PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents

2026-06-28

AI Summary

This study addresses the challenge that large language model (LLM) agents struggle to consistently adhere to enterprise policies across multi-turn dialogues, as existing external monitoring mechanisms often fail to intervene effectively due to insufficient contextual understanding. To tackle this, the work formulates policy compliance as a dialogue-level task and introduces a context-aware sub-agent verifier that shares the main agent’s conversational perspective. By jointly reasoning over dialogue history and policy rules, the verifier generates tailored compliance-preserving action recommendations. Integrated into mainstream LLM systems—including GPT, Claude, and Gemini—the proposed architecture demonstrates substantial performance gains on the tau²-BENCH aviation dataset, improving the PASS4 metric by 6.0–12.0 percentage points on average, achieving higher violation recall, and reducing intervention frequency by approximately 50%.

Abstract

LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is a broader problem: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value. Meeting this bar requires (i) full conversation context, (ii) self-reasoning over the policy and the current dialogue, and (iii) conversation-specific remediation that guides the agent's next turn -- three capabilities that prior safeguard work has often underestimated. We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn. On tau^2-BENCH airline across three vendors (GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro) with four trials per setting, POLICYGUARD improves PASS4 by +12.0 / +6.0 / +12.0 pp. Per-call analyses show POLICYGUARD achieves higher policy-violation recall while blocking roughly half as often as argument-level guards.

Problem

• policy adherence
• LLM agents
• dialogue context
• multi-turn workflows
• compliance verification

Innovation

• PolicyGuard
• LLM agents
• policy adherence
• dialogue-grounded verification
• conversation context