PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents

• URL: http://arxiv.org/abs/2606.29225v1
• Date: Sun, 28 Jun 2026 06:27:36 GMT
• Title: PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents
• Abstract summary: LLM agents handle user requests on behalf of organizations through tool calls.<n>Prior work approaches this as a safeguarding problem -- external checks block non-compliant agent actions.<n>We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn.
• Score: 46.25624714630383
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is a broader problem: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value. Meeting this bar requires (i) full conversation context, (ii) self-reasoning over the policy and the current dialogue, and (iii) conversation-specific remediation that guides the agent's next turn -- three capabilities that prior safeguard work has often underestimated. We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn. On tau^2-BENCH airline across three vendors (GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro) with four trials per setting, POLICYGUARD improves PASS4 by +12.0 / +6.0 / +12.0 pp. Per-call analyses show POLICYGUARD achieves higher policy-violation recall while blocking roughly half as often as argument-level guards.

Related papers

• Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control [33.97165894442089]
  Personal AI agents are increasingly given access to a user's private data and communications.<n>This creates a persistent privacy risk: the agent must decide whether a given sensitive information should be disclosed to a particular party.<n>We present FLOWSEAL, a defense that enforces confidentiality through a tool-level interceptor outside the agent's context.
  arXiv  Detail & Related papers  (2026-09-12T15:31:37Z)
• PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents [46.25624714630383]
  PolicyGuide compiles each domain policy into a workflow graph and invokes a proactive verifier at userturn boundaries.<n>From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path.
  arXiv  Detail & Related papers  (2026-08-20T10:13:19Z)
• How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement [55.966820779528376]
  As AI agents gain prevalence, users are increasingly exposed to the risks such systems entail.<n> Prompt injection attacks, as well as hallucination, can cause agents to leak private information to third parties.<n>As autonomous systems, agents present the more active danger of performing sensitive tasks, such as bank transactions, without the user's intent or authorization.
  arXiv  Detail & Related papers  (2026-07-15T11:36:22Z)
• Communication Policy Evolution for Proactive LLM Agents [58.4960889232199]
  This paper formalizes Communication Policy, establishes textual and UI-based policies, and then evaluates communication policies across diverse environments.<n>We propose Communication Policy Evolution (CPE), a self-evolution framework for refining communication policies through rollout and prompt-level evolving.
  arXiv  Detail & Related papers  (2026-06-12T09:54:01Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• Policy Compiler for Secure Agentic Systems [20.346157626726725]
  We present PCAS, a Policy Compiler for Agentic Systems that provides deterministic policy enforcement.<n>We evaluate PCAS on three case studies: information flow policies for prompt injection defense, approval in a multi-agent pharmacovigilance system, and organizational policies for customer service.
  arXiv  Detail & Related papers  (2026-02-18T18:57:12Z)
• Analyzing and Internalizing Complex Policy Documents for LLM Agents [53.14898416858099]
  Large Language Model (LLM)-based agentic systems rely on in-context policy documents encoding diverse business rules.<n>This motivates developing internalization methods that embed policy documents into model priors while preserving performance.<n>We introduce CC-Gen, an agentic benchmark generator with Controllable Complexity across four levels.
  arXiv  Detail & Related papers  (2025-10-13T16:30:07Z)
• PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents [60.23552141928126]
  PSG-Agent is a personalized and dynamic system for LLM-based agents.<n>First, PSG-Agent creates personalized guardrails by mining the interaction history for stable traits.<n>Second, PSG-Agent implements continuous monitoring across the agent pipeline with specialized guards.
  arXiv  Detail & Related papers  (2025-09-28T03:31:59Z)
• Effective Red-Teaming of Policy-Adherent Agents [10.522087614181745]
  Task-oriented LLM-based agents are increasingly used in domains with strict policies, such as refund eligibility or cancellation rules.<n>We propose a novel threat model that focuses on adversarial users aiming to exploit policy-adherent agents for personal benefit.<n>We present CRAFT, a multi-agent red-teaming system that leverages policy-aware persuasive strategies to undermine a policy-adherent agent in a customer-service scenario.
  arXiv  Detail & Related papers  (2025-06-11T10:59:47Z)
• Certifiably Robust Policy Learning against Adversarial Communication in Multi-agent Systems [51.6210785955659]
  Communication is important in many multi-agent reinforcement learning (MARL) problems for agents to share information and make good decisions. However, when deploying trained communicative agents in a real-world application where noise and potential attackers exist, the safety of communication-based policies becomes a severe issue that is underexplored. In this work, we consider an environment with $N$ agents, where the attacker may arbitrarily change the communication from any $CfracN-12$ agents to a victim agent.
  arXiv  Detail & Related papers  (2022-06-21T07:32:18Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.