PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents

원문 초록

LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is broader: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on dialogue rather than on any single argument value. We introduce PolicyGuard, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and returns actionable remediation. On $\tau^2$-bench airline across GPT 5.4, Claude Sonnet 4.6, and Gemini 2.5 Pro, PolicyGuard improves $\mathrm{Pass}^4$, the fraction of tasks successful in all four trials, by +12.0 / +6.0 / +12.0 pp; pooled paired tests support an overall cross-vendor effect. We further evaluate PolicyGuard on the full retail and telecom base splits, covering all three $\tau^2$-bench customer-service domains. Further analyses show that PolicyGuard improves reliability beyond agent self-checking, catches more policy violations with fewer blocks than argument-level guards, and preserves its refusal accuracy under three adversarial probes.