Don’t Let the Agent Be Its Own Judge: OBPE Moves Governance Beyond the Model

Introduction

Giving an AI agent a person’s credential gives it the person’s technical reach, but not the judgment that normally keeps that reach within a job’s boundaries. A credential-valid request can still be excessive: an agent may retrieve every accessible record, absorb hidden instructions or secrets into its context, and complete an action that is technically permitted but operationally inappropriate. The paper If Agents Were Angels, No Governance Would Be Necessary proposes Out-of-Band Policy Enforcement, or OBPE, to move these decisions outside the model’s reasoning loop.

How OBPE works

OBPE places a trusted policy boundary between the agent and the backend service. Rather than relying on prompts to make the model enforce its own limits, the boundary handles several controls:

• Authorize the typed request: