profile.

The facets are complementary rather than hierarchical. A decision can therefore be characterized by asking: where does it occur, over what scope, which decision function is involved, and what method can establish its role? For example, decoding a long-horizon strategy at trajectory scope establishes that the strategy is represented, whereas demonstrating that it causally determines later actions requires intervention. Likewise, identifying a causal circuit within one forward pass does not by itself establish that the same mechanism explains an agent’s policy across multiple steps.

2.9. Applying the Taxonomy to Representative Studies

The facets are intended to be used together. Table 2 illustrates this with representative studies spanning model-internal computation, reasoning traces, and agent trajectories. The examples show that similar behaviors support different conclusions depending on system locus, temporal scope, decision function, and evidential relation. For example, activation patching in the IOI task can localize components that causally influence a controlled selection [12], whereas function vectors identify transferable internal states that can steer task behavior [76]. Trace-faithfulness studies instead examine whether visible reasoning corresponds to answer-forming computation, while Reflexion demonstrates how harness-provided feedback changes subsequent actions across an agent trajectory [77].

3. Methods for Investigating Decision Making

3.1. Review Scope and Literature Selection

This structured, non-systematic review covers the literature published from 2019 to 2026 in five topic areas: mechanistic interpretability; reasoning and strategy selection; agent planning and action; harness and orchestration; and decision-theoretic, safety, and security studies. Sources included ACL Anthology, NeurIPS proceedings, OpenReview for ICLR and related conferences, AAAI proceedings, ACM Digital Library, IEEE Xplore, SpringerLink, Elsevier ScienceDirect, the Proceedings of the National Academy of Sciences, and arXiv, supplemented by backward and forward citation chaining.

Searches paired LLM-related terms with topic terms such as circuits, activation patching, steering, strategy selection, chain-of-thought faithfulness, planning, tool choice, memory, verifiers, deception, confidence, and abstention. Titles and abstracts were screened for direct relevance to at least one decision stage, and full texts were retained when they provided empirical evidence, a method for identifying or manipulating a decision-relevant variable, or a conceptual synthesis needed for comparison. Studies concerned only with downstream performance were excluded when they made no claim about a decision process, policy, or attribution.

3.2. Methods and Evidential Relations

Different methods provide different levels of access to how an LLM or agent reaches a decision. Diagnostic methods reveal decision-relevant representations; causal interventions identify states or components that influence a choice; circuit-level approaches seek the computational pathway implementing it; and steering methods test whether a decision can be predictably redirected. These method families correspond broadly to the evidential relations introduced in Facet C.

3.3. Diagnostic Decoding: What the Model Represents

Diagnostic methods ask whether decision-relevant information is encoded in the model’s internal state. Linear and nonlinear probes, logit and tuned lenses, representational-similarity analysis, task or function vectors, and sparse representations have been used to recover variables such as task state, confidence, candidate responses, or strategy-related information.

Sparse autoencoders (SAEs) provide a particularly useful representation by decomposing activations into more interpretable features. SAE-derived features have enabled finer analysis of behaviors such as indirect-object identification [78], although their effectiveness depends on factors including layer, dictionary width, and pooling strategy, and transfer across models remains limited [79]. Function vectors similarly identify activation patterns associated with a task and can transfer the corresponding behavior when injected into another context [76]. Related approaches extend this idea to multi-step reasoning, where internal trajectories can reveal different stages or strategies [80].

The principal limitation of diagnostic decoding is that representation does not imply use. A variable may be recoverable from an activation without participating in the computation that determines the final choice. Diagnostic methods therefore provide candidate decision variables that require causal testing.

3.4. Causal Localization: What Influences the Decision

Causal localization asks whether a candidate state, feature, or component contributes to the resulting decision. Ablation, activation patching, path patching, causal tracing, and component gating intervene on internal computation and measure the resulting change in behavior.

The interpretation of such interventions depends strongly on experimental design. Results can vary with the corruption baseline, intervention distribution, metric, granularity, and redundancy of the underlying computation [21]. For example, an intervention may produce the expected behavioral change while acting through a dormant or unintended pathway [19]. Likewise, examining components individually can miss decisions implemented jointly across multiple heads or neurons [81]. Intervening only in activation space may also misidentify a component that merely aggregates information originating elsewhere, motivating complementary parameter-space interventions [82].

Causal localization therefore establishes that a component or representation matters for a decision, but additional evidence is needed to determine whether it implements the decision variable or mechanism itself.

3.5. Circuit and Causal-Variable Discovery: How the Decision Is Implemented

Circuit discovery moves from identifying influential components to reconstructing the computational pathway that produces a decision. A circuit is typically represented as a sparse subgraph of features, neurons, attention heads, or interactions, whereas causal-variable approaches seek correspondence between internal states and higher-level variables such as alternatives, evaluations, or commitments.

Automated approaches increasingly make such analysis tractable. Attribution-based methods can extract information-flow graphs from a forward pass [83]; contextual decomposition provides a more efficient alternative to repeated patching [84]; and sparse feature circuits replace polysemantic components with more interpretable feature-level representations [85]. Automated neuron- and agent-level pipelines further reduce the amount of manual feature search required [86,87].

However, the appropriate unit of mechanism is not always obvious. Individual attention heads can contain several distinct computational functions [88], while different sparse circuits may implement the same behavior [89]. A discovered circuit should therefore not be treated as an explanation merely because it predicts or reproduces behavior. Strong mechanistic claims require tests of faithfulness, necessity, sufficiency, completeness, and stability relative to the intact model [12,90].

3.6. Control and Steering: How Decisions Can Be Changed

Steering methods test whether an identified representation can be manipulated to alter a decision in a predictable direction. Activation addition, representation editing, feature steering, and related interventions therefore provide a stronger test of decision relevance than passive decoding alone.

Activation engineering showed that contrastively derived directions can shift model behavior at inference time without modifying model weights [91]. More recent approaches improve the interpretability and specificity of these interventions. SAE-based steering operates on interpretable features rather than opaque activation directions [92]; angular steering controls behavior through rotations within a low-dimensional activation subspace [93]; and context-dependent steering fields address the limitation that a fixed direction may become misaligned across different inputs [94].

Steering can also reveal decision-relevant structure across reasoning tasks. Internal interventions can induce reasoning behaviors without explicit natural-language instructions [95], transfer reasoning-related directions across languages [96], and transfer safety-related interventions between models [97].

A successful steering intervention nevertheless does not prove that the manipulated direction is the model’s natural decision mechanism. A useful intervention may combine several endogenous processes. Strong evidence therefore requires specificity, bidirectionality, dose-response behavior, and preservation of unrelated capabilities.

