If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary

• URL: http://arxiv.org/abs/2608.27646v1
• Date: Thu, 27 Aug 2026 19:35:48 GMT
• Title: If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary
• Abstract summary: Out-of-Band Policy Enforcement (OBPE) is a trusted boundary outside agent reasoning.<n>OBPE authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response.
• Score: 0.07499722271664146
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.

Related papers

• Codebook Agent: Amortized Topology Design for LLM Multi-Agent Systems [67.04448659688579]
  We develop a query-independent 16-entry codebook that ranks the top decoded candidates in a single batched forward pass.<n>With no iterative search and no message passing at test time, Codebook Agent is the most accurate method on all six benchmarks.
  arXiv  Detail & Related papers  (2026-09-02T08:10:22Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems [7.734540679538682]
  LLM agents increasingly read untrusted content, invoke external tools, access private data, and delegate work to other agents.<n>We present AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems.
  arXiv  Detail & Related papers  (2026-08-24T06:56:00Z)
• Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents [45.88028371034407]
  Tool-using large language-model agents can complete a task while exercising authority that the user did not grant or the task does not need.<n>We propose a framework where each action is audited before execution and again from observed effects along six dimensions of risk.<n>We find that after training using this framework on Qwen3.5-4B over 1,500 tasks, the selected seed reaches 98.48% safe success across 2,896 evaluation episodes.
  arXiv  Detail & Related papers  (2026-08-18T22:07:23Z)
• Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance [6.411104724993454]
  We introduce Fiducia-bench, a benchmark for the governability of financial agents.<n>We use it to study a question no prior benchmark addresses: does an agent degrade its governance?<n>Policy-relevant facts discovered by one component are attenuated at the handoff boundary before reaching the component that must act on them.
  arXiv  Detail & Related papers  (2026-08-17T03:31:59Z)
• The Recall Trap: A Recall-Maximizing Retriever Configuration Reduces Issue Resolution in Fixed-Budget Code Context [45.88028371034407]
  We report a controlled case study in code repair, not a new phenomenon.<n>We toggle one flag (one-chunk-perfile deduplication) on an otherwise identical stack.<n>We map where it holds: it reverses on a lexical BM25 (3.2pp, significant cross-paradigm interaction)<n>We show that at a tight fixed budget, do not hard-deduplicate by file, and A/B packing policies against the task, not the metric flag was tuned.
  arXiv  Detail & Related papers  (2026-08-14T19:22:50Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• Agent Security Needs Redefinition through a Holistic Framework [46.88917910966891]
  Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action.<n>We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory.
  arXiv  Detail & Related papers  (2026-07-24T06:43:09Z)
• Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents [1.6567880228735357]
  In policy-permissive environments, a tool may execute any well-formed call even when the corresponding state transition is forbidden by domain policy.<n>We study this failure mode in the $2$-bench airline domain.<n>We evaluate a lightweight intervention: deterministic, read-only pre-execution gates.
  arXiv  Detail & Related papers  (2026-07-08T13:38:54Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• Policy-Invisible Violations in LLM-Based Agents [10.660248467840821]
  We call this failure mode policy-invisible violations: cases in which compliance depends on entity attributes, contextual state, or session history absent from the agent's visible context.<n>We present PhantomPolicy, a benchmark spanning eight violation categories with balanced violation and safe-control cases.<n>We introduce Sentinel, an enforcement framework based on counterfactual graph simulation.
  arXiv  Detail & Related papers  (2026-04-14T01:15:15Z)
• Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents [0.0]
  Open Agent Passport (OAP) is an open specification and reference implementation that intercepts tool calls synchronously before execution.<n>OAP enforces authorization decisions in a measured median of 53 ms (N=1,000)<n>The same infrastructure that enforces security constraints also enforces quality gates, operational contracts, and compliance controls.
  arXiv  Detail & Related papers  (2026-03-21T21:34:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.