PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents

Abstract: Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the $τ<sup>2$-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean $\mathrm{Pass}<sup>4$ from $0.42$ to $0.62$, with the largest gain on telecom ($0.19$ to $0.61$), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.

• The paper introduces PolicyGuide, an external verifier that compiles policies into workflow graphs, tracks progress across turns, and gates unauthorized tool actions with targeted remediation.
• PolicyGuide achieves the highest Pass⁴ scores in airline (0.620), retail (0.614), and telecom (0.614), including a 0.421 gain over ReAct in workflow-heavy telecom tasks and a 0.675 score against FlowAgent’s 0.350.
• The approach reduces attack success to 0.087 in airline red-team tests and improves process validity to 56.2%, but adds roughly 5.5× ReAct’s latency and does not provide unconditional guarantees between verifier interventions.

Motivation and problem statement

Customer-service LLM agents operating under organizational policy face two distinct compliance failure modes: forbidden actions (e.g., granting an ineligible change) and omitted or misordered procedural requirements (e.g., skipping identification, eligibility checks, or confirmation). The authors' source-policy analysis shows that procedural requirements are pervasive across the τ²-bench domains—67.4% of airline requirements, ~100% of retail, and 98.0% of telecom—but that ordered workflow-level requirements concentrate heavily in telecom (54.0%, versus 4.7% in airline and 3.6% in retail). This asymmetry matters because action-local runtime safeguards can only check flat prerequisites at a guarded mutating call, whereas ordered procedures constrain earlier dialogue and tool-use actions and may contain no agent-side mutation to intercept at all.

Existing work splits along this axis. Runtime safeguards such as ToolGuard, ShieldAgent, GuardAgent, and PolicyGuard monitor agent behavior but are action-scoped; workflow systems such as SOP-Agent, StateFlow, and FlowAgent execute prescribed procedures but target faithful workflow completion rather than safeguarding agent behavior. PolicyGuide (2608.19861) occupies the intersection: an external, agent-agnostic overlay that both guides required steps and gates policy-sensitive actions.

Method

PolicyGuide has two halves. Offline, a multi-stage pipeline compiles each domain's raw policy and tool registry into a frozen workflow graph with typed nodes (agent actions, user inputs, read-only tools, mutating-tool authorization, decisions, subflows), explicit satisfying conditions per node, and authorize→verify pairs for every mutating tool. The graph is schema-validated, checked for reachability and authorization coverage, and manually verified against the source policy without post-hoc editing.

Online, a proactive verifier fires before the agent responds to each user turn (and once more after an unauthorized mutating call is intercepted). Each firing is a single verifier generation $$V_\phi(\pi,\mathcal{T},G,H,S)=(d,\widehat{\mathcal{R}})$$ over the raw policy, tool specs, frozen graph, interaction history, and code-owned request state. The verifier reconciles all open requests against persisted state, traverses each from its recorded node judging satisfying conditions against grounded evidence (tool results establish facts; user messages establish consent), stops at the first unsatisfied node, and returns step-specific remediation plus updated state. Code—not model memory—owns persistence, validates node IDs, filters authorizations against the enumerated tool inventory, and reconstructs the enabled tool set. In the evaluated advisory mode, the first unauthorized mutating call is intercepted once per user-turn region, then the gate disarms for immediate retry.

The paper grounds the design theoretically via intervention coverage: a theorem establishes that an ideal binding verifier preserves procedural validity exactly when its firing schedule covers every reachable first deviation, and corollaries show that a workflow-level schedule satisfies this condition while an action-triggered schedule does so only if every first deviation belongs to its guarded action class. Crucially, the authors concede that the evaluated boundary schedule (user-turn firings plus one-shot intercept) does not provide an unconditional guarantee, since deviations between intervention points remain uncovered.

Main results

With a GPT 5.4 agent and verifier ($n{=}4$ per cell), PolicyGuide achieves the highest overall Pass⁴ in all three τ²-bench domains:

Domain	ReAct	PolicyGuard	PolicyGuide
Airline	0.460	0.580	0.620
Retail	0.596	0.360	0.614
Telecom	0.193	0.202	0.614

The mean gain is 20 points (0.42 → 0.62), with the largest on telecom (+0.421 over ReAct, 95% CI [+0.316, +0.526])—the most workflow-structured domain, consistent with persisted graph position mattering most for long diagnose–instruct–verify chains. Pooled stratified McNemar tests favor PolicyGuide over ReAct ($p<10^{-8}$) and PolicyGuard ($p<10^{-12}$). Notably, gains span both policy-violation (PV) and mutation (Mut) slices rather than trading completion for stricter blocking. On Retail, however, the overall difference versus ReAct is not statistically significant, and Retail has only 10 PV tasks—a limitation the authors state plainly.

