让大模型代理更懂公司政策，通过对话上下文智能校验并纠正行为。
PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents
- 构建对话感知的子验证器，结合上下文与政策推理
- 在三个大模型上提升合规通过率12个百分点以上
- 减少误拦截，适合需高合规性的企业级应用
大型语言模型代理通过工具调用代表组织处理用户请求，必须遵循系统提示中规定的公司政策。以往工作将此视为安全防护问题——通过外部检查阻止不合规动作。我们提出，政策遵守是更广泛的问题：真实工作流跨越多轮对话，需用户确认和前置阅读，且依赖对话内容而非单一参数值。达成这一目标需要（i）完整对话上下文，（ii）对政策与当前对话的自我推理，以及（iii）针对对话场景的补救建议以指导下一轮行动——这些能力在以往防护工作中常被低估。我们提出POLICYGUARD，一个与代理共享对话视图的子验证器，能在上下文中推理政策，并为下一轮行动提供可操作反馈。在tau^2-BENCH航空任务数据集上，针对三个厂商（GPT-5.4、Claude Sonnet 4.6、Gemini 2.5 Pro），每设置四次实验，POLICYGUARD使PASS4分别提升+12.0 / +6.0 / +12.0个百分点。逐调用分析显示，POLICYGUARD在保持约一半拦截频率的同时，显著提升了政策违规检测召回率。
原文摘要 · Abstract (English)
LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is a broader problem: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value. Meeting this bar requires (i) full conversation context, (ii) self-reasoning over the policy and the current dialogue, and (iii) conversation-specific remediation that guides the agent's next turn -- three capabilities that prior safeguard work has often underestimated. We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn. On tau^2-BENCH airline across three vendors (GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro) with four trials per setting, POLICYGUARD improves PASS4 by +12.0 / +6.0 / +12.0 pp. Per-call analyses show POLICYGUARD achieves higher policy-violation recall while blocking roughly half as often as argument-level guards.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。