From Alignment to Access Control: A Framework for GenAI Policy Enforcement

1 Introduction

• The paper connects incidents involving a deleted production dataset and harmful LLM interactions with policies that could have prevented or mitigated them.It identifies access control for the first case and steering away from sycophantic spirals for the second.Source: §1 · pp. 1–2
• Different communities use “policy” to mean different things, while applications may need multiple policies enforced across layers.This diversity makes discovering, specifying, and enforcing policies an open challenge.Source: §1 · p. 2, Figure 2 · p. 3
• GenAI’s dynamic, probabilistic environment makes policy enforcement an interdisciplinary challenge, and not every desired policy can be enforced deterministically.Natural-language policy specification also enables fuzzy policies, but novel enforcement approaches may create a false sense of security and compliance.Source: §1 · p. 3
• The proposed methodology assesses enforcement mechanisms through policy definition, enforcement guarantees, and stack enforcement.It is intended to guide selection for diverse policies applicable to GenAI applications.Source: §1 · p. 4
• The paper finds policy enforcement fragmented across model alignment, runtime guardrails, agent-flow constraints, and access controls, with no unified view across layers.It offers recommendations and discusses open challenges.Source: §1 · p. 4

2 Policies in the Wild

• The paper defines GenAI applications to include LLM-based agents and chatbots, with agents using memory and tools to interact with users or other agents.It describes policy governance as applying to information flows and interactions in this infrastructure.Source: §2 · p. 4
• The paper groups policies found in practice into regulatory, content and behavioral, business compliance and logic, traditional cybersecurity, and system policies.Examples include privacy and harm controls, application-specific rules, tool access, and deployment requirements.Source: §2 · p. 5
• The paper uses “policy” for machine-enforceable requirements, excluding regulatory policies that require decomposition and cannot currently be enforced directly by a machine.Source: §2 · p. 6
• Policies may target single- or multi-turn interactions, tools, agent traces, the harness, or memory.The paper notes that tool policies are often traditional cybersecurity policies, while memory policies often restrict private-data storage.Source: §2 · p. 7
• GenAI applications may require multiple policies enforced at different places in the stack, motivating a framework for assessing approach suitability.Source: §2 · p. 7

3 Proposed Approach to Dissect Policies

• The methodology evaluates policy definition, enforcement guarantees, and stack enforcement to compare approaches and identify gaps.Policy definitions range from strict to fuzzy, enforcement from hard to soft, and stack enforcement concerns where the mechanism operates.Source: §3 · p. 8

3.1 Interactions between policy definition and enforceability

• Concrete policies can use hard enforcement, while fuzzy policies such as preventing sycophancy require soft, stochastic mechanisms.Content moderation can pair deterministic forbidden-word matching with a stochastic model guardrail; the paper says no deterministic mechanism offers provable sycophancy mitigation results.Source: §3.1 · p. 9
• Pretty Please enforcement relies on the LLM and provides no guarantee, so prompts should guide behavior rather than substitute for adequate enforcement.The paper contrasts this with carefully placed access controls and recommends hard mechanisms when the policy definition supports them.Source: §3.1 · pp. 10–12

3.2 The Stack Enforcement and Defense in Depth

• Defense in depth requires protections across application components; an adapted LLM remains a single layer and retains a security gap.Alignment, unlearning, and fine-tuning can reduce that gap, but the paper says it cannot yet be fully closed.Source: §3.2.1 · p. 14

3.2.2 Using Policy Enforcement Points

• Hooks at the right application-stack locations can connect policy enforcement points to suitable mechanisms, including hard controls for authentication and access-token verification.The paper recommends separating policy definition from enforcement points and gives MCP tool-call hooks as one example.Source: §3.2.2 · pp. 14–15

