Skip to content

PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents

🕒 Published (v1): 2026-06-28 00:00 UTC · Source: HuggingFace · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

PolicyGuard introduces a sub-agent Verifier that intercepts every mutating tool call in an LLM agent loop, reads the full agent–user dialogue, reasons over the raw policy document and an LLM-generated per-tool checklist, and returns either PASS or BLOCK with a conversation-specific remediation message. On \(\tau^2\)-BENCH airline, PG-CHECKLIST lifts PASS4 by +12.0/+6.0/+12.0 pp across GPT-5.4/Claude Sonnet 4.6/Gemini 2.5 Pro — the only configuration that improves every vendor without regressing on either the refusal-required or mutation-required slice.

Problem

  • Company-policy adherence in LLM agents is treated as a safeguarding problem (harmful-content blocking), but \(\sim\)2/3 of \(\tau^2\)-BENCH airline policy is process-level: procedural preconditions like "user explicitly confirmed", "insurance was offered", or "identity verified" — predicates over the open-ended dialogue, not over tool arguments or toxicity.
  • Even frontier ReAct agents leave a large PASS4 gap (GPT-5.4 \(\sim\)46%, Claude Sonnet 4.6 \(\sim\)72%) because the policy lives only in the system prompt and prompt-level instruction is insufficient.
  • Existing argument-level verifiers (ToolGuard, Solver-Aided, PCAS) are structurally dialogue-blind or resort to brittle string-matching; Nemo Guardrails reads the dialogue but is bound to scripted flows.

Method

  • Architecture: A Verifier sub-agent sits between Agent and Environment. Every mutating tool call is intercepted; read-only calls bypass verification.
  • Offline (once per domain): A four-step LLM pipeline (no hand-authoring) converts the raw policy document into a per-tool YAML checklist with typed requirements — data-verification (cite a specific read-only tool that should have been called) and procedural (cite a conversational predicate, e.g. "user confirmed after seeing the full summary").
  • Online (per mutating call): The Verifier issues one LLM completion (temperature 0) with three inputs: (i) the pending tool call, (ii) the policy specification (raw text + optional generated checklist), and (iii) the full formatted agent–user history. Output is a per-requirement MET/NOT MET list followed by PASS or BLOCK with a 1–3 sentence remediation message.
  • Protocol: Verifier is paired with the agent (same vendor and tier) so cross-vendor differences reflect method quality, not stronger substrate rescuing a weaker agent.
  • Policy variants compared: PG-RAW (policy text only), PG-CHECKLIST (text + generated checklist, headline), PG-RAW-TRAJ (drops dialogue as ablation), PG-CHECKLIST-ONLY (drops raw policy text as ablation).

Key Contributions

  • Argues that company-policy adherence is a distinct problem from safety/harm safeguarding — the failure mode is procedural, not content-based, and the load-bearing input is the dialogue, not a single tool-call tuple.
  • Proposes PolicyGuard, the first verifier to simultaneously provide conversation-awareness, self-reasoning over policy, and behavior-driving remediation.
  • PG-CHECKLIST is the only configuration across all three frontier agents that lifts PASS4 without causing mutation-regression on any agent, and reaches perfect PV refusal (24/24) on every vendor.
  • Per-call analysis shows higher policy-violation (PV) recall at roughly half the block rate of argument-level guards, with fewer remediation turns per mutation trajectory.

Results

  • Cross-vendor PASS4 lift (PG-CHECKLIST vs. baseline): GPT-5.4 +12.0 pp (0.460 → 0.580), Claude Sonnet 4.6 +6.0 pp (0.720 → 0.780), Gemini 2.5 Pro +12.0 pp (0.480 → 0.600).
  • Slice decomposition (PG-CHECKLIST): Perfect PV PASS4 (1.000 on all agents); Mut PASS4 non-regressed or improved — GPT-5.4 0.192 (flat), Sonnet 4.6 0.500 → 0.577, Gemini 2.5 Pro 0.231 (flat).
  • Dialogue ablation (PG-RAW-TRAJ): Removing the dialogue causes Mut PASS1 to collapse from 0.260 to 0.000 — the verifier blocks everything and can no longer discriminate legitimate from violating mutations. Dialogue grounding is causal.
  • Policy-text ablation (PG-CHECKLIST-ONLY): Removing raw policy text from PG-CHECKLIST drops Mut PASS1 by −15.4 pp; adding it back recovers but does not reach the full-dialogue ceiling. Policy text is augmenting, not causal.
  • Cost knob (GPT-5.4 agent, mini verifier): PG-CHECKLIST with GPT-5.4-mini loses −6 pp PASS4 vs. full-size verifier but still matches ToolGuard's PASS4 (0.520) with higher PV recall (0.917 vs. 0.875) at \(\sim\)13% per-trial cost saving.
  • Weak-agent transfer (GPT-5.4-mini agent + mini verifier): PG-CHECKLIST lifts PASS4 by +16.0 pp over same-agent baseline — the weaker the agent, the more the verifier helps. ToolGuard collapses Mut to 0/26 on this agent.
  • ToolGuard comparison: ToolGuard lifts GPT-5.4 but regresses Sonnet 4.6 (−14 pp) and Gemini 2.5 Pro (−4 pp). It inflates Mut trajectories at 1.5–2.3\(\times\) PG-CHECKLIST's rate (the static error leaves the agent guessing the next action).

Limitations

  • Evaluated only on \(\tau^2\)-BENCH airline (50 tasks, n=4 per cell); retail and telecom audits appear in Appendix K (scoping rationale in §6).
  • Requires one LLM completion per mutating tool call — adds latency and per-call cost.
  • Verifier quality depends on the LLM-generated checklist; no formal guarantees about coverage or correctness.
  • The paired-verifier protocol (same model for agent and verifier) is methodologically clean but may not reflect real deployments where the verifier budget is constrained.
  • ToolGuard uses a human-curated Step 1 mapping for guard generation vs. PolicyGuard's fully automated LLM pipeline — a slight evaluation asymmetry.

Relevance to Agentic AI / LLM Agents

PolicyGuard tackles a critical bottleneck for deploying LLM agents in enterprise customer-facing loops: ensuring that every action satisfies procedural preconditions (consent, identity verification, prerequisite reads) without requiring developers to hand-author guards for every tool. Its dialogue-grounded, self-reasoning verification paradigm — combined with conversation-specific remediation that guides the agent's next turn — directly addresses the gap between today's harmful-content safeguards and the process-level compliance demands of real multi-turn agent workflows.