arXiv:2606.29225 · v2

PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents

首次提交 2026-06-28 14:27

版本更新 2026-11-09 17:03

雷达观测 2026-11-10 15:22

摘要

LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is broader: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on dialogue rather than on any single argument value. We introduce PolicyGuard, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and returns actionable remediation. On $τ^2$-bench airline across GPT 5.4, Claude Sonnet 4.6, and Gemini 2.5 Pro, PolicyGuard improves $\mathrm{Pass}^4$, the fraction of tasks successful in all four trials, by +12.0 / +6.0 / +12.0 pp; pooled paired tests support an overall cross-vendor effect. We further evaluate PolicyGuard on the full retail and telecom base splits, covering all three $τ^2$-bench customer-service domains. Further analyses show that PolicyGuard improves reliability beyond agent self-checking, catches more policy violations with fewer blocks than argument-level guards, and preserves its refusal accuracy under three adversarial probes.

作者备注：21 pages. Updated manuscript with expanded cross-domain evaluation and analyses