Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the $τ^2$-bench airline, retail, and telecom domains with a GPT 5.4 agent and verifier, PolicyGuide raises mean $\mathrm{Pass}^4$ from $0.42$ to $0.62$, with the largest gain on telecom ($0.19$ to $0.61$), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an independently validated workflow-level audit.
LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is broader: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on dialogue rather than on any single argument value. We introduce PolicyGuard, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and returns actionable remediation. On $τ^2$-bench airline across GPT 5.4, Claude Sonnet 4.6, and Gemini 2.5 Pro, PolicyGuard improves $\mathrm{Pass}^4$, the fraction of tasks successful in all four trials, by +12.0 / +6.0 / +12.0 pp; pooled paired tests support an overall cross-vendor effect. We further evaluate PolicyGuard on the full retail and telecom base splits, covering all three $τ^2$-bench customer-service domains. Further analyses show that PolicyGuard improves reliability beyond agent self-checking, catches more policy violations with fewer blocks than argument-level guards, and preserves its refusal accuracy under three adversarial probes.