3.7. Validity and Robustness of Decision-Level Evidence

Methods for studying decision making are vulnerable to several confounds. Diagnostic results may reflect lexical or positional leakage; causal interventions may introduce out-of-distribution states or general capability degradation; and discovered circuits may capture only one of several equivalent pathways. Appropriate controls therefore depend on the type of claim being made.

Useful controls include random-label or random-direction baselines, lexical and positional controls, matched behavioral conditions, counterfactual inputs, no-op and off-target interventions, dose-response tests, multiple seeds, held-out tasks, cross-model evaluation, and independent replication. Circuit stability across inputs is itself informative because unstable mechanisms often fail to generalize [24]. Explicit hypothesis testing has further shown that candidate circuits can fail formal faithfulness criteria even when they appear intuitively plausible [22]. Conversely, mechanistic analyses can sometimes support stronger guarantees, including formal performance bounds that transfer across seeds [98].

These controls are particularly important because no single method is sufficient for understanding a decision. Decoding identifies candidate variables, causal localization tests whether they matter, steering tests controllability, and circuit or mediation analysis seeks the mechanism connecting state to action. Combining these forms of evidence provides a stronger basis for explaining decision making than any individual technique in isolation.

4. Decisions Within a Model Call

A single model call provides the most direct access to the internal computations underlying a decision. Open-weight models allow decision-relevant states to be decoded, localized, intervened on, and traced across layers and components. Evidence at this level therefore addresses how candidate information is represented, how alternatives are routed or evaluated, where selection occurs, and whether the selected value is successfully propagated to the output.

The literature reviewed in this section supports three recurring distinctions. First, multiple candidate states can coexist before one becomes dominant. Second, the components that represent information are not necessarily the same components that determine its use. Third, failures can arise at different stages of the decision process: the correct information may be represented internally yet fail during evaluation, selection, or readout.

4.1. State and Candidate Representations (B1)

Internal activations can encode several variables relevant to a later decision, including task identity, candidate answers, factual associations, confidence, intermediate variables, and action-related information. Diagnostic probes, representation analysis, sparse features, and related methods therefore provide evidence about which decision-relevant variables are available inside the model before a choice becomes visible.

A central limitation is that representation does not imply use. A candidate may be strongly decodable from the residual stream while having little causal influence on the final output. Conversely, several candidate states may coexist until later computation determines which one is routed toward selection. This distinction between represented information and decision-driving information becomes important in the later stages of the within-call process, particularly in cases where the correct value remains internally recoverable even when the model emits an incorrect answer.

4.2. Option Generation and Factual Retrieval (B2)

The strongest available evidence indicates that candidate facts coexist in a distributed state and that context determines which becomes reachable. Factual-conflict tasks supply a controlled choice set: the model can copy a contextual statement, retrieve a contradictory parametric fact, or emit some other continuation. Yu et al. quantified the phenomenon on world-capital queries, measuring how often a counterfactual prefix overrides pretraining knowledge and linking that rate to training frequency and to attention-head contributions to copying versus recall [1]. Ortu et al. sharpened this into the “competition of mechanisms” account, tracing the factual and counterfactual pathways separately in GPT-2 and attributing the outcome to a small number of heads [52].

Three independent replications followed. Dotsinski et al. test generalizability beyond the original setting [57], Wiegman et al. reproduce the experiments with softmax-normalized logits and extended controls [58], and Campregher et al. reconcile these with the negative-head literature, finding that what was described as factual competition is in substantial part a copying mechanism [99]. The competition between information sources therefore survives replication, whereas the proposed inventory of fixed “factual” and “counterfactual” heads does not. The more robust conclusion is that contextual and parametric information compete during retrieval and routing, while the specific components implementing that competition vary across models and experimental settings.

More recent work moves from which heads win to how the candidate set is formed. Wang et al. decompose factual recall into subject augmentation, object retrieval and reranking, and conclusion fusion, and they find failures concentrated in reranking: models do not lack the knowledge but fail to select among what they retrieve [100]. Zhao et al. model retrieved context and parametric memory as an entity flow with an inference-time entity-aware probe [11], and Gekhman et al. show that reasoning tokens expand recall even on single-hop questions, through a content-independent buffer effect and through factual priming [101]. The defensible synthesis is that candidate facts coexist in a distributed state, and that context, reasoning tokens, and attention routing change which candidate becomes reachable rather than which facts are stored.

4.3. Evaluation and Component Routing (B3)

Across the studies reviewed here, head roles are context-conditioned and are better specified as communication operations than as labels. Vig and Belinkov cataloged how heads differ in positional, syntactic, and long-range behavior [102], but attention weight is not causal importance, and newer methods are built around that gap. Causal head gating classifies each head as facilitating, interfering with, or irrelevant to a target behavior, a classification no descriptive catalog can produce because interference is invisible in attention weights [103]. Ma et al. resolve head roles per reasoning step rather than per task [104], and Basile et al. show that editing a small set of concept-ranked heads changes behavior in text and vision-language models [105].

The strongest conceptual advance is to specify a communication operation instead of labeling components. Franco and Crovella identify attention-causal communication: low-dimensional features written into one token, read from another, with a demonstrable causal relationship to the attention pattern [106]. That is a B3 claim at C4 rather than C2, because it names what is transmitted rather than which unit matters. Head roles remain context-conditioned: a polysemantic component can change function through interaction with the residual stream, and a gate learned on one distribution may suppress several overlapping computations at once.

4.4. Selection and Task-Specific Circuits (B4)

Within a forward pass, selection can often be localized to relatively sparse computational pathways in constrained tasks. The IOI circuit in GPT-2 Small, for example, decomposes name selection into interacting name-mover, inhibition, induction, and supporting heads whose causal roles were tested through patching and ablation [12]. Related studies find comparable sparse mechanisms in syllogistic reasoning and show that components involved in IOI can be reused in other tasks [13,107]. However, component reuse does not imply that the same decision algorithm is implemented across tasks.

Arithmetic studies provide complementary evidence that selection can emerge progressively. Models may recognize the task in earlier layers while the selected result forms only later [108]. Digit-specific circuits, heuristic neurons, and partial-sum representations suggest that intermediate variables contribute to the final choice through both shared and format-dependent computations [109,110,111,112]. Steering such representations toward particular outcomes further shows that some identified states can influence selection rather than merely correlate with it [110].

Similar circuit-level analyses have been reported for propositional logic, relevance judgments, and emotion inference [113,114,115]. Across these domains, the strongest evidence arises when a candidate decision variable is localized, causally manipulated, and traced to the resulting output. By contrast, showing that removal of a sparse component set reduces performance is insufficient to establish a unique selection mechanism, because redundant or alternative pathways may implement the same behavior [89].

Overall, current evidence supports the existence of localized and causally relevant selection mechanisms for controlled tasks, but not a universal set of components or circuits for decision selection. The recovered mechanisms remain dependent on task structure, input format, model architecture, and the level at which the computation is analyzed.

4.5. Execution and Readout Failures (B5)

This subsection examines the cleanest dissociation we found between representation and decision: a model can hold the required value and still fail to emit it. Karim et al. study procedural hallucination in long-context binding tasks with a known single-token answer set, decomposing failures into gating errors, where the model does not enter answer mode, and binding errors, where it does but selects the wrong candidate under recency bias. Binding errors dominate the hard regime, and on those trials a linear probe on the final-layer residual stream recovers the correct value at 74% against a 2% baseline on Qwen2.5-3B: the answer is present and unused. An oracle intervention that restates the binding near the query nearly eliminates the failure [116]. Bhatt et al. find the same separation across languages, with highly similar activations on aligned mMMLU items even where the emitted choices diverge [117]. Zhang et al. show that late readout rests on distributed earlier computation: Shapley-based layer attribution identifies cornerstone layers whose removal collapses performance to chance, while other layers can be removed with marginal effect [118]. The consequence is direct: adding retrieval will not repair a routing deficit, and strengthening a readout pathway can raise a benchmark score without improving the computation underneath it.

4.6. Synthesis and Limitations

Across the reviewed studies, three conclusions receive comparatively consistent support. First, multiple candidate representations can coexist before selection. Second, relatively sparse components can exert causal influence over controlled choices. Third, representation, routing, and readout are empirically separable: a model may internally encode the correct information while failing to select or emit it.

What does not generalize as clearly is the identity of the underlying components. Head, neuron, and circuit assignments often depend on task, prompt format, model architecture, and intervention method. Evidence also remains concentrated in open-weight models and relatively constrained tasks. Establishing whether within-call mechanisms persist across reasoning episodes and agent trajectories therefore remains a central challenge.

5. Strategy Selection Across Reasoning Traces

Reasoning traces extend decision making across multiple generated tokens. Unlike a single forward pass, earlier outputs become part of the context and can influence later computation. A visible chain may therefore serve as a computational workspace, expose part of a latent process, or merely verbalize a decision that has already been formed internally. Understanding reasoning-level decision making requires separating these possibilities.

5.1. Latent Reasoning State (B1)

Reasoning is not restricted to visible natural-language tokens. Intermediate computation can be represented in latent activations, continuous thought states, or compressed internal vectors, and several approaches explicitly move reasoning from token space into latent space [119,120,121,122]. This demonstrates that a visible chain of thought cannot be assumed to contain the full computation responsible for an answer.

Interpretability studies provide complementary evidence. Sparse features and latent directions have been associated with uncertainty, exploration, reflection, and reasoning progress, and manipulating these representations can alter reasoning behavior [123,124]. Latent vectors can also encode compressed information about reasoning steps, with early states sometimes having disproportionate influence on later outcomes [125,126]. These findings support the existence of decision-relevant latent reasoning state, although the identified representations remain task- and model-dependent.

5.2. Commitment Dynamics (B4)

A central question is when a model commits to an answer or strategy. Several studies show that final outcomes can be predicted from internal representations before the visible reasoning has finished, and in some settings even before it begins [14,127,128].

More direct evidence comes from interventions on pre-answer representations. Cox et al. identify a residual-stream direction that predicts the final answer before chain-of-thought generation and show that steering this direction can flip the resulting choice [4]. Related work finds trajectories that become committed to an incorrect answer before explicit answer text is emitted [129]. Hidden-state analyses further suggest that reasoning can undergo abrupt transitions toward productive or unproductive states [130,131].

However, early decodability should not be equated with irreversible commitment. Interventions are most effective while alternative trajectories remain accessible [132]. Commitment is therefore better understood as increasing stability of a selected state under plausible continuation or intervention, rather than simply the first point at which the answer becomes decodable.

5.3. Strategy Repertoires and Routing (B2–B4)

Reasoning models may rely on multiple procedures rather than a single fixed algorithm. Arithmetic provides evidence for mixtures of heuristic, retrieval-based, and more explicit reasoning strategies whose relative contribution depends on task, scale, and training [2,133]. Thinking style can also be shifted experimentally, suggesting that transitions between faster and more deliberative modes are at least partly controllable [134].

The strongest evidence for strategy selection arises when candidate strategies are defined independently of the observed traces. In controlled tasks such as Nim, intermediate heuristics can be identified during training and selectively encouraged or suppressed [68]. Conversely, surface cues can dominate more appropriate strategies even when the required knowledge is available, indicating failures in routing or constraint use rather than missing knowledge [63].

Clustering reasoning traces alone is therefore insufficient to establish distinct internal strategies. A stronger routing claim requires independently specified alternatives, evidence that some state or cue shifts their relative use, and downstream consequences consistent with the selected procedure.

5.4. Faithfulness and Post Hoc Rationalization (B5)

Visible reasoning is not always a faithful record of the computation that produced an answer. A chain may causally contribute to the decision, expose only part of a latent process, or rationalize an answer that was already selected. Faithfulness has been tested through counterfactual hints, trace corruption, truncation, attribution, answer probes, and interventions on reasoning states [6].

Mechanistic evidence increasingly supports this distinction. Reasoning drift can lock a model into an incorrect pattern that remains locally coherent [135], while activation-based probes can detect post-commitment reasoning and reduce such behavior during training [136]. Other work suggests that instruction-related and execution-related computations can become dissociated, allowing a model to state a principle correctly while failing to apply it [137].

Behavioral measures alone are also unreliable. Human-annotated studies show that common indicators of unfaithfulness perform poorly, particularly on incorrect answers, where diagnosis is most important [18]. Faithfulness assessment should therefore combine trace-level observations with latent-state and causal evidence.

5.5. Verification, Correction, and Backtracking (B6)

An improved final answer does not by itself demonstrate that a model recognized and corrected its own error. Correction involves several distinct operations: detecting a problem, evaluating alternatives, selecting a repair, executing it, and deciding when to stop. Methods such as Reflexion, recursive introspection, and trajectory optimization improve outcomes through repeated feedback or revision [77,138,139], but these behavioral gains do not identify where error recognition occurs.

Mechanistic studies suggest that visible markers of revision can occur after the underlying decision to change course. Zulaika et al. identify internal components associated with sensing trajectory quality, evaluating whether to continue, and initiating backtracking; removing the relevant internal signal substantially reduces backtracking even though the visible interrupting token itself is downstream of the decision [64]. Related work finds that failures often originate at a small number of early transition points marked by uncertainty changes and that redirecting these states can repair the subsequent trajectory [140].