3.3 Enforcing Multiple Policies

• The paper recommends a central control panel with well-specified error logging, while noting that diverse existing mechanisms serve limited policy types.Logging interactions and agreeing on error definitions can support compliance and recovery in multi-agent applications.Source: §3.3 · p. 15
• A single GenAI application may need to enforce multiple concrete and fuzzy policies together, despite unresolved conflicts between their objectives and obligations.Most solutions described rely on content similarity to select a policy to apply.Source: §3.3 · p. 16

4.1 Traditional Cybersecurity Policy Enforcement

• Traditional access-control systems separate policy information, decision, and enforcement points, enabling modular enforcement and policy updates without changing application logic.The PEP intercepts interactions, the PDP decides whether to grant or deny access, and the PIP stores policies.Source: §4.1 · p. 17, Figure 9 · p. 17

4.2 Policies for System, Business Compliance and Logic

• Natural-language policies are transformed into verifiable code or evaluated through prompts, but the reviewed methods do not address multi-stakeholder policies.Examples include tool-invocation checks, Prolog evaluation, and question-answer alignment.Source: §4.2 · pp. 18–19

4.3 Enforcing Policy by Adapting Models or Their Behavior

• Policy enforcement approaches adapt model weights through alignment or unlearning and steer activations at runtime, though steering side effects need further study.YAML-based policy specifications can also define model outputs and exceptions to support compliance verification across agents.Source: §4.3 · p. 19

4.4 Stochastic Methods and Efficacy Evaluation

• FragFuse [83] broke four agents using prompt-based access control and also broke GuardAgent, AGrail, and ShieldAgent; [72] found current models do not respect instruction hierarchies, while [60] found 64.7% of error-encountering rollouts led to dangerous actions.In over half of dangerous failures, unsafe behavior was not reported to the user.Source: §4.4 · p. 20

4.5 Guardrails and Enforcement Frameworks

• Guardrails inspect model inputs and outputs or steer conversation flows, but NeMo Guardrails uses stochastic policy selection and prompt-based enforcement.NeMo specifies valid flows in Colang and selects relevant policies through embedding similarity.Source: §4.5 · pp. 20–21

4.6 Harnesses and Systems

• Agent harnesses and platforms offer hooks, workflow rails, access controls, and content filters, but the reviewed systems lack a default way to resolve conflicts among multiple policies.Open Claw's SOUL.md instructions are characterized as Pretty Please prompts.Source: §4.6 · p. 21

4.7 Policy Composition Conflict Resolution

• Policy conflicts are handled through agent agreement, precedence rules, or semantic similarity, but reviewed approaches provide no formal guarantees across enforcement types.Similarity-based selection introduces stochasticity into decisions that should be deterministic.Source: §4.7 · pp. 21–22

• The analysis surveys diverse policies and enforcement locations, then dissects techniques by policy definition, enforcement guarantees, and stack enforcement.It also summarizes recommendations for selecting enforcement approaches.Source: §5 · p. 22
• For well-defined policies, the authors recommend non-stochastic enforcement rather than unreliable LLM-based mechanisms, which can create false security.The framework also identifies fuzzy policies that could not be enforced before the LLM era.Source: §5 · p. 22
• Prompt-based enforcement by one model is not defense in depth; the authors call for multiple mechanisms beyond the LLM.They cite stochastic failures, jailbreaks, prompt injection, and reward hacking as vulnerabilities.Source: §5 · p. 22
• Stack enforcement should retain logging and Policy Enforcement, Decision, and Information Points, though GenAI-specific nuances complicate direct transfer of some concepts.The authors also point to SELinux-inspired hooks as a possible direction and leave related challenges open.Source: §5 · pp. 22–23
• Two open gaps are standardized failure semantics for policy violations and principled resolution of simultaneous policy conflicts.Current conflict approaches rely on vector similarity, which lacks the formal guarantees of traditional access-control conflict resolution.Source: §5 · p. 23
• The proposed analytical framework offers practitioners a way to identify potential failures and gaps when developing defense-in-depth solutions.Source: §5 · p. 23

• Baracaldo’s work spans adversarial robustness, federated learning, and machine unlearning, alongside trustworthy AI.Source: Author Biography · p. 24