VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills

• URL: http://arxiv.org/abs/2606.26524v1
• Date: Thu, 25 Jun 2026 01:58:44 GMT
• Title: VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills
• Abstract summary: VIGIL is an end-to-end runtime enforcement framework for agentic systems.<n>It checks an agent's actual execution trace against behavioral policies from skill specifications, operator-defined constraints, and global rules spanning multiple skills.<n>It detects policy violations with over 95% recall and a false-positive rate below 10%.
• Score: 13.980239249972819
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Agentic systems increasingly act through third-party skills, allowing model-generated decisions to affect files, communication channels, and cyber-physical devices. These skills often include natural-language specifications that define access permissions, disclosure limits, execution privileges, and required preconditions. Although such specifications describe the intended boundaries of skill behavior, they do not by themselves provide executable runtime enforcement. Enforcing them raises a contextual granularity challenge: even when a policy is written for a particular task context, a monitor must still decide which events to observe, what state to retain, how far across the execution to reason, and where to intervene. Choosing the wrong granularity can either block benign executions or miss violations that emerge only across multiple actions. Most existing enforcement mechanisms, however, assume a fixed event model or enforcement point. In this work, we present VIGIL, an end-to-end runtime enforcement framework for agentic systems. VIGIL checks an agent's actual execution trace against behavioral policies from skill specifications, operator-defined constraints, and global rules spanning multiple skills. To make such policies executable, VIGIL introduces a policy language that captures context-specific enforcement requirements over agent-tool events, including temporal dependencies, argument constraints, and value-flow conditions. The language is paired with symbolic evaluation rules that translate policies into SMT constraints over finite traces, allowing VIGIL to detect violations that depend on event order, argument relationships, or cross-call value flow rather than relying on fixed single-call filters. On real LLM-agent runs spanning office-document, operational, and engineering tasks, VIGIL detects policy violations with over 95% recall and a false-positive rate below 10%.

Related papers

• EMERGE-Policy: A Robot Mind Emerges Beyond a Single Policy [48.898967774856466]
  EMERGE-Policy coordinates both capability invocation and information exchange.<n>Main Agent retains task-level state within an active context window.<n>Role-specific Sub Agents process perception, execution monitoring, verification, and memory consolidation.
  arXiv  Detail & Related papers  (2026-08-30T16:46:06Z)
• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs [11.447078130049512]
  FAVA is a permission-carrying authorization framework for agent execution.<n>We evaluate FAVA across OpenAgentSafety, OctoBench, and ActPlane scenarios.
  arXiv  Detail & Related papers  (2026-07-29T09:41:07Z)
• ETAS: An Effect-Typed Language for Agent Systems [3.1440390119576676]
  ETAS is a programming language for agent systems.<n>It treats model-backed agents, tool calls, prompts, typed memory, human approvals, policies, and execution traces as semantic program elements.
  arXiv  Detail & Related papers  (2026-07-20T10:11:53Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents [39.819141036179225]
  Policy-adherent tool-calling agents in customer-service domains must maintain task states across turns while calling tools and obeying domain policies.<n>We introduce textscLedgerAgent, an inference-time method for tool-calling agents that maintains observed task states in a separate ledger and renders the states into the prompt.
  arXiv  Detail & Related papers  (2026-06-18T17:41:56Z)
• Deontic Policies for Runtime Governance of Agentic AI Systems [2.1095754823099657]
  We propose AgenticRei, which realizes key governance requirements such as obligations, dispensations, policy conflict resolutions, and reasoning over policies.<n>Our approach composes naturally with industry-standard frameworks like A2AS.
  arXiv  Detail & Related papers  (2026-06-17T18:02:07Z)
• Specifying AI-SDLC Processes: A Protocol Language for Human-Agent Boundaries [0.0]
  We propose a domain-specific language for specifying AI-SDLC processes as protocols.<n>The language distinguishes policy (declared intent) from mechanism (structural enforcement)<n>A working implementation demonstrates feasibility; empirical evaluation is future work.
  arXiv  Detail & Related papers  (2026-05-24T02:52:47Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• SARC: A Governance-by-Architecture Framework for Agentic AI Systems [0.0]
  Agentic AI systems increasingly act through tools, sub-agents, and external services, but governance controls are still commonly attached to prompts, dashboards, or post-hoc documentation.<n>We introduce SARC, a runtime governance architecture for tool-using agents that treats constraints as first-class specification objects alongside state, action space, and reward.<n>SARC executes zero hard-constraint violations under exact predicates; its declared PAA throttling response reduces soft-window overages by 89.5% relative to policy-as-code-only.
  arXiv  Detail & Related papers  (2026-05-08T13:34:36Z)
• Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimes [0.0]
  We argue that a skill is emphuntrusted code until it is verified.<n>Without skill verification, a human-in-the-loop gate must fire on every irreversible call.<n>We give a trust schema that includes an explicit verification level on every skill manifest.
  arXiv  Detail & Related papers  (2026-05-01T05:53:05Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• OpenKedge: Governing Agentic Mutation with Execution-Bound Safety and Evidence Chains [2.124730017640531]
  We introduce OpenKedge, a protocol that redefines mutation as a governed process.<n>Intent-to-Execution Evidence Chain (IEEC) links intent, context, policy decisions, execution bounds, and outcomes into a unified lineage.<n>We evaluate OpenKedge across multi-agent conflict scenarios and cloud infrastructure mutations.
  arXiv  Detail & Related papers  (2026-04-07T22:51:08Z)
• SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement [120.52289344734415]
  We propose an automated framework for stealthy prompt injection tailored to agent skills.<n>The framework forms a closed loop with three agents: an Attack Agent that synthesizes injection skills under explicit stealth constraints, a Code Agent that executes tasks using the injected skills and an Evaluate Agent that logs action traces.<n>Our method consistently achieves high attack success rates under realistic settings.
  arXiv  Detail & Related papers  (2026-02-15T16:09:48Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)
• Compromising Embodied Agents with Contextual Backdoor Attacks [69.71630408822767]
  Large language models (LLMs) have transformed the development of embodied intelligence. This paper uncovers a significant backdoor security threat within this process. By poisoning just a few contextual demonstrations, attackers can covertly compromise the contextual environment of a black-box LLM.
  arXiv  Detail & Related papers  (2024-08-06T01:20:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.