PaperlayerView exact revision on arXiv

Source-linked AI summary

PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents

Seongjae Kang, Taehyung Yu, Sung Ju Hwang

arXiv:2608.19861v1cs.AIcs.CLcs.LG

TL;DR

Customer-service agents need to avoid forbidden actions while completing required multi-step procedures, a gap left by action-local safeguards and workflow systems focused on execution. PolicyGuide compiles policies into workflow graphs and uses a proactive verifier with persisted state to guide agents; across three τ^2-bench domains, it improves mean Pass4 from 0.42 to 0.62 and transfers across agent families.

  • Problem

    Policy compliance requires agents to avoid forbidden actions and complete procedural requirements, but action-local safeguards do not guide multi-step procedures.

  • Method

    PolicyGuide compiles each domain policy into a workflow graph and uses an external verifier at user-turn boundaries to track persisted state and return remediation for unmet steps.

  • Results

    PolicyGuide raises mean Pass4 from 0.42 to 0.62 across airline, retail, and telecom domains, with the same workflows transferring to Claude Sonnet 4.6 and Gemini 2.5 Pro.

  • Takeaways & Limitations

    PolicyGuide treats the procedure, not only the final action, as the unit of policy adherence while separating workflow guidance from the acting agent.

  • Takeaways & Limitations

    Evaluation uses three English synthetic τ^2-bench domains with simulated users, and one frozen GPT-5.4-authored workflow per domain, so author-side generalization remains unestablished.

Abstract

from arXiv · show

Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the $τ^2$-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean $\mathrm{Pass}^4$ from $0.42$ to $0.62$, with the largest gain on telecom ($0.19$ to $0.61$), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.

1 Introduction

Policy compliance requires both safe actions and completion of required procedures. POLICYGUIDE combines workflow guidance with external safeguarding to proactively guide agents through policy-compliant interactions.

  • Customer-service agents must follow policy when booking flights, modifying orders, or changing account plans through user-account tools.
  • Procedural requirements are pervasive, appearing in 67.4% of airline, approximately 100% of retail, and 98.0% of telecom policies.Ordered workflow requirements are concentrated in telecom: 54.0%, versus 4.7% in airline and 3.6% in retail.
  • Action guards check only final mutating calls, discovering skipped prerequisites late and returning blocks after the procedure has failed.
  • Workflow systems guide prescribed procedures, but their checks primarily support faithful workflow execution rather than safeguarding general-purpose agent behavior.
  • POLICYGUIDE compiles policies into workflow graphs and uses an external proactive verifier to track graph position, reconcile requests, and remediate the first unmet step.The verifier operates at user-turn boundaries and guides the agent through required steps before recommending a mutation.
  • POLICYGUIDE raises mean PASS4 from 0.42 to 0.62 across airline, retail, and telecom, with a 0.19-to-0.61 gain on telecom.The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro, while complementary evaluations report 20-point mean PASS4 gains, adversarial robustness, and stronger workflow compliance.

2 Background and Related Work

PolicyGuide bridges action-focused safeguards and workflow-focused systems by giving an external verifier persistent workflow state and responsibility for guiding policy-compliant agent behavior.

  • POLICYGUIDE connects runtime safeguards that monitor agent behavior with workflow-guided systems that execute prescribed procedures.
  • Runtime safeguards: Most runtime safeguards are action-scoped, so process-level requirements may remain unreachable or be checked only around risky actions.PolicyGuard is dialogue-aware but remains action-scoped because it does not persist workflow position or proactively guide missing steps.
  • Workflow- and SOP-guided agents: Workflow and SOP systems encode procedures as graphs or state machines, but primarily study faithful workflow execution rather than safeguarding policy-violating agent behavior.
  • POLICYGUIDE: POLICYGUIDE uses an external verifier to monitor interactions, persist workflow state, and return remediation for unmet steps while pairing the same workflow with different agents.This separates workflow safeguarding from the acting agent architecture and supports transfer across agent runtimes.

