Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents

2026-07-13

AI Summary

This work addresses the challenge of reliably executing long-horizon, condition-dependent, and safety-critical standard operating procedures (SOPs) in enterprise agents, a task for which current large language models lack sufficient structural constraints and runtime guidance. The authors propose a program-guided stack-based virtual machine framework that compiles machine-readable SOPs into executable pseudocode and leverages a dynamic activation-frame paging mechanism to provide contextual awareness during semantic execution. A novel capability-gated runtime policy is introduced, enabling active paging only for strong models exhibiting state discipline, thereby achieving the first decoupling of SOP representation from runtime control. Evaluated on SOPBench, the approach yields up to a 16.0-point improvement, increases accuracy on Bank tasks from 70.4% to 92.8%, achieves 100% correctness in refusal responses, and consistently benefits strong models across seven domains while automatically suppressing weaker ones.

Abstract

Enterprise agents must follow long-horizon, conditional, safety-critical standard operating procedures (SOPs). We compile machine-readable SOP constraints into executable pseudo-code and run them with a program-guided (PG) stack machine that pages the active frame while an LLM performs semantic execution. A three-arm SOPBench study across six models separates representation from runtime: compiled text never significantly hurts and gains up to 16.0 points where official prose underperforms. Runtime guidance is capability-gated. Two strong models independently show positive seven-domain PG contrasts (58:19 and 75:31 discordant pairs), whereas weak models are harmed. A full-program cursor ablation (active frame first, complete program retained) recovers much of the strong-model refusal gain; selective visibility adds a smaller improvement. Paired probe and audit measurements track this divide to spontaneous state discipline rather than reconstruction ability. On Bank the three primary arms rise from 70.4 to 86.4 to 92.8, with 100% refusal correctness. Practical guidance: compile first; enable active-frame paging only after a model-level discipline check.

Problem

• standard operating procedures
• procedural LLM agents
• safety-critical execution
• long-horizon tasks
• capability-gated runtime

Innovation

• program-guided execution
• capability-gated runtime
• executable SOP compilation
• active-frame paging
• procedural LLM agents