---
title: 'PolicyGuard: Executable Policy Enforcement'
url: https://www.emergentmind.com/topics/policyguard
type: topic
---

# PolicyGuard: Executable Policy Enforcement

PolicyGuard is a policy-grounded control paradigm for AI systems in which policies are made executable rather than left as prompt text or informal guidance. In recent arXiv usage, the label denotes multiple architectures rather than a single algorithm: learned runtime access control for tool-using agents, deterministic policy compilation over dependency graphs, dialogue-grounded sub-agent verification, step-level backdoor detection for reinforcement learning agents, neuro-symbolic compliance review for documents, privacy enforcement for retrieval-augmented generation, and lightweight policy-violation detection for web-agent trajectories [2601.10440] [2602.16708] [2606.29225] [2606.12896] [2606.32004] [2605.17034] [2510.03485]. Taken together, these systems treat “policy” as an operational object—encoded as graph predicates, typed logic rules, learned access predicates, uncertainty thresholds, or trajectory–policy classifiers—and place enforcement at the point where an unsafe action, document decision, or output would otherwise be committed.

## 1. Scope and terminological usage

By 2025–2026, “PolicyGuard” appears as an overloaded research term spanning several technical traditions. Some works use the name directly, while others explicitly position their framework as a policy-based guard or “PolicyGuard” layer. The common denominator is not a shared implementation, but an insistence that policy adherence should be explicit, inspectable, and enforceable before harmful side effects occur [2601.10440] [2602.16708] [2606.29225].

| Work | Policy substrate | Primary control point |
|---|---|---|
| AgentGuardian | Learned per-tool predicates plus CFG constraints | Runtime gate beneath agent business logic |
| PCAS-based PolicyGuard | Datalog-derived rules over a dependency graph | Reference monitor before execution |
| Dialogue-grounded POLICYGUARD | Raw policy text plus per-tool checklist | Mutating tool-call verifier |
| RL PolicyGuard | GP posterior variance over clean behavior manifold | Test-time step-level detector |
| Document-review PolicyGuard | Typed relational logic plus atom questions | Symbolic compliance evaluator |
| Privacy Policy Enforcement PolicyGuard | Dual one-class density estimators over fused embeddings | Layer-2 RAG output gate |
| PolicyGuard-4B | Instruction-tuned trajectory–policy classifier | Full-trajectory and prefix-based monitoring |

This breadth matters because the word “policy” is instantiated differently across settings. In agent governance, it usually means authorization conditions over tool calls, provenance, workflow order, or dialogue prerequisites. In document review, it means organization-specific negotiation rules formalized as Boolean logic. In privacy enforcement, it becomes a decision boundary separating safe outputs, unsafe outputs, and abstain regions. In reinforcement learning, it refers not to the agent’s control policy $\pi$ alone, but to a detector that guards that policy at test time [2606.32004] [2605.17034] [2606.12896].

## 2. Runtime governance of tool-using agents

One major PolicyGuard line governs agent actions at runtime. AgentGuardian is explicitly positioned as a policy-based guard for AI agents that “learns, expresses, and enforces access-control policies over tool invocations and their orchestration,” with three layers of coverage: input validation, attribute-based constraints, and workflow constraints. During an attack-free staging phase, it monitors benign execution traces, constructs a control-flow graph (CFG), embeds each tool event into a 150D vector, clusters per-tool behaviors, generalizes them into regex predicates and numeric ranges, and then enforces a binary access-control policy at runtime through LiteLLM’s custom feedback hook [2601.10440]. Its local-and-global decision rule is
$$
ACP_T(x,a,path)=\mathbf{1}[path \in Paths(\mathcal{G}, \ldots \to T)] \land \Big(\bigvee_{k=1}^{K_T} R_{T,k}(x,a)\Big),
$$
so legality requires both a valid leading context in the CFG and satisfaction of at least one learned rule. On two real-world applications, Knowledge Assistant and IT Support, AgentGuardian reported aggregate $FAR = 0.10$, $FRR = 0.10$, and $BEFR = 0.075$, detecting $18/20$ violations overall; it also blocked hallucination-driven orchestration errors as “benign execution failures” rather than false positives [2601.10440].

A second strand replaces learned policies with declarative compilation. PCAS formulates agentic state as a dependency graph $G=(V,D)$ over messages, tool calls, tool results, and approvals, then evaluates Datalog-derived authorization rules over the backward slice of a proposed action. The core enforcement claim is deterministic: a reference monitor intercepts all actions, checks policy before execution, and yields traces satisfying
$$
\forall G \in \textsf{traces}(\mathcal{C}(S,P)),\; G \models P.
$$
The paper frames this as a PolicyGuard for secure agentic systems, with recursive provenance via `Depends(dst, src) :- Edge(src, dst)` and its transitive closure, enabling information-flow control, approval workflows, and organizational policy enforcement across multiple agents [2602.16708]. In evaluation, PCAS improved customer-service policy compliance from $48\%$ to $93\%$ across frontier models, achieved zero policy violations in instrumented runs, reduced prompt-injection attack success to $0/5$ under MLS and Toxic Flow policies versus $5/5$ for the non-instrumented anti-exfiltration prompt baseline, and raised pharmacovigilance compliance from $0/15$ to $15/15$ while blocking unauthorized FDA access before execution [2602.16708].

AIRGuard advances a closely related runtime-authority formulation. It normalizes heterogeneous tool calls into $\bar a_i=(\kappa_i,y_i,e_i,s_i)$, derives step-level authority $\alpha_i=(issuer, subject, scope, ttl, A_i, G_i)$ from trusted issuers, labels source and target trust as $\rho_i=(r_i,t_i)$, and then decides `allow`, `audit`, `ask`, `inspect`, `sandbox`, `quarantine`, or `block` based on a coverage predicate and a risk simulator [2605.28914]. The defining invariant is that untrusted resources may inform reasoning but must not authorize side effects. On AgentTrap, AIRGuard reduced Claude Sonnet 4.6 attack success from $36.3\%$ without defense to $5.5\%$, with $84.0\%$ benign utility preservation; on DTAP-150, it preserved $76.0\%$ benign utility with Haiku 4.5, compared with $52.0\%$ for ARGUS and $42.0\%$ for MELON [2605.28914]. This suggests a three-way distinction inside agent-side PolicyGuard research: learned access control from benign traces, symbolic authorization over provenance graphs, and authority-control mediation over normalized actions.

## 3. Dialogue-grounded adherence and decision-level verification

A distinct PolicyGuard formulation argues that agent compliance failures are often procedural rather than purely authorization-theoretic. The dialogue-grounded POLICYGUARD system is a sub-agent verifier that shares the agent’s view of the full conversation, the pending mutating tool call, prior tool results, the raw policy text, and a per-tool YAML checklist. For each mutating attempt, it marks requirements as `MET` or `NOT MET`, returns `PASS` or `BLOCK`, and—if blocking—produces a short remediation message that guides the agent’s next turn [2606.29225]. The paper’s motivating statistic is that approximately two-thirds of atomic policy requirements on $\tau^2$-Bench airline, $29/43 = 67.4\%$, are process-level and therefore outside the scope of argument-only verifiers. Two prompt instructions are load-bearing: “Only trust values confirmed by tool results, not user-claimed values,” and “If a required action was never performed, treat it as NOT MET” [2606.29225].

The empirical emphasis is worst-case reliability rather than one-shot accuracy. On airline across GPT-5.4, Claude Sonnet 4.6, and Gemini 2.5 Pro, PG-Checklist improved Pass4 by $+12.0$, $+6.0$, and $+12.0$ percentage points over baseline, respectively; it also achieved perfect policy-violation Pass on all three vendors while blocking substantially less often than ToolGuard [2606.29225]. In per-call analysis, GPT-5.4 under PG-Checklist reached $100\%$ policy-violation recall with `Blk%` $44.1\%$, versus ToolGuard’s `Blk%` $73.9\%$ and recall $80.0\%$; Gemini 2.5 Pro improved from ToolGuard’s $31.2\%$ recall to $94.7\%$ under PG-Checklist while lowering blocking from $71.1\%$ to $57.8\%$ [2606.29225]. Dialogue ablation was decisive: when user and assistant natural-language turns were removed from the verifier’s view, Mut Pass collapsed to $0.000$ on GPT-5.4. The paper therefore treats conversation state, not tool arguments alone, as the load-bearing policy substrate [2606.29225].

This verifier-centric view is adjacent to decision-level provenance defenses such as MindGuard, which tracks tool-selection influence through a Decision Dependence Graph (DDG) built from attention patterns rather than dialogue semantics. MindGuard frames DDG as a PolicyGuard substrate for MCP Tool Poisoning Attacks, enabling CFI-like and DFI-like predicates over decision provenance, with mean AP approximately $93.2\%$, detection accuracy approximately $95.3\%$, attribution accuracy $95$–$100\%$, processing times under one second, and no additional token cost [2508.20412]. The contrast is structural: dialogue-grounded POLICYGUARD reasons over explicit speech acts and read-only tool evidence, whereas DDG-based approaches reason over influence paths inside the model’s planning context.

## 4. Trajectory- and step-level PolicyGuard in reinforcement learning and web agents

In reinforcement learning, PolicyGuard becomes a test-time detector rather than a tool-call gate. The RL formulation introduces a black-box, step-level backdoor defense that models normal behavior with a sparse additive Gaussian Process over clean trajectory embeddings and uses posterior variance as an uncertainty signal. Because step-level uncertainty depends on sequence context, the method constructs pseudo trajectories by splicing the current suspicious state-action pair into clean reference futures and aggregating per-step uncertainty with the Interquartile Mean:
$$
U(s_t,a_t)=\mathrm{IQM}(\{U_i(s_t,a_t)\}_{i=1}^N).
$$
A backdoor is signaled when $U(s_t,a_t)>\tau$ [2606.12896]. Across seven RL games, PolicyGuard reported average AUROC $0.856$ for perturbation-based attacks and $0.859$ for adversary-agent attacks; on hard-coded backdoors, it maintained overall AUROC $0.868$ and $0.878$ for the two attack families, where optimization-based baselines collapsed near AUROC $\approx 0.5$ [2606.12896]. The paper’s theoretical basis is that benign points densely covered by the clean manifold drive posterior variance toward zero, while triggered states farther from the inducing points yield larger expected uncertainty.

For autonomous web agents, PolicyGuard is formulated as explicit policy-violation classification over long-horizon trajectories. PolicyGuardBench contains 59,997 balanced trajectory–policy pairs derived from 733 standardized WebArena trajectories with an average of 9.3 actions, 2,195 curated policies, and both within-subdomain and cross-subdomain pairings; the benchmark includes full-trajectory detection and prefix-based detection from the first $N \in \{1,\ldots,5\}$ steps [2510.03485]. PolicyGuard-4B is a Qwen3-4B-Instruct model instruction-tuned on this benchmark. On full trajectories, it achieved Accuracy $0.9014$, F1 $0.8759$, latency $22.5$ ms/example, FLOPs/example $2.57$ TFLOPs, and EA-F1 $38.93$, outperforming larger models on efficiency while remaining close to the best open-source F1 values [2510.03485]. In leave-one-domain-out evaluation, average in-domain performance was $0.9328/0.9322$ Accuracy/F1 and out-of-domain performance was $0.9083/0.9086$, indicating a relatively small generalization gap [2510.03485].

These two lines share a trajectory perspective but differ in what constitutes “policy.” In RL, the guarded object is the deployed policy’s test-time behavior under triggers; in web agents, the guarded object is a textual trajectory evaluated against an explicit textual rule. A plausible implication is that PolicyGuard has become a general label for systems that intervene over sequential behavior before complete failure manifests, whether the monitored sequence is a control trajectory, a web workflow, or a multi-turn agent dialogue.

## 5. Neuro-symbolic document compliance and privacy enforcement

Another major usage of PolicyGuard formalizes organization-specific policy logic as symbolic computation. The document-review PolicyGuard converts policy guidance into typed relational logic rules, atom-level extraction questions, and rule-level validation tests. At review time, an LLM answers local true/false questions using retrieved clause evidence, and a deterministic evaluator implemented with the Z3 SMT solver applies Boolean rule formulas to decide non-compliance [2606.32004]. The representation includes typed predicates, ground atoms, and rules of the form
$$
\mathrm{Violation}(x) \leftarrow A_1(x)\land \cdots \land A_k(x)\land \neg E_1(x)\land \cdots \land \neg E_m(x),
$$
with no probabilistic rule weighting in the core evaluator [2606.32004]. In a company-specific NDA case study comprising 95 internal guidelines over five real NDAs, for 475 policy–contract decisions, PolicyGuard achieved average accuracy $93.4$ and average non-compliance F1 $73.7$, versus best prompting baselines around $42.9$ F1; its pass$^1$ to pass$^{10}$ reliability dropped only from $93.4$ to $92.1$, and $97.0\%$ of policy–contract decisions were identical across all 10 runs [2606.32004]. The gain is attributed to separation of concerns: local interpretation remains probabilistic, but policy application is deterministic and auditable.

