PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents

• URL: http://arxiv.org/abs/2608.19861v1
• Date: Thu, 20 Aug 2026 10:13:19 GMT
• Title: PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents
• Abstract summary: PolicyGuide compiles each domain policy into a workflow graph and invokes a proactive verifier at userturn boundaries.<n>From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path.
• Score: 46.25624714630383
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the $τ^2$-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean $\mathrm{Pass}^4$ from $0.42$ to $0.62$, with the largest gain on telecom ($0.19$ to $0.61$), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing [80.39644823192113]
  We propose StepGuard, a step-level guard model that can audit completed agent trajectories and check tool actions before they are executed.<n>StepGuard achieves the highest average accuracy among open-weight guard models, with performance comparable to GPT-5.4.<n>When used to guard agents on AgentDojo and AgentDyn, StepGuard reduces mean attack success rate by 77.3%.
  arXiv  Detail & Related papers  (2026-08-25T16:17:27Z)
• AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems [7.734540679538682]
  LLM agents increasingly read untrusted content, invoke external tools, access private data, and delegate work to other agents.<n>We present AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems.
  arXiv  Detail & Related papers  (2026-08-24T06:56:00Z)
• OpenAgentFlow: Enabling System-Wide Safety Boundaries for Heterogeneous AI Agent Fleets [30.42587289236515]
  We present OpenAgentFlow, a control-plane/action-plane architecture that establishes the action-commit boundary as a shared enforcement interface.<n> GUI, API, tool, and LLM-generated actions are normalized into a common AgentEvent stream and mediated by a shared pre-execution Policy Enforcement Point.<n>This provides a common governance layer across incompatible executors and allows new policies to take effect without modifying agents, prompts, models, or execution paths.
  arXiv  Detail & Related papers  (2026-08-14T02:55:59Z)
• PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents [46.25624714630383]
  LLM agents handle user requests on behalf of organizations through tool calls.<n>Prior work approaches this as a safeguarding problem -- external checks block non-compliant agent actions.<n>We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn.
  arXiv  Detail & Related papers  (2026-06-28T06:27:36Z)
• Governance by Construction for Generalist Agents [7.48004748585128]
  This demo presents CUGA's policy system, a modular policy-as-code layer that composes with a generalist agent to deliver predictable, auditable, and compliance-aware behavior.<n>We present a governance architecture that enforces policy interventions at every critical stage of execution.
  arXiv  Detail & Related papers  (2026-05-20T08:13:16Z)
• Near-Miss: Latent Policy Failure Detection in Agentic Workflows [9.719140082591956]
  We introduce a novel metric for detecting latent policy failures in agent conversations traces.<n>Our results show that latent failures occur in 8-17% of trajectories involving mutating tool calls.
  arXiv  Detail & Related papers  (2026-03-31T12:26:35Z)
• Authenticated Workflows: A Systems Approach to Protecting Agentic AI [0.0]
  We introduce authenticated, the first complete trust layer for enterprise agentic AI.<n>We enforce intent (operations satisfy organizational policies) and integrity (operations are cryptographically authentic) at every boundary crossing.<n>This delivers deterministic security--operations either carry valid cryptographic proof or are rejected.
  arXiv  Detail & Related papers  (2026-02-11T03:04:50Z)
• Towards Policy-Compliant Agents: Learning Efficient Guardrails For Policy Violation Detection [25.53228630260007]
  PolicyGuardBench is a benchmark of about 60k examples for detecting policy violations in agent trajectories.<n>PolicyGuard-4B is a lightweight guardrail model that delivers strong detection accuracy across all tasks.<n>Together, PolicyGuardBench and PolicyGuard-4B provide the first comprehensive framework for studying policy compliance in web agent trajectories.
  arXiv  Detail & Related papers  (2025-10-03T20:03:19Z)
• PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents [60.23552141928126]
  PSG-Agent is a personalized and dynamic system for LLM-based agents.<n>First, PSG-Agent creates personalized guardrails by mining the interaction history for stable traits.<n>Second, PSG-Agent implements continuous monitoring across the agent pipeline with specialized guards.
  arXiv  Detail & Related papers  (2025-09-28T03:31:59Z)
• Progent: Programmable Privilege Control for LLM Agents [46.31581986508561]
  We introduce Progent, the first privilege control framework to secure Large Language Models agents.<n>Progent enforces security at the tool level by restricting agents to performing tool calls necessary for user tasks while blocking potentially malicious ones.<n>Thanks to our modular design, integrating Progent does not alter agent internals and only requires minimal changes to the existing agent implementation.
  arXiv  Detail & Related papers  (2025-04-16T01:58:40Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.