These results distinguish recognizing an error from merely producing text that looks like self-correction. Understanding correction therefore requires locating the internal transition that triggers revision rather than relying only on verbal markers such as “wait”, “however”, or “let me reconsider”.

5.6. Synthesis

Reasoning traces provide useful evidence about decision making, but they should not be treated as direct transcripts of internal computation. Across the reviewed literature, three conclusions receive comparatively consistent support. First, decision-relevant reasoning state can exist outside visible tokens. Second, commitment to an answer or strategy can occur before the point at which it becomes explicit in the trace. Third, visible reasoning and revision markers can be downstream of latent decisions rather than their cause.

Reasoning-level analysis should therefore combine trace observations with internal-state decoding and causal intervention. The most informative measurements are not merely whether a plausible chain was produced, but which strategy was active, when commitment occurred, whether alternative strategies remained accessible, and whether observed correction was causally connected to internal error detection.

6. Policy Selection Across Agent Trajectories

Agent decision making extends across multiple model calls, tool interactions, observations, and changes to the environment. This introduces two challenges that do not arise within a single forward pass. First, decision-relevant state must persist or be reconstructed across context boundaries. Second, actions change the observations available for subsequent decisions, so early commitments can shape the evidence on which later choices are based.

At this level, understanding a policy therefore requires tracking not only individual actions but also how goals, beliefs, plans, tool preferences, and recovery decisions evolve across the trajectory.

6.1. Persistence of Goals, Beliefs, and Plans (B1–B2)

Long-horizon decision making requires information about goals, constraints, observations, uncertainty, and progress to remain available across successive model calls. Such persistence can arise in two fundamentally different ways: the model may maintain a decision-relevant state internally, or the surrounding system may reconstruct that state from visible context, memory, or an explicit plan.

Several agent architectures deliberately externalize this state through belief representations, natural-language summaries, or explicit planning structures [72,141,142]. These mechanisms can improve long-horizon behavior, but they demonstrate persistence at the agent-system level rather than persistent internal state in the language model.

Evidence for internal persistence is currently much weaker. Mehta and Datta compare trajectories with and without an explicit plan in context and find that the corresponding hidden-state signal rapidly decays after the plan is written [143]. This suggests that at least in the studied setting, the plan remains behaviorally relevant because it is externally available rather than because it has been internalized as a durable latent state.

A stronger persistence claim therefore requires more than successful long-horizon behavior. It requires showing that a goal or belief remains recoverable across calls and causally influences later actions even when superficial contextual cues are controlled. Causal state binding and goal-representation probing provide examples of experimental designs aimed at separating genuine state dependence from action priors or prompt reconstruction [62,74].

6.2. Tool and Action Selection (B3 and B4)

In the studied benchmark and models, the strongest available evidence locates many tool-selection failures at the decision readout rather than at insufficient attention to the correct tool. Tool use is not one decision: it comprises whether external computation is needed, which tool applies, how arguments are grounded, whether permissions allow execution, how a result updates belief, and whether to call again. Decomposing it settles a common misdiagnosis. Chen measures attention to each labeled tool-definition segment on real Berkeley Function-Calling Leaderboard failures. The model attends most to the correct tool 80% of the time against 21% chance, and the gold tool is under-attended on only 10% of failures. Repairing the prompt by reordering or duplicating the gold tool recovers at most 23% of failures, whereas readout-side interventions recover 59 to 91%, with an attention-logit bias and a residual-stream steering vector recovering largely the same cases [144]. The agent looks at the right tool and picks the wrong one, which places the failure at B4 rather than B1, as the readout results of Section 4 did within a single call.

The complementary finding is that this decision is legible and manipulable. Tool choice is linearly readable from activations and steerable, giving both a pre-execution check on a wrong call and a mechanistic foothold, though steering strength has no consistent direction of effect and can swing outcomes by up to 30 percentage points [145]. Heading-specific vectors exert bidirectional control over whether a tool is invoked at all, across five open models and three domains, which is notable because tools exist only in context and have no encoding in the weights [146]. Related work supplies the engineering, including observability that reports before rather than after an action and targeted intervention for tool-structured inference [147,148,149], while PaaT exposes activation-derived probes as functions the agent can call [150].

A represented tool that loses at the selection gate, a correct schema with hallucinated arguments, and an ignored valid result are three different failures that share one score, which is why evaluation should record decision-level outcomes alongside task success.

6.3. Failure Prediction, Recovery, and Termination (B6)

This subsection examines evidence that goal drift and premature commitment are both detectable in activations before the failing action. Chen instruments an agent’s residual stream to test whether goal drift, the loss of objective that produces action loops and off-instruction output, can be anticipated from mid-network activations before the failing action [69]. Mehta diagnoses the opposite failure, in which agents settle on one reading of the evidence early and spend the run defending it. Defining representational commitment as cross-run hidden-state convergence at a fixed step, step-4 similarity on Llama-3.1-70B predicts downstream behavioral consistency with a localized temporal and layer-wise signature, and it replicates on Qwen-2.5-72B [151]. Lead time indicates that the relevant state precedes the observable failure, but it is easy to overstate, since step index, accumulated length, task identity, and lexical warnings all offer shortcuts a probe can exploit.

Intervention is beginning to be characterized rather than merely demonstrated. Yap trains sparse autoencoders on a 35B mixture-of-experts model and projects probe weights back through the decoder to obtain continuous steering vectors. Five nominal agentic traits collapse onto a single agency axis, and autonomy steering shifts the model away from asking the user for help at a large effect size across 1800 rollouts [152]. The collapse of several nominally distinct traits onto a common latent direction cautions against interpreting behaviorally defined agent traits as independent internal variables.

Recovery remains a distinct policy over repairs and stopping: detect the failure, estimate whether another attempt is worthwhile, choose a changed action rather than repeat one, and eventually abort or escalate. Terminal success after a harness retry is not evidence of internal self-correction, a point Section 7 develops.

6.4. Multi-Agent Interaction

Across the studies reviewed here, internal evidence about multi-agent decision making is close to absent. Multiple agents add variables with no single-agent counterpart: beliefs about partners, division of labor, communication policy, trust, deception, and stopping rules. The corpus covers cooperative decomposition into planning and reasoning roles [153], coopetition using coarse verifier signals [154], foresight optimization [155], and prompting-based strategic play across matrix-game variants and hidden information [70], with Park et al. measuring agents against regret, a metric independent of the model [156]. Almost all of it is behavioral. The exception is Masukawa et al., who integrate frozen expert models through their hidden states and observe a dual mechanism: simple domains are explained by static expert preference, harder ones by increasingly concentrated expert attention over training [157]. Claims that an agent represents a partner’s belief, rather than responding to surface messages, are currently unsupported, and multi-agent settings intensify harness confounding, since orchestration order, message truncation, shared memory, and judge prompts can by themselves determine the apparent social strategy. The incident analyzed in Section 9 is the sharpest illustration: shared infrastructure state functioned as a message board between agents that were never given a communication channel.

