LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents

• URL: http://arxiv.org/abs/2606.20529v1
• Date: Thu, 18 Jun 2026 17:41:56 GMT
• Title: LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents
• Abstract summary: Policy-adherent tool-calling agents in customer-service domains must maintain task states across turns while calling tools and obeying domain policies.<n>We introduce textscLedgerAgent, an inference-time method for tool-calling agents that maintains observed task states in a separate ledger and renders the states into the prompt.
• Score: 39.819141036179225
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Policy-adherent tool-calling agents in customer-service domains must maintain task states across turns while calling tools and obeying domain policies. Task states consist of relevant facts, identifiers, constraints, and conditions observed through user interaction and tool calls. In standard agents, task states are not represented separately. Observations, tool returns, and policy instructions are placed in the prompt, leaving agents to reconstruct the relevant states from the prompt each time they decide what to do next. This design makes state management implicit, creating two common failure modes. An agent may retrieve the right facts but later ground its decision in stale, missing, or incorrect information; and a syntactically valid tool call may still violate a domain policy that depends on the current task state. We introduce \textsc{LedgerAgent}, an inference-time method for tool-calling agents that maintains observed task states in a separate ledger and renders the states into the prompt. The ledger is also used to check state-dependent policy constraints before environment-changing tool calls are executed, blocking policy violations. Across four customer-service domains and a mixed panel of open- and closed-weight models, \textsc{LedgerAgent} improves average pass\textasciicircum{}k over a standard prompt-based tool-calling approach, with the largest gains under stricter multi-trial consistency metrics.

Related papers

• PolicyMem: Geometric Policy Memory for LLM Governance [72.04962480384322]
  We introduce PolicyMem, a geometric policy memory that externalizes natural-language policies as reusable geometric memory objects.<n>A memory writer compiles natural-language policies into policy memory slots, and query-response pairs read the policy memory through projection energy.<n>The resulting policy-evidence profile directly mediates the safety verdict and is reused for policy attribution and post-intervention verification.
  arXiv  Detail & Related papers  (2026-09-12T06:07:43Z)
• EMERGE-Policy: A Robot Mind Emerges Beyond a Single Policy [48.898967774856466]
  EMERGE-Policy coordinates both capability invocation and information exchange.<n>Main Agent retains task-level state within an active context window.<n>Role-specific Sub Agents process perception, execution monitoring, verification, and memory consolidation.
  arXiv  Detail & Related papers  (2026-08-30T16:46:06Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• ElephantAgent: Contextual State Continuity in Agentic Systems [8.106306932558722]
  Recent tool and memory poisoning attacks show that maliciously crafted tool descriptors and poisoned memory can covertly bias agent behavior.<n>We present ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning.
  arXiv  Detail & Related papers  (2026-07-02T09:18:09Z)
• VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills [13.980239249972819]
  VIGIL is an end-to-end runtime enforcement framework for agentic systems.<n>It checks an agent's actual execution trace against behavioral policies from skill specifications, operator-defined constraints, and global rules spanning multiple skills.<n>It detects policy violations with over 95% recall and a false-positive rate below 10%.
  arXiv  Detail & Related papers  (2026-06-25T01:58:44Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• Deontic Policies for Runtime Governance of Agentic AI Systems [2.1095754823099657]
  We propose AgenticRei, which realizes key governance requirements such as obligations, dispensations, policy conflict resolutions, and reasoning over policies.<n>Our approach composes naturally with industry-standard frameworks like A2AS.
  arXiv  Detail & Related papers  (2026-06-17T18:02:07Z)
• Can Generalist Agents Automate Data Curation? [58.652262227632406]
  Curating training data is among the most consequential yet labor-intensive parts of modern AI development.<n>We ask whether generalist coding agents can automate this data-curation loop.<n>We introduce *Curation-Bench*, an agent-centric benchmark that fixes the model, training recipe, and evaluation suite.
  arXiv  Detail & Related papers  (2026-06-02T22:26:53Z)
• AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions [78.49000936275773]
  We introduce AgentHijack, a benchmark designed to evaluate the robustness of computer-use agents under common corruptions.<n>We evaluate a variety of desktop tasks that utilize MLLM-based agents and discover that even minor instances of corruption can result in substantial performance degradation.<n>We propose AgentHijack-Agent, a framework that integrates an action generator with enhanced grounding capabilities and an onlooker responsible for behavior summarization and environment checking.
  arXiv  Detail & Related papers  (2026-05-25T11:09:22Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• Near-Miss: Latent Policy Failure Detection in Agentic Workflows [9.719140082591956]
  We introduce a novel metric for detecting latent policy failures in agent conversations traces.<n>Our results show that latent failures occur in 8-17% of trajectories involving mutating tool calls.
  arXiv  Detail & Related papers  (2026-03-31T12:26:35Z)
• Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agents [5.90411280561446]
  We introduce an SMT solver-aided framework to enforce tool-use policy compliance in TaLLM agents.<n>Specifically, we use an LLM-assisted, human-guided approach to translate natural-language-specified tool-use policies into formal logic.<n>At runtime, planned tool calls are intercepted and checked against the constraints using the Z3 solver as a pre-condition to the tool call.
  arXiv  Detail & Related papers  (2026-03-20T19:25:43Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• InfiAgent: An Infinite-Horizon Framework for General-Purpose Autonomous Agents [36.740230738304525]
  InfiAgent keeps the agent's reasoning context strictly bounded regardless of task duration.<n>InfiAgent with a 20B open-source model is competitive with larger proprietary systems.
  arXiv  Detail & Related papers  (2026-01-06T17:35:57Z)
• QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systems [22.833567409552074]
  textscQuadSentinel is a four-agent guard that compiles safety policies into machine-checkable rules.<n>textscQuadSentinel improves guardrail accuracy and rule recall while reducing false positives.
  arXiv  Detail & Related papers  (2025-12-18T07:58:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.