Search papers, labs, and topics across Lattice.
This paper introduces PolicyGuide, a novel approach for ensuring policy compliance in customer-service LLM agents by transforming domain policies into workflow graphs and employing a proactive verifier at user-turn boundaries. By addressing the limitations of traditional runtime safeguards that only check individual actions, PolicyGuide significantly improves compliance rates, achieving a mean $\mathrm{Pass}^4$ increase from $0.42$ to $0.62$, particularly excelling in the telecom domain. The method not only enhances compliance across multiple domains but also demonstrates resilience against adversarial attacks, making it a robust solution for policy-guided LLM interactions.
PolicyGuide boosts compliance rates in LLM agents by transforming policy checks into a proactive, workflow-guided system that adapts to user interactions.
Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the $\tau^2$-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean $\mathrm{Pass}^4$ from $0.42$ to $0.62$, with the largest gain on telecom ($0.19$ to $0.61$), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.