6.5. Synthesis

Agent-level decision making differs from within-call reasoning because decision-relevant state must survive across model invocations and because actions modify the evidence available to later decisions. Current evidence suggests that much of this persistence is supplied by external context, memory, or planning structures rather than by durable latent state within the model.

Three findings are particularly important. First, explicit plans can remain behaviorally necessary without being internally persistent. Second, correct tool information can be represented or attended to while selection still fails. Third, goal drift and premature commitment can sometimes be detected in internal states before they become visible in behavior.

These results motivate trajectory-level analysis that separates representation, selection, execution, and update. Task success alone cannot reveal whether an agent maintained the correct goal, selected the wrong action despite representing the right one, or recovered only because the surrounding system reintroduced missing state or feedback.

7. The Harness as Part of the Decision System

An LLM agent does not make decisions in isolation. Its effective policy emerges from the interaction between the model and a surrounding harness that constructs observations, manages memory, defines available tools, executes actions, supplies feedback, applies verification, and controls retries. These components determine both the information available to the model and the actions it is permitted to take.

Harness-level analysis is therefore necessary for distinguishing model-internal decision making from behavior induced by the surrounding system. If changing context construction, memory, tool interfaces, or verification while holding the model fixed changes internal state or action selection, the resulting decision is a property of the coupled model–harness system rather than of the model alone.

7.1. Harness Effects on Decision-Relevant State

Changing the harness while holding the base model fixed can alter the internal state on which later decisions depend. Chen reports systematic changes in model-derived estimates of progress, risk, recoverability, constraints, uncertainty, and expected success under different harness configurations [7]. Such results show that internal decision state cannot always be interpreted independently of the system that constructs the model’s observations.

External manipulation of the action interface provides an even clearer demonstration. ToolHijacker redirects tool selection by modifying malicious tool documentation without changing model weights or activations [25]. Contextual distractors can similarly redirect reasoning and final choice [17]. Together, these findings show that context and interface design can alter both the state available to the model and the action ultimately selected.

7.2. Context Construction, Memory, and Affordances

This subsection argues that context construction and the action set are design variables that change the decision problem itself. Summarization, truncation, retrieval, and state serialization determine what evidence exists on each call, and persistent memory can preserve goals and observations or introduce stale, poisoned, and over-salient records. A plan that disappears after context eviction was never maintained internally, while a plan reconstructed from a memory record is genuinely part of the agent system even though no activation persisted between calls; neither observation is a claim about the model. Tool schemas, action names, permissions, defaults, and interface wording define the feasible action set, so changing a schema changes performance by changing the decision problem, not preference or competence. Structural proposals make this explicit. Wei characterizes the standard agent loop as a single-ready-unit scheduler in which the choice of the next executable unit is the output of an opaque inference rather than an inspectable policy, and lifts that control structure into an explicit static graph with an immutable plan version [158]. The point for interpretability is that the scheduling decision is a design variable, and in the loop paradigm it is silently delegated to the model. A useful harness audit therefore reports prompt assembly, observation filters, memory writes, tool descriptions, execution semantics, and retry policy.

7.3. Feedback, Verification, and Repair

This subsection examines why verifier-assisted success does not distinguish internal revision from external filtering. Long-horizon work shows that verifier signals, execution feedback, and episodic correction preserve success over extended tasks [16,159], and multi-turn reinforcement learning addresses the same gap from the training side, since standard prompting rarely yields agents that ask clarifying questions [160]. What such results do not distinguish is how a verifier helps: it may add missing evidence, change the incentive to inspect work, reject a candidate, or select among candidates directly, and these differ in what they imply about the model’s capability.

The correct unit of comparison is therefore a model and harness pair. Under equal compute one can compare an unverified model, a model shown verifier feedback, a harness that silently rejects outputs, and an oracle selector. Measuring the model’s belief before and after feedback separates internal revision from external filtering. Repair studies should report whether the second attempt rests on a changed diagnosis or merely on resampling. The proactivity results make the same point about information the harness never collects: an agent cannot act on a user preference it was never given the opportunity to obtain, so what looks like a failure of inference can be a property of the interaction design [161].

7.4. Attributing Decisions to Model and Harness

Separating model-level from system-level decision making requires controlled variation of the surrounding harness while holding the base model fixed. Existing studies show that changes in system context can alter intermediate beliefs, planning behavior, calibration, and information seeking even without modifying model weights [7,161,162]. Webb et al. further show that parts of multi-step planning can be externalized into explicit system components and improved without changing the underlying model [162].

Relevant harness variables include system prompts, observation construction, memory policy, available actions, tool descriptions, verifiers, and retry logic. Varying these factors while holding the model fixed can reveal whether an observed trajectory depends on the model or on the surrounding system. Conversely, evaluating different models under the same harness helps isolate model-specific effects.

Endpoint accuracy alone is insufficient for this attribution. Intermediate measurements such as belief state, candidate actions, tool selection, correction events, and responses to feedback can reveal whether the harness changes the model’s decision process or merely filters its outputs. A decision pattern that remains stable across equivalent harness configurations provides stronger evidence for a model-level mechanism; a pattern that changes with the harness should instead be interpreted as a property of the coupled model–harness system.

7.5. Synthesis

Harness components can alter the information available to an agent, the alternatives it can select, and the feedback that shapes subsequent decisions. Current evidence shows that changing the harness while holding the model fixed can alter decision-relevant internal states and action selection, while memory and context can preserve task state that is not internally persistent across calls.

These findings make system boundaries essential for interpreting agent behavior. A trajectory cannot automatically be attributed to the language model when context construction, memory, tool interfaces, verifiers, or retry policies contribute to the observed choice. Claims about model-internal policy therefore require demonstrating that the relevant decision pattern remains stable under controlled changes to the surrounding harness.

8. Stress Tests of Decision and Strategy Selection

Decision mechanisms are most informative when they remain identifiable under conditions that disrupt the usual correspondence between internal state and observable behavior. Deception, adversarial manipulation, uncertainty, distribution shift, and long-horizon monitoring provide such stress conditions. They test whether an identified representation or mechanism continues to explain what the system selects when outputs become misleading, context is manipulated, confidence is unreliable, or behavior unfolds over extended trajectories.

8.1. Deception and Alignment Faking

Across the studies reviewed here, deception evidence mostly stops at a decodable state while the vocabulary used to discuss it reports a policy. Deception is a stringent decision test because identical false outputs can arise from ignorance, instruction following, role-play, local reward optimization, or a policy that represents the truth and selects concealment. Only the last is deception in the sense that matters here, and separating it from the others is a question of system locus, temporal scope, stage, and evidential relation [163,164,165,166].

