As autonomous systems and AI agents begin to access quantum cloud resources, existing agent governance frameworks enforce only budgets and delegation scope, not physical execution quality. We present a governance framework that enforces hardware fidelity constraints before permitting agent-mediated quantum computation. The framework extends cryptographic delegation chains with physics facets (coherence times, gate errors, readout errors, calibration freshness) that participate in the same monotonic narrowing invariant as budget and scope constraints. A cross-backend experiment on IBM Quantum hardware (ibm_fez, ibm_marrakesh, ibm_kingston) shows that governance correctly denies a backend where qubit T1 falls below the delegation threshold (39.1 µs vs. 80 µs minimum), while permitting backends meeting the constraint. A counterfactual experiment indicates a 5.2 percentage point Bell state fidelity gap between the denied and permitted backends (92.9% vs. 98.1%), widening to 7.7 points on a 4-qubit GHZ circuit. Governance overhead is 4.2 ms for policy evaluation and receipt signing. Ed25519-signed receipts bind each governance decision to the hardware calibration state at the moment of evaluation.
As autonomous systems and AI agents begin to access quantum cloud resources, existing agent governance frameworks enforce only budgets and delegation scope, not physical execution quality. We present a governance framework that enforces hardware fidelity constraints before permitting agent-mediated quantum computation. The framework extends cryptographic delegation chains with physics facets (coherence times, gate errors, readout errors, calibration freshness) that participate in the same monotonic narrowing invariant as budget and scope constraints. A cross-backend experiment on IBM Quantum hardware (ibm_fez, ibm_marrakesh, ibm_kingston) shows that governance correctly denies a backend where qubit T1 falls below the delegation threshold (39.1 µs vs. 80 µs minimum), while permitting backends meeting the constraint. A counterfactual experiment indicates a 5.2 percentage point Bell state fidelity gap between the denied and permitted backends (92.9% vs. 98.1%), widening to 7.7 points on a 4-qubit GHZ circuit. Governance overhead is 4.2 ms for policy evaluation and receipt signing. Ed25519-signed receipts bind each governance decision to the hardware calibration state at the moment of evaluation.
Our computing ecosystem is being transformed by two emerging paradigms: the increased deployment of agentic AI systems and advancements in quantum computing. With respect to agentic AI systems, one of the most critical problems is creating secure governing architectures that ensure agents follow their owners' communication and interaction policies and can be held accountable for the messages they exchange with other agents. With respect to quantum computing, existing systems must be retrofitted and new cryptographic mechanisms must be designed to ensure long-term security and quantum resistance. In fact, NIST recommends that standard public-key cryptographic algorithms, including RSA, Diffie-Hellman (DH), and elliptic-curve constructions (ECC), be deprecated starting in 2030 and disallowed after 2035. In this paper, we present MAGIQ, a framework for policy definition and enforcement in multi-agent AI systems using novel, highly efficient, quantum-resistant cryptographic protocols with proven security guarantees. MAGIQ (i) allows users to define rich communication and access-control policy budgets for agent-to-agent sessions and tasks, including global budgets for one-to-many agent sessions; (ii) enforces such policies using post-quantum cryptographic primitives; (iii) supports session-based enforcement of policies for agent-to-agent and one-to-many agent sessions; and (iv) provides accountability of agents to their users through message attribution. We formally model and prove the correctness and security of the system using the Universal Composability (UC) framework. We evaluate the computation and communication overhead of our framework and compare it with the state-of-the-art agentic AI framework SAGA. MAGIQ is a first step toward post-quantum-secure solutions for agentic AI systems.
Existing artificial intelligence governance and runtime execution governance frameworks were developed primarily within classical computing environments. While autonomous and agentic systems have introduced new governance challenges, most governance architectures continue to rely upon assumptions regarding deterministic execution, reproducibility, authorization validity, and auditability. Quantum and hybrid classical-quantum systems introduce execution characteristics that challenge these assumptions. Probabilistic measurement, circuit compilation and transpilation, hardware-dependent execution behavior, calibration drift, shot-based execution, hybrid computational workflows, and emerging distributed quantum architectures create governance obligations not fully addressed by existing execution-governance models. This paper proposes an extension of execution-layer governance into quantum environments through the introduction of Quantum Runtime Governance Invariants and corresponding Quantum Governance Requirements. The proposed invariants identify governance properties that must remain true regardless of implementation details, hardware platforms, programming models, or execution environments. These invariants are explicitly tied to governance properties including authorization integrity, admissibility integrity, provenance continuity, governance evidence integrity, replayability, governance continuity, and governance authority. The paper further introduces the concept of Probabilistic Admissibility, in which governance systems evaluate and authorize bounded outcome distributions rather than deterministic outcomes. Building upon this foundation, the paper derives a structured set of Quantum Governance Requirements spanning quantum resource governance, circuit governance, compilation governance, probabilistic outcome governance, shot governance, calibration governance, hybrid classical-quantum governance, quantum artificial intelligence governance, and distributed quantum governance. Finally, the paper examines the implications of these concepts for the Artificial Intelligence Governance Control Plane (AGCP), arguing that quantum systems do not require a fundamentally new governance architecture. Rather, they require an extension of existing execution-governance semantics capable of operating over probabilistic execution environments. The resulting framework establishes an initial foundation for AGCP-Quantum profiles, governance conformance assessment methodologies, registry assessment frameworks, governance assurance models, and future standards development activities.