3 Method

PolicyGuide separates offline policy compilation from online enforcement, using an external verifier to traverse persisted workflow state and guide a general-purpose agent at user-turn boundaries. The runtime reconciles requests, checks requirements against the interaction, and returns targeted remediation and authorization state.

  • Architecture: PolicyGuide compiles domain policies into reusable workflow graphs and uses an external runtime verifier to guide agents through required procedures.Offline generation extracts policy and tool structure, validates workflows, and freezes one graph per domain for workflow-based conditions.
  • Motivation: The design distinguishes workflow-level guidance from action-local safeguards because policy deviations can occur during evidence gathering, instructions, branching, or completion decisions.A later action check cannot undo a procedural violation already committed before a permissible mutation.
  • Interface: The verifier maps raw policy, tools, graph, history, and code-owned state to merged remediation and updated request records.Code validates node identifiers, filters authorization outputs against the mutating-tool inventory, reconstructs enabled tools, and persists request progress.
  • Runtime: The verifier fires before each user-turn response and after an unauthorized mutating call, judging the complete interaction trajectory.Intercepted calls trigger corrective verification, while other workflow-governed actions receive remediation rather than hard gating.
  • Runtime: For each open request, the verifier resumes from persisted graph position, reconciles request status, and stops at the first unsatisfied requirement.Facts and eligibility require grounded tool evidence, while user choices and consent can be established from user messages.

4 Experiments

Experiments compare PolicyGuide with unguided, action-local, actor-only, and workflow-controller baselines across three domains and multiple agent families. PolicyGuide leads overall outcomes, transfers across agents, reduces adversarial attack success, and achieves the strongest ordered-trace compliance, with important evaluation-scope caveats.

  • 4.1 Setup: PolicyGuide is evaluated on Airline, Retail, and Telecom tasks covering policy-violation prevention and permitted mutations, with GPT 5.4 as the domain-wide comparison substrate.Base splits contain 50 Airline tasks and 114 each for Retail and Telecom; all main cells use n=4.
  • 4.2 Main results: PolicyGuide achieves the highest overall Pass4 in all three domains, with gains spanning both policy-violation and mutation slices.Its lead persists as k increases, and pooled paired tests favor it over both baselines.
  • 4.2 Main results: In Retail, PolicyGuide preserves ReAct’s mutation performance while improving policy-violation performance, unlike PolicyGuard’s trade-off between those slices.The overall Retail difference is not significant.
  • 4.3 Ablations: PolicyGuide improves overall Pass4 over its raw-policy ablation by 0.100 on Airline, 0.150 on Retail, and 0.325 on Telecom.The larger Telecom gap is consistent with explicit graph position helping resume long, ordered diagnostic chains, although the ablations are not a complete factorial decomposition.
  • 4.5 Agent-family generalization: The same GPT 5.4-authored Airline workflow transfers to Claude Sonnet 4.6 and Gemini 2.5 Pro without re-authoring.For Gemini, PolicyGuide raises Mut Pass4 from 0.231 under either baseline to 0.462; transfer across workflow-author models remains untested.
  • 4.7 Workflow compliance: PolicyGuide attains the highest Telecom process-valid rate at 56.2%, versus 17.5% for ReAct and 13.1% for PolicyGuard.Process validity requires both benchmark outcome success and the author-designed ordered-trace rubric; conditional diagnostics characterize successful traces.

5 Conclusion

PolicyGuide treats the procedure, not only the final action, as the unit of policy adherence by combining compiled workflow graphs with an external verifier that persists progress. Across domains, agent families, and complementary audits, it achieves strong policy-constrained outcomes and procedural compliance.

  • Conclusion: PolicyGuide replaces action-local checks with an external guide that traverses a compiled policy graph, persists progress, and returns targeted remediation.The approach achieves the best overall Pass4 across three τ^2-bench domains and performs strongest on procedural Telecom.

Limitations

The evaluation is limited to selected synthetic customer-service settings, fixed workflows, and practical runtime schedules. Its workflow-compliance audit and robustness results therefore do not establish broad generalization or unconditional guarantees.