Privacy-oriented PolicyGuard work moves from symbolic rules to density estimation over outputs. The Privacy Policy Enforcement framework for data-sensitive RAG targets contextual leakage through quasi-identifier clusters rather than token-level PII, using fused 3,072-dimensional embeddings from Qwen3-Embedding-0.6B, BGE-M3, and E5-large-v2, together with dual one-class estimators and an abstain region for both-OOD cases [2605.17034]. Its discriminator is $\delta(x)=\sigma_u(x)-\sigma_s(x)$, with abstention when neither safe-side nor unsafe-side density claims the input as in-distribution. The recommended detector, T3+OCSVM-v4, achieved within-distribution AUROC $0.995$, $0.992$, and $0.971$ across medicine, finance, and law; on the more important borderline-safe stress test, it reached AUROC $0.965$, $0.963$, and $0.930$, while the GMM baseline collapsed to $0.725$, $0.722$, and $0.792$ [2605.17034]. Borderline FPR95 dropped by $54.8$, $52.5$, and $44.3$ percentage points across the three domains, abstain rates were $10.7\%$, $3.5\%$, and $3.7\%$, and latency was on the order of milliseconds per answer, approximately $5$ ms [2605.17034].

Both systems are policy-grounded but differ in execution semantics. The NDA system compiles policy into logic and then gathers evidence. The RAG privacy system instead operationalizes policy as a calibrated boundary in embedding space, with `safe`, `flag`, or `abstain` actions. This suggests that “PolicyGuard” is not tied to symbolic or statistical enforcement alone; rather, it denotes a design goal in which policy becomes the primary interface between organizational requirements and model outputs.

## 6. Common design patterns, benchmarking infrastructure, and limitations

Across these papers, several recurring design patterns emerge. First, policies are externalized from the model: as CFG-constrained per-tool predicates in AgentGuardian, Datalog rules in PCAS, YAML checklists plus raw policy text in dialogue-grounded POLICYGUARD, typed relational logic in document review, or explicit thresholds and abstain regions in privacy and RL detection [2601.10440] [2602.16708] [2606.29225] [2606.32004] [2605.17034] [2606.12896]. Second, the enforcement point is pushed as close as possible to the irreversible event: before a tool call, before an environment mutation, before a document compliance label is finalized, or before a suspicious RL action executes. Third, provenance or context is usually richer than a single input string: CFG paths, dependency graphs, dialogue history, pseudo trajectories, or full agent trajectories are treated as necessary state.

A broader policy-grounded ecosystem has also emerged around testing and data construction. GUARD operationalizes government-issued guidelines from the EU Trustworthy AI Assessment List, UK Illustrative AI Risks, and NIST Risks Unique to GAI into guideline-violating questions and jailbreak diagnostics, using multi-role generation and GUARD-JD scenario optimization [2508.20325]. GuardSet-X, also described as PolyGuard in the paper, grounds over 100k guardrail instances in more than 150 authentic policy documents, more than 400 risk categories, and 1,000 safety rules across eight domains, and shows that all 19 evaluated guardrail models remain vulnerable to optimized adversarial attacks [2506.19054]. These datasets do not themselves enforce policy, but they supply the policy-grounded corpora, benchmarks, and stress tests from which many PolicyGuard-like systems can be trained or audited.

The limitations are correspondingly diverse. Learned policy systems assume attack-free staging and representative benign traces; AgentGuardian explicitly warns that contaminated staging can encode unsafe behaviors, that too few samples yield over-permissive regexes, and that limited CFG coverage can increase false rejections [2601.10440]. Dependency-graph compilers require complete mediation and accurate policy specifications; PCAS notes that uninstrumented channels, covert channels, and the effort of translating natural language policy into Datalog remain open issues [2602.16708]. Runtime authority control depends on robust risk recognition and pre-action hooks; AIRGuard reports residual failures dominated by missed risk recognition at the decisive action and cannot protect tools executed outside mediation [2605.28914]. Dialogue-grounded verification adds one LLM call per mutating attempt and relies on LLM-generated checklists, honest-user workflows, and reliable tool results; it also shows domain-structure limits outside airline [2606.29225]. The RL detector requires a clean environment for reference collection and is sensitive to distribution shift and large random perturbations [2606.12896]. The NDA system is evaluated on one company’s playbook and cannot release raw data because of confidentiality [2606.32004]. The privacy guard inherits synthetic-data biases and shows a finance-specific residual where borderline FPR at $\tau=0$ remains $36.0\%$ [2605.17034]. PolicyGuardBench, finally, depends on automated annotation and benchmark serialization choices that may induce artifacts even though cross-domain generalization remains strong [2510.03485].

Taken together, these works define PolicyGuard not as a single model family but as a research program: translating policy from prose into executable structure, attaching that structure to the right state representation, and enforcing it at the moment where model reasoning would otherwise become an external commitment. The field’s internal variation—symbolic versus learned, runtime mediation versus post-hoc classification, dialogue grounding versus provenance graphs, binary blocking versus abstention or remediation—indicates that policy-grounded control is now being treated as a systems problem rather than merely a prompting problem.

Source: https://www.emergentmind.com/topics/policyguard