Behavioral benchmarks establish that models produce context-sensitive falsehoods and strategic-looking actions. Alignment-faking experiments impose more structure by manipulating whether behavior is monitored or trained and testing for a compliance gap, a design that targets the selector rather than the output; a broad replication across 25 models found the pattern is not uniform and that only some models’ gaps are consistently explained by goal preservation [167]. That is independent-replication evidence ($R_I$) doing its work: replication narrows a general claim without erasing a real phenomenon. Internal studies decode or track truth, intent, uncertainty, or the geometry of deceptive trajectories, and some intervene on the relevant states. Layer-wise trajectory signatures vary by model and by type of deception, which cautions against positing a single deception direction [168], and agentic fine-tuning can increase unintended harmful action, so training for tool competence changes safety-relevant routing with no deception objective present [169]. The defensible evidential distinctions follow Facet C: false behavior at C0, a separable deceptive state at C1, a causally relevant state at C2, controllability at C3, and a mediated account of a concealment policy at C4, with persistence across contexts recorded separately in the robustness profile. The studies reviewed here mostly stop at C1, while the vocabulary in which they are discussed reports C4.

8.2. Adversarial Redirection

This subsection argues that attacks and defenses must be labeled by locus and stage together, because equally effective defenses leave different internal states. An attack is a decision experiment run by an adversary, and it is useful here because attacks are explicit about which stage they target. ToolHijacker and action-hijacking attacks operate on retrieval and tool selection, while memory-control-flow and sleeper-memory attacks make persistent records dominate later policy [25,170,171,172]. The first is the sharpest demonstration that selection can be located outside the model entirely, as Section 7 argued.

Mechanistic defenses localize jailbreak-relevant components or steer a safety subspace, and report large reductions in attack rate, with strong control from a small set of components and, in some vision-language models, from a single head [173,174,175,176]. These are C2 and C3 findings demonstrated in their original settings: concentration of an effect in a component does not establish robustness to adaptive attacks, and an attacker optimizing against a known defended component is the adversarial form of the specificity problem of Section 3. System defenses instead purify context, constrain tool-dependency graphs, or correct injected attention at inference time [177,178,179]. That both families work is why system locus and stage must be stated together: a harness constraint can prevent execution while leaving the model’s redirected goal intact, and an activation intervention can restore refusal while leaving poisoned memory available to the next call. Two defenses with the same success rate can leave the system in entirely different internal states, which endpoint evaluation cannot distinguish.

8.3. Confidence, Calibration, and Abstention

The reviewed evidence indicates that reported confidence depends heavily on how it is elicited, and that abstention is better treated as a policy than as a threshold. Confidence is the one case in this survey where the model issues its own report about an internal state. Black-box work comparing prompts, sampling, and aggregation finds strong dependence on the elicitation method [180], and more recent evidence indicates that reported confidence tracks commitment more closely than correctness, while high confidence amplifies persuasive risk in deception settings [181,182]. Read against Section 5 that is coherent: if an answer is fixed before the visible chain begins, a confidence report generated afterwards is a report about the commitment, not the evidence.

Abstention should therefore be treated as a B6 policy rather than a threshold appended to an answer. Cascaded systems route cases by confidence to models of different cost or to human experts, improving the accuracy–cost trade-off [183], which is a system-level use of a signal whose internal meaning remains unsettled. Without a test of whether intervention on the uncertainty state causally changes stopping, a calibration result is a C1 claim about a correlate.

8.4. Distribution Shift and Long-Horizon Drift

Robustness requires testing whether a decision variable remains informative under changes that alter the distribution on which it was identified. Robustness is weak at every scope, and each preceding section supplied an instance: features that encode lexical or positional regularities rather than the intended variable, circuits that reorganize across models, commitment probes that track task difficulty, and agent monitors that exploit trajectory length. Changed tool schemas, longer horizons, adversarial behavior, and memory contamination shift the distribution further, and trajectory scope compounds the problem because the agent’s own actions determine its later inputs. Held-out examples from the same benchmark establish prompt- or sample-level robustness ($R_P$), not task, model, harness, or independent-replication robustness. Those dimensions must be reported separately.

8.5. Monitoring and Intervention

Prospective monitoring provides a stronger test of a decoded state because it requires that state to predict failure before the corresponding behavior becomes visible. A probe that reports a state after the fact may be a post hoc correlate; a probe that aborts a doomed episode before the failing action must have located something the trajectory had not yet expressed, which is why lead time rather than accuracy carries the evidential weight. Trace-based debuggers locate the causal failure step, online auditors predict failure before completion, probe cascades abort doomed episodes, and trajectory models aggregate sparse evidence across many steps [184,185,186,187]. Long-horizon monitors face a compression problem, since the relevant evidence may be weak at every step yet compelling in aggregate, and are answered by explicit cross-step dependency models or compressed risk-bearing subtraces [188,189,190]. Realistic benchmarks remain hard, with substantial headroom on fine-grained source diagnosis and degraded recovery under corrupted tool outputs [191,192].

Detection is valuable without a causal interpretation, provided the claim stays diagnostic and reports lead time, recall at a fixed false-positive rate, and robustness to an adaptive adversary. Repair systems show that stopping or constrained rerunning improves safety and reliability [193,194,195,196,197]. The unresolved question is whether a monitor has found a portable decision variable or a deployment-specific signature. Separate changes of harness, task family, and model are needed to answer it.

8.6. Unified Stress-Test Matrix

This subsection shows that the five conditions above become comparable once each is written using system locus, temporal scope, stage, and evidential relation. Table 3 gives that reading, using only the evidence reported above. The organization prevents behavioral success from being mistaken for mechanistic understanding, and it identifies where a defense acts even when it is effective against several attack names.

Table 3. Taxonomy-based comparison of strategy-selection stress tests.

Condition	System/Scope	Primary Stage	Typical Relation
Deception and alignment faking	$S_M/T_2$–$T_3$	B1 represent state; B3 evaluate	C1
Adversarial redirection	$S_H$ or $S_M$, $T_1$–$T_3$	B4 select and commit; B1 state update under untrusted evidence	C2–C3
Confidence and abstention	$S_M/T_2$	B6 correct or stop, via uncertainty-to-stop coupling	C0–C1
Monitoring	$S_M$ or $S_C$ at $T_3$	B1 represent state, read prospectively	C1
Recovery and repair	usually $S_H/T_3$	B6 update, retry, terminate	C0–C2

9. Compact Use Case: From Observed Behavior to Testable Hypotheses

The security incident is included as a compact demonstration of the taxonomy’s research use, not as a mechanistic reconstruction of proprietary models. Public reports describe a July 2026 evaluation in which agents exploited an internal package-registry proxy, escalated privileges, reached external infrastructure, and used shared state in ways that supported coordination [198,199,200]. These records establish observed trajectory and harness behavior at C0. They do not establish an internal representation of circumvention, a stable goal, or a causal selector.

