PolicyGuard: 一种基于对话的子代理验证器，用于确保LLM代理遵循策略
PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents
AI总结：
提出PolicyGuard子代理验证器，通过共享对话上下文、策略推理和可操作反馈，在tau²-BENCH航空数据集上使PASS4提升12个百分点，同时误拦率降低约一半。
摘要：
LLM代理通过工具调用代表组织处理用户请求，必须遵循系统提示中声明的公司策略。先前的工作将其视为一个安全问题——通过外部检查来阻止不合规的代理行为。我们认为策略遵循是一个更广泛的问题：真实的工作流程涉及多个回合，需要明确的用户确认和先决条件阅读，并且取决于对话内容而非任何单一参数值。满足这一要求需要（i）完整的对话上下文，（ii）对策略和当前对话的自我推理，以及（iii）针对对话的具体补救措施，以指导代理的下一步行动——这是先前安全工作常常低估的三种能力。我们引入POLICYGUARD，一个子代理验证器，它与代理共享对话视图，在上下文中推理策略，并为代理的下一步行动提供可操作的反馈。在tau²-BENCH航空数据集上，针对三个供应商（GPT-5.4、Claude Sonnet 4.6、Gemini 2.5 Pro）每种设置进行四次试验，POLICYGUARD将PASS4提高了+12.0 / +6.0 / +12.0个百分点。每次调用的分析显示，POLICYGUARD实现了更高的策略违规召回率，同时拦截频率约为参数级守卫的一半。
英文摘要：
LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is a broader problem: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value. Meeting this bar requires (i) full conversation context, (ii) self-reasoning over the policy and the current dialogue, and (iii) conversation-specific remediation that guides the agent's next turn -- three capabilities that prior safeguard work has often underestimated. We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn. On tau^2-BENCH airline across three vendors (GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro) with four trials per setting, POLICYGUARD improves PASS4 by +12.0 / +6.0 / +12.0 pp. Per-call analyses show POLICYGUARD achieves higher policy-violation recall while blocking roughly half as often as argument-level guards.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
