Skip to content

Executable Governance for AI: Translating Policies into Rules Using LLMs

🕒 Published (v1): 2025-12-04 03:11 UTC · Source: Arxiv · Venue: AAAI · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Policy→Tests (P2T) is a pipeline that converts natural-language AI governance documents (EU AI Act, HIPAA, NIST RMF, etc.) into machine-readable, executable rules via LLM extraction guided by a compact JSON DSL. Generated rules match human annotators on span- and field-level metrics, and HIPAA-derived guardrails applied to a generative agent cut violation rates from 34% to 5% overall (58% to 8% on obfuscated prompts).

Problem

AI governance frameworks (EU AI Act, NIST RMF, HIPAA) are written as nonprescriptive prose. Translating these into concrete, executable compliance checks requires manual expert effort—slow, error-prone, unscalable, and blocking real deployment of safeguards. Existing tools (NeMo Guardrails, OPA/Rego, OpenAI Evals) all presuppose rules already exist; none automate the prose-to-rule conversion step.

Method

P2T is a six-stage modular pipeline: 1. Ingestion & chunking — paragraph-level spans with section headers for provenance. 2. Clause mining — deterministic deontic marker detection to filter obligation-bearing spans, reducing downstream LLM cost. 3. Structured extraction — LLM generates atomic JSON rules under a strict DSL schema (fields: scope, hazard, conditions, exceptions, requirement, evidence, severity, is_testable). An LLM judge flags invalid outputs; a repair LLM applies minimal edits. Optional SMT consistency checks encode rules as logical constraints to detect contradictions; counterfactual paraphrases test polarity sensitivity. 4. De-duplication — structural (canonical signature hash) then semantic (embedding similarity clustering) passes. 5. Testability tagging — LLM rubric assigns is_testable boolean and evidence channel labels (io_check, log_check, config_check, etc.). 6. Example generation — benign and adversarial prompt pairs for I/O-testable rules.

Rules are rendered as NeMo Colang snippets, Guardrails validators, OPA/Rego policies, or Evals prompts. GPT-5-mini and GPT-4o-mini are evaluated as extraction backends.

Key Contributions

  • P2T pipeline and open-source DSL for automated prose-to-executable-rule conversion.
  • Human-annotated gold set across four heterogeneous policy documents (427 unique rules; inter-annotator span κ = 0.83 ± 0.03).
  • Ablation study showing Judge+Repair improves coverage, Span F1, and field similarity; semantic de-duplication trades recall for redundancy reduction.
  • Case study demonstrating HIPAA-derived NeMo guardrails reduce agent violation rates from 34% to 5% overall, and from 58% to 8% on obfuscated prompts.
  • Open release of codebase, DSL schema, prompts, and policy-derived rule sets.

Results

  • Span F1: 0.75–0.84 across documents (vs. human gold); AUPRC 0.70–0.91.
  • Coverage (fraction of gold spans matched): 0.55–0.76.
  • SE slot similarity (structured field quality): 0.24–0.36.
  • Testability accuracy: matches Span F1 (0.55–0.84).
  • Ablation (GPT-5-mini): Judge+Repair raises coverage 0.929→0.944, Span F1 0.971→0.978, requirements similarity 0.539→0.563.
  • Agent safety case study: Baseline overall violation rate 34%; guarded agent 5%. Obfuscated bucket: 58% → 8%. Compositional bucket: 42% → 6%.
  • Pipeline cost: ~$20 total for 4 documents (~42M input tokens); 30 min–3 h per document vs. 5–19 expert-hours per document for manual annotation.

Limitations

  • Ambiguous, context-dependent, or cross-referenced clauses yield incomplete or incorrect rules (dropped qualifiers, scope misassignment).
  • DSL cannot capture temporal or probabilistic constraints; coarse slots blur "may"/"should"/"shall" distinctions.
  • LLMs can hallucinate plausible-but-incorrect rules; rigorous human validation remains necessary.
  • Clause mining heuristics degrade on documents with non-standard drafting styles or domain shifts.
  • No established external benchmark exists; evaluation relies on internal human gold sets and ablations rather than cross-system comparison.
  • Judge outputs were not double-annotated; their utility is inferred from downstream metric gains only.

Relevance to Agentic AI / LLM Agents

P2T directly addresses runtime safety enforcement for deployed LLM agents: its output rules are designed to slot into NeMo Guardrails, OPA/Rego, and similar runtime guardrail frameworks that wrap generative agents. The case study—attaching HIPAA-derived output rails to a generative agent—is a concrete demonstration of automated policy grounding improving agent safety against both direct and obfuscated adversarial prompts. For researchers building agents that must operate under regulatory constraints (healthcare, finance, EU AI Act high-risk categories), this provides a scalable path from governance prose to enforceable agent behavior without hand-authoring every rule.