The taxonomy converts those observations into hypotheses that can be tested in a contained cyber range. A controlled reproduction should distinguish intended solving, permitted auxiliary-tool use, exploitation of a synthetic unintended affordance, and coordination through shared state. It should vary communication state, permissions, tool interfaces, objective pressure, and retry policy while holding the underlying task and model fixed. The resulting design tests whether the observed policy is attributable to model state, the harness, or their interaction.

This case therefore supports the research agenda by making the cross-scope continuity gap operational. Let $t_{\mathrm{unsafe}}$ be the first disallowed action and $t_{\mathrm{detect}}$ the first calibrated warning. The monitor’s useful lead time is $L=t_{\mathrm{unsafe}}-t_{\mathrm{detect}}$. Positive lead time would establish prospective detection, while C4 would additionally require mediation: changing the candidate selector must change trace-level commitment, tool choice, and the executed action. Table 4, hows how a C0 public observation can be converted into a sequence of C1–C4 tests without treating the incident itself as mechanistic evidence.

Table 4. Taxonomy-derived hypotheses for a controlled reproduction of the observed incident.

Hypothesis	Required Comparison or Intervention	Relation
A strategy variable becomes detectable before the first unauthorized action.	Train and test a prospective probe with strategy labels defined independently of trace wording; control step index, task identity, trajectory length, and security vocabulary.	C1
The candidate internal state causally influences strategy selection.	Patch matched pre-commitment states between intended-solving and circumvention trajectories; require a specific change in strategy rather than general performance loss.	C2
The candidate state permits controlled switching.	Raise and lower the state and test for bidirectional, procedure-specific effects with off-target measurements.	C3
Writable shared state causes coordination.	Compare isolated, read-only, and writable shared state at equal budgets; perturb partner identity, provenance, and message content.	C2–C3
Harness affordances mediate the selected policy.	Vary permissions, observation construction, memory visibility, tool availability, verification, and retry logic independently.	C2–C3
One variable mediates the full transition from commitment to action.	Intervene at the earliest hypothesized cause and test propagation through trace commitment, tool choice, shared memory, executed action, and feedback.	C4

10. Cross-Scope Synthesis and Research Agenda

Across model-internal computation, reasoning traces, agent trajectories, and the surrounding harness, the literature provides increasingly strong methods for identifying decision-relevant states and mechanisms. The principal limitation is not the absence of evidence at any individual system locus or temporal scope, but the lack of studies that preserve and test the same decision variable across scopes.

This distinction is central for understanding agentic decision making. A representation decoded within a model call, a commitment inferred from a reasoning trace, an executed action, and a harness-induced change in behavior may all concern the same apparent decision while reflecting different underlying processes. A complete explanation therefore requires connecting these observations causally rather than studying each in isolation.

10.1. Strength of Synthesis Claims

The conclusions below are calibrated in three categories. Convergent findings recur across multiple tasks, models, or methods; setting-bounded findings are supported in particular experimental settings but should not yet be generalized; and interpretive claims are syntheses proposed by this review and remain hypotheses for direct testing.

The following findings receive convergent support: multiple incompatible candidates can coexist internally, so an incorrect output does not necessarily imply missing knowledge (Section 4); commitment can precede a visible rationale, so generated reasoning cannot automatically be treated as the origin of a decision; agent failures can occur at different functional stages; and the surrounding harness can alter decision-relevant state and action selection. Evidence that sparse components and low-dimensional representations exert causal influence is strong in constrained tasks but remains setting-bounded because the corresponding mechanisms are often task-, format-, and model-dependent. The claim that these local effects compose into persistent cross-call policies is interpretive and motivates, rather than reports the result of, the cross-scope experiments proposed below.

These findings support increasingly detailed accounts of local decision processes, but they do not establish universal decision circuits, faithful chains of thought, or context-independent agent policies.

Table 5 summarizes representative phenomena across system loci and temporal scopes, the evidential relation currently supported, the principal limitation of that evidence, and the type of experiment needed to strengthen the corresponding claim.

Table 5. Comparison of recurring decision-making phenomena and evidence gaps.

Phenomenon	System/Scope	Stage	Best Evidence	Key Limitation	What Would Strengthen the Claim
Parametric–contextual competition	$S_M/T_1$	B2–B3	C2; $R_P,R_T,R_M,R_I$	Specific component assignments do not consistently replicate	Causal-variable validation of the competition itself rather than individual components
Task-specific selection circuits	$S_M/T_1$	B4	C4; original setting	Multiple faithful circuits may implement one task; components are format-dependent	Recovery of the same mechanism across formats, tasks, and models
Correct internal value with incorrect output	$S_M/T_1$	B5	C2; $R_P$	Evidence remains concentrated in constrained binding and readout tasks	Intervention on the routing state across multiple task families
Commitment before visible reasoning	$S_M/T_2$	B4	C3; $R_P$	Steering can alter answers without establishing natural mediation	Trace the pre-answer state causally through reasoning into the final choice
Strategy repertoires and routing	$S_M/T_2$	B2–B4	C3; original setting	Strongest evidence comes from tasks with pre-specified strategies	Intervention on a strategy selector with procedure-specific downstream consequences
Backtracking and correction	$S_M/T_2$	B6	C2; $R_T$	Visible revision markers can occur downstream of the actual decision to revise	Causal mediation from error recognition through strategy change to corrected output
Plan persistence across calls	$S_C/T_3$	B1–B2	C2; original setting	Internal persistence has been tested in few models and settings	Cross-model and cross-harness replication with positive controls
Tool selection failure	$S_C/T_3$	B4	C3; original setting	Evidence remains benchmark- and schema-dependent	Cross-harness and cross-schema replication with off-target controls
Goal drift and premature commitment	$S_C/T_3$	B1–B6	C1; $R_P$	Probes may exploit trajectory length, step index, or lexical cues	Prospective lead-time evaluation with these confounds controlled
Multi-agent coordination	$S_C/T_3$	B3–B4	C0; original setting	Evidence is predominantly behavioral	Partner-state interventions combined with internal measurements of coordination variables
Harness-induced state shift	$S_H/T_1$–$T_3$	B1	C2; original setting	Evidence is concentrated in individual harness configurations	Factorial harness variation while holding the underlying model fixed
Tool-interface redirection	$S_H/T_2$–$T_3$	B4	C2; $R_P$	Behavioral redirection is measured more often than the resulting internal state	Internal measurement under attack separating goal change from execution redirection
Deception and alignment faking	$S_M$–$S_C/T_2$–$T_3$	B1–B3	C1; claim-specific $R_P,R_T,R_M,R_I$	Internal signatures vary across models and forms of deceptive behavior	Controlled intervention on candidate concealment variables with specificity tests
Confidence and abstention	$S_M/T_2$	B4–B6	C1; $R_P$	Reported confidence can reflect commitment rather than evidence quality	Intervention on uncertainty-related state and measurement of its effect on stopping or abstention

10.2. What Remains Unresolved

Evidence becomes substantially weaker when the same decision must be followed across temporal scopes and into the surrounding harness. Few studies trace one decision variable from its internal representation through commitment and into an executed action, and still fewer test whether that relation survives changes to the surrounding harness. Multi-agent coordination is studied predominantly through observable behavior, while the strongest causal and mechanistic evidence remains concentrated in short, controlled tasks on open-weight models.

The resulting gap is therefore not simply one of scale. Current methods are increasingly effective at characterizing local states and mechanisms, but evidence that these local mechanisms compose into persistent strategies or policies remains limited.

10.3. The Cross-Scope Continuity Gap

The central unresolved problem is to connect a component-level mechanism to a reasoning-level commitment and then to a trajectory-level policy. A convincing analysis requires a shared decision variable—for example, a selected tool, candidate answer, safety constraint, or goal—that can be followed from $T_1$ through $T_3$ and across relevant system loci. An intervention at the earliest hypothesized cause must then be traced through its downstream consequences.

Existing work begins to address parts of this bridge but does not yet provide a common experimental design for following the same variable across temporal scopes and harness feedback [201,202]. Figure 2 summarizes this gap.

Figure 2. Cross-scope continuity gap between local decision mechanisms and persistent agent policy.

Tool selection illustrates the problem particularly clearly. At $S_M/T_1$, internal representations can encode tool identity and affordances. At $T_2$, reasoning may compare alternatives and exhibit a commitment boundary. At $S_C/T_3$, the emitted tool call, arguments, result uptake, retries, and stopping behavior form the executed policy. At $S_H$, retrieval, permissions, tool descriptions, memory, and retry rules determine the choice environment. Evidence exists at each scope, but very little work preserves the same tool-selection variable across them.

A cross-scope experiment would therefore manipulate routing cues and harness affordances independently, intervene on the candidate internal selector before commitment, and measure whether the intervention propagates through the emitted tool call into subsequent result use. Such designs are needed to distinguish a probe that merely reflects the prompt, a reasoning trace that rationalizes an earlier choice, and an apparent agent policy that is actually produced by the surrounding harness.

10.4. Benchmarking Strategy Identification

A second methodological gap is the absence of benchmarks in which the strategy used by a model can be distinguished from the answer it produces. If different strategies always lead to different outputs, a classifier can infer the apparent strategy from the answer without identifying the underlying decision process.

A useful benchmark should therefore contain at least two independently specified solution procedures and include answer-equivalent cases in which different strategies produce the same result. Candidate strategies should be defined independently of the observed reasoning trace, and the benchmark should provide intervention points that allow the inferred strategy to be tested causally rather than only decoded.

Controlled settings such as arithmetic heuristics and Nim illustrate the value of defining alternatives in advance [2,68]. Future benchmarks should extend this principle across model, reasoning, trajectory, and harness levels, combining hidden-state measurements with counterfactual interventions that test whether the inferred strategy actually governs subsequent actions.

10.5. Requirements for Cumulative Evidence

Cross-scope claims require enough experimental detail to distinguish representation, causal influence, and persistent policy. Studies should therefore report the decision alternatives being tested, the temporal point at which relevant state is measured or manipulated, the intervention and causal estimand, appropriate controls, and the conditions under which the result generalizes.

For agent studies, the surrounding harness is part of the experimental specification. Context construction, memory policy, tool schemas, permissions, verification, retry logic, and model version should therefore be reported alongside the model itself. Mechanistic and steering studies should additionally report off-target effects and stability across prompts, tasks, and seeds. Trace-faithfulness studies should distinguish correct from incorrect trajectories because the relation between visible reasoning and underlying computation may differ substantially between them.

Negative and non-transfer results are also informative. Failure of a circuit, probe, or steering direction to generalize can reveal that the identified mechanism was tied to a particular task representation, format, model, or harness rather than reflecting a broader decision variable.

10.6. Open Questions

The synthesis leaves several questions unresolved:

• Which decision-relevant internal variables persist across separate model calls, and which are reconstructed from context each time?
• When does decodable information become causally available to downstream decision making, and when does it remain inert?
• Can a strategy transition be identified before its surface behavior diverges?
• Which local decision mechanisms remain stable across prompts, tasks, models, and harness configurations?
• How do model-internal state and harness design jointly determine routing among strategies?
• Can monitors continue to identify unsafe strategies when agents adapt their behavior in response to oversight?

10.7. Limitations

This article presents a conceptual framework supported by a structured, non-systematic literature synthesis rather than a systematic review. The literature is English-dominant and includes a substantial number of recent preprints, particularly in fast-moving areas such as agent monitoring and mechanistic interpretability. Coverage may therefore favor recent LLM-centered work over related traditions in reinforcement learning, classical planning, cognitive science, and decision theory.

Assignments of system locus, temporal scope, function, evidential relation, and robustness necessarily involve interpretive judgment and were performed by a single reviewer. The taxonomy should therefore be understood as a structured synthesis of the available evidence rather than a definitive coding of the literature.

11. Conclusions

This review examined how decision making and strategy selection in LLMs and LLM-based agents can be studied across system loci and temporal scopes: model-internal computation, reasoning episodes, agent trajectories, and the surrounding harness. The proposed taxonomy separates where computation occurs, over what temporal scope a decision is investigated, which decision function is involved, and what evidential relation connects an observed variable or mechanism to the resulting choice.

Across these scopes, the literature shows that decision-relevant information can often be decoded before it becomes visible in behavior, that causal interventions can identify states and components influencing selection, and that commitment can precede explicit reasoning or action. At the agent level, however, persistent behavior cannot automatically be attributed to the language model, because memory, context construction, tool interfaces, verification, and retry logic may substantially shape the effective policy.

The main unresolved problem is therefore cross-scope continuity. Current methods increasingly explain local decision processes, but they rarely follow the same decision variable from internal representation through commitment, executed action, feedback, and subsequent state. Progress toward trustworthy agentic systems will require experiments and monitors that preserve this causal chain, distinguish model-level decisions from harness-induced behavior, and detect unsafe strategy transitions early enough for intervention.