Abstract We present an experimental characterization of the three-qubit controlled-controlled-Z (CCZ) gate on IBM Quantum’s 127-qubit superconducting quantum computers, revealing state-backend-dependent performance variations. Using quantum state tomography (QST), we evaluate the gate’s output-state fidelity when applied to three algorithmically significant input states—the W state, the Greenberger–Horne–Zeilinger (GHZ) state, and the uniform superposition state. Each state probes distinct aspects of the reconstructed state fidelity, the GHZ state tests coherence in maximally entangled systems, the W state reveals sensitivity to asymmetric errors, and the uniform superposition assesses basis-state-independent behavior. Experiments were conducted across three computational environments, noise-free simulation, noisy simulation, and actual hardware executions on three IBM Quantum computers, ibm_osaka , ibm_brisbane , and ibm_sherbrooke . State fidelities for the qasm_simulator remained above 99.2% for all input states. Noisy simulations yielded fidelities around 80–82%, while hardware results showed more significant degradation: 67.6% (GHZ), 59.0% (uniform superposition), and 50.3% (W)—highlighting the combined importance of state selection and hardware characteristics for reliable quantum computation. These results quantify the current performance gap between simulated and physical implementations of multi-qubit gates and provide a benchmark for error profiles relevant to near-term quantum algorithms
We evaluate calibration-based digital twins for IBM Quantum hardware, aiming to reproduce hardware measurement outcomes on classical simulators. We present a workflow that builds twins from downloadable calibration CSV files by mapping coherence times, gate and readout error rates, and operation durations to thermal-relaxation, depolarizing, and readout error channels, while reconstructing a directed coupling map to restore connectivity constraints during transpilation. We compare four twin variants (CSV-built, backend-derived simulator, backend-derived noise model, and fake-backend snapshots) under a common execution and validation protocol. Experiments on two IBM QPUs, ibm_brisbane and ibm_sherbrooke, use randomized five-qubit circuits of depths 10, 20, and 30 across four optimization levels. Weighted Jaccard similarity indicates that twins constructed from downloadable calibration CSV data often achieved the closest agreement with hardware, while backend-derived twins provided competitive and practical baselines. The results further show that agreement depends on both the target device and the transpilation settings, underscoring the need to validate digital twins for the specific execution setup rather than assuming transferability across devices.
Verification protocols provide cryptographic guarantees that the outcome of a delegated quantum computation is correct, a key requirement for scalable and trustworthy quantum computing. A central assumption underlying these protocols is secret independence: the noise affecting state preparation must not depend on the classical secrets that specify the prepared states. In earlier protocols this assumption was enforced by the physical separation of client and server; in the recent on-chip setting it becomes a property of the hardware itself, and one that high-fidelity devices do not automatically satisfy. We first make the requirement quantitative, deriving a bound that shows how residual secret dependence limits the size of any verifiable computation within this framework. Motivated by this, we introduce a calibration framework that enforces secret independence through pulse-level quantum control, producing state preparations that are simultaneously high-fidelity and secret-independent. We assess its performance on a nitrogen-vacancy centre system via emulation, showing that it reduces the secret dependence of the preparations by more than an order of magnitude compared to standard optimal control, and that it is robust against detuning and drive-amplitude errors commonly encountered in experiment. The framework operates entirely at the calibration stage and is platform-agnostic, offering a practical pathway towards verifiable quantum computing at scale.
Quantum-control optimisation typically begins with calibration records assumed to remain applicable to the intended operation. Yet coherence, phase references, coupling, read-out response and subsystem interactions vary with time and operating context. Local calibration success may therefore be insuffi- cient to justify joint or changed-context control, allowing optimisation to pursue candidates founded on stale, incomplete or inapplicable evidence. We propose an evidence-governed admissibility framework that checks evidence role, scope, freshness, provenance and composition authority before constructing control candidates. Its computational layers have distinct functions: Layer 1 classifies routes as Permit, Withhold or Revalidate, retaining auditable native states and reasons; Layer 2A constructs and screens reduced-model candidates only for permitted routes; and Layer 2B checks applicable end-to-end workflows. Synthetic integration and authority-ablation tests demonstrate enforceable differences in permission, and the implementation passed 150/150 core and 10/10 slew-specific tests. These are computational findings, not hardware validation. We also provide two complementary prospective experimental arms for evaluating practical benefit. Arm 1 (predictive lift) freezes assessments before hardware outcomes are known and tests whether they predict the performance of independently authorised ordinary-baseline operations better than calibration- or availability-only benchmarks. Arm 2 (constructive recovery) tests whether initially unsuitable cases can yield authorised alternative controls after evidence refresh or reconfirmation, a new Layer 1 decision and downstream construction, while preserving the original classification. We release code, schemas, guided workbooks, fixtures and prespecified protocols for independent pilots. Hardware validation could establish whether this approach reduces wasted searches and improves control reliability or qubit performance.