  • Evaluation scope: The study evaluates three English τ^2-bench domains with simulated users, not other policy regimes, languages, or live users.Retail has only 10 PV tasks, and its overall gain over ReAct is not significant.
  • Evaluation scope: The author-designed Telecom trace metric is exploratory, uses deterministic event ordering and text matching, and lacks second-annotator agreement.It is conditioned by gold task actions and does not establish exhaustive natural-language policy compliance.
  • Benchmark coverage: CRAFT robustness is reported only on its clean, release-aligned 20-task Airline split, so cross-domain or adaptive-attack robustness is not established.No official Telecom set exists, and the released Retail materials do not reproduce one consistent paper-faithful task set.
  • Workflow generation and faithfulness: Using one frozen GPT-5.4-authored workflow per domain isolates runtime and executor differences but does not establish author-side generalization across models or seeds.Workflow faithfulness is separately checked by manual verification against source policies and tool specifications.
  • Trigger and cost: The evaluated runtime fires at user-turn boundaries and after one corrective intercept, leaving deviations between intervention points outside the unconditional guarantee.Broader intervention coverage would require more verifier calls, costing approximately $0.40 per conversation.
  • Probabilistic enforcement: Because node judgments are probabilistic and exceptions fail open, PolicyGuide provides empirical adherence rather than a hard guarantee.High-stakes deployments require an additional deterministic monitor for the formally expressible policy subset.

Ethics Statement

PolicyGuide is presented as a probabilistic aid rather than a guarantee, and its deployment scope requires safeguards for verifier data and generated workflows. The experiments use synthetic tasks and simulated users without real customer data or external actions.

  • Ethics and deployment: PolicyGuide is a probabilistic aid for policy adherence, not a guarantee or sole control for high-stakes actions.Its verifier reads conversation, tool results, and persisted workflow state.
  • Ethics and deployment: Verifier calls and logs require privacy, access-control, retention, and auditing requirements.These requirements extend to the interaction data processed by the verifier.
  • Ethics and deployment: Experiments use synthetic τ^2-bench tasks and simulated users, with no real customer data or external actions.Deployment also requires policy-owner review, monitoring, and a safe fallback because generated workflows may reproduce policy errors or add unsupported restrictions.

A.1 Intervention coverage

The appendix formalizes intervention coverage: preserving workflow validity requires checking every reachable first deviation before commitment. It contrasts workflow-level and action-triggered schedules, then relates the formal distinction to policy structures across airline, retail, telecom, and technical-support settings.

  • A.1 Intervention coverage: A policy workflow defines compliant complete sequences, while a partial sequence is valid when it can still be completed to one.The set PG denotes valid prefixes of the workflow language.
  • A.1 Intervention coverage: A reachable first deviation is an agent event that would extend a valid prefix into an invalid one; a schedule covers it only before commitment.The action-triggered schedule mediates only events in the designated action class A.
  • A.1 Intervention coverage: Under the theorem’s ideal assumptions, a firing schedule preserves procedural validity exactly when it covers every reachable first deviation.The sufficiency proof proceeds by induction over the interaction, rejecting uncovered invalid proposals before commitment.
  • A.1 Intervention coverage: Workflow-level firing covers every policy-relevant agent action, whereas action-triggered firing guarantees validity only when every first deviation triggers the check.A later action-triggered verifier cannot prevent or undo an earlier procedural violation.
  • A.1 Intervention coverage: The evaluated boundary schedule preserves validity only if every reachable first deviation occurs between a scheduled firing and the next committed agent event.Its practical runtime therefore measures risk reduction rather than providing an unconditional formal guarantee.
  • Policy structure: The paper extends prior argument/process classifications with a workflow-level class to examine how procedural structure relates to observed gains.Airline has 2 workflow-level requirements among 43, while retail has 1 among 28.
  • Policy structure: Telecom has the strongest workflow structure, with 7 workflow-level requirements among 29; technical support has 20 among 21 and mandates diagnose, conditional fix, and re-verify.Retail is flatter, with one workflow-level requirement among 28 and no branching or verify-after-act structure.

B.5 Policy structure and observed gains

Workflow-level requirements are especially concentrated in telecom, where PolicyGuide’s persisted graph state can exploit ordered procedures. Its compiled-graph gain is correspondingly largest in telecom.

  • Telecom’s workflow-level mass is concentrated in the overdue-payment state machine, suspension procedure, and diagnostic manual.
  • Telecom’s technical-support manual contains 21 requirements, including 20 workflow-level requirements and one process-level requirement.
  • +0.325 is PolicyGuide’s compiled-graph gain over the matched raw-policy guide on telecom, compared with +0.100 on airline and +0.150 on retail.
  • PolicyGuide tracks position across workflow-graph turns, targeting the locations where telecom’s workflow-level requirements concentrate.

C Reliability and significance

The evaluation reports task-level Pass^4 results on shared base splits and tests paired system differences across domain strata. Pooled comparisons favor PolicyGuide over the baselines with very small p-values.

  • The base splits are Airline base-50 and Retail/Telecom base-114.
  • Pass^4 equals one only when all four trials for a task succeed.
  • Paired bootstrap confidence intervals use 10,000 task-level resamples on common tasks.
  • PolicyGuide improves pooled Pass^4 over ReAct with p < 10^-8 and over PolicyGuard with p < 10^-12.
  • A signed domain-level difference interval crossing zero indicates that the difference is not statistically distinguishable from zero.

D.1 Guide-side usage

PolicyGuide adds recurring verifier inference whose cost and latency are driven by structured workflow audits. Prompt caching reduces repeated input processing, but output generation and repeated calls remain substantial overhead.

  • The guide costs $0.34–$0.56 per task and fires 7.4–11.5 times per task in the GPT-5.4 configuration.Telecom is higher because its diagnostic workflows require longer interactions.
  • 67.5–71.0% of guide spend comes from output generation, despite 85.8–88.1% of prompt tokens being cached.
  • Reducing guide output length is the main remaining cost-optimization opportunity.Caching reduces repeated input processing but does not eliminate the verifier’s marginal cost.
  • PolicyGuide requires 5.45–5.78× ReAct’s observed wall-clock time per task.The measurement includes actor, verifier, user-simulator, and tool execution.
  • Each firing uses one verifier generation for all open requests and may advance across several satisfied workflow nodes.Guide calls scale with relevant agent turns rather than individual workflow nodes or tool observations.
  • Frozen workflows were checked through manual review and programmatic validation of schemas, composition, references, reachability, branches, and authorization coverage.
  • The Telecom disable_roaming flag is outside the authorized workflow scope because the source policy specifies enabling, not disabling, roaming.

F Call-level near-miss audit

The call-level near-miss audit measures missing prior-read prerequisites among successful mutating calls, with a domain-specific Telecom adaptation. Its results are lowest for PolicyGuide on Airline but cannot establish full procedural quality in Telecom.

  • Call-NMR is the fraction of successfully executed mutating calls in passing Mut trajectories that lack an earlier read required by a frozen guard.Blocked attempts, tool errors, and calls without successful responses are excluded.
  • On Airline, PolicyGuide has the lowest observed Call-NMR at 15.6%, versus 25.4% for ReAct and 32.5% for PolicyGuard.
  • On Retail, PolicyGuide and PolicyGuard are effectively tied at 34.7% and 34.8%, while PolicyGuide supports 116 outcome-passing Mut trajectories versus 80.Call-NMR audits prior-read coverage conditional on success, not task coverage or complete procedural validity.
  • The Telecom adaptation covers only agent-side carrier mutations because user/device actions fall outside the agent-call oracle.
  • The adapted Telecom read oracle yields 0.0% for all three primary systems, but cannot express conversational evidence or ordering among user/device actions.This ceiling effect motivates workflow-level expansion of prerequisite analysis.
Loading 2608.19861v1…