Ablations and baselines

Two diagnostic variants isolate the design's ingredients. PolicyGuide-Self gives the actor the frozen graph but removes the external verifier stack; its Mut Pass⁴ never exceeds ReAct, showing that workflow access alone does not ensure reliable execution. PolicyGuide-Raw keeps the verifier schedule but substitutes raw policy text for the graph; the compiled-graph advantage is +0.100, +0.150, and +0.325 on airline, retail, and telecom respectively, again largest where ordered chains dominate. The authors note these ablations remove components as bundles rather than isolating state persistence alone.

Against FlowAgent—the closest workflow-controller baseline, given the same deterministically compiled PDL representation on the 40-task telecom test split—PolicyGuide reaches 0.675 Pass⁴ versus 0.350 for FlowAgent, 0.325 for PolicyGuard, and 0.250 for ReAct. This indicates the benefit lies in external persisted verification rather than workflow representation per se.

Cross-agent transfer

The GPT-authored airline graph transfers unchanged to Claude Sonnet 4.6 and Gemini 2.5 Pro agents with model-paired verifiers. For Gemini 2.5 Pro, Mut Pass⁴ improves from 0.231 under either baseline to 0.462. One caveat stands out: for Claude Sonnet 4.6, PolicyGuide matches PolicyGuard overall (0.780) with lower PV (0.917 vs. 1.000), indicating a completion benefit rather than stricter final-action checking. Transfer across workflow-author models remains untested.

Robustness and procedural compliance

Under CRAFT red-teaming on airline (persuasive users injecting false eligibility premises), PolicyGuide attains the lowest attack-success rate at every $k$: per-trial ASR of 0.087 versus 0.125 for PolicyGuard and 0.200 for ReAct, preventing 91.3% of tested attacks while improving benign completion. The mechanism is evidence grounding: unsupported user claims cannot satisfy workflow prerequisites. The authors restrict this claim to the clean 20-task airline split—they could not reproduce a consistent CRAFT retail set, and no official telecom set exists—so cross-domain and adaptive-attack robustness remain open.

Because final-state Pass ignores intermediate ordering, the authors designed a task-conditioned telecom trace rubric checking identification, diagnosis-before-intervention, consent, correction order, and final verification. PolicyGuide achieves a 56.2% process-valid rate versus 17.5% (ReAct) and 13.1% (PolicyGuard), with Trace-TCR of 63.4% versus 35.4% and 23.9%. This metric is explicitly exploratory: it uses deterministic event matching conditioned on gold task actions, has no second-annotator agreement estimate, and does not establish exhaustive policy compliance. A supplementary Call-NMR audit shows the lowest near-miss rate on airline (15.6%), ties PolicyGuard on retail, and saturates on telecom due to oracle limitations.

Cost

The verifier adds measurable overhead: guide-side cost is $0.34–$0.56 per task across 7.4–11.5 firings, with output generation (~2.2k tokens/call) accounting for roughly two-thirds of spend despite 86–88% prompt-cache hit rates. End-to-end wall-clock time is 5.45–5.78× ReAct. Reducing verifier output length is identified as the main remaining optimization lever.

Limitations and open questions

The evaluation covers three English τ²-bench domains with a frozen GPT 4.1 user simulator and four trials per cell; no live users, other languages, or other policy regimes are tested. Enforcement is probabilistic—each node judgment is an LLM call, verifier exceptions fail open, and deployments needing hard guarantees would require an additional deterministic monitor for the formally expressible policy subset. Workflow faithfulness depends on manual verification of GPT-authored graphs, and author-side generalization across models or seeds is unexamined. The theoretical guarantee assumes a faithful workflow and an ideal binding verifier, neither of which holds unconditionally in the deployed advisory configuration. Open questions include whether sparser or cheaper firing schedules can retain coverage, whether the approach extends beyond customer-service dual-control settings, and how robustness degrades under adaptive adversaries.

Conclusion

PolicyGuide reframes policy adherence for LLM agents as a joint safeguarding-and-workflow-enforcement problem addressed by an external verifier that compiles policies into graphs, persists progress across turns, and returns targeted remediation. It delivers the best overall Pass⁴ in all three evaluated domains, transfers across agent families without re-authoring, performs strongest where policies are most workflow-structured, and reduces adversarial success while improving benign completion—at a fivefold latency cost and without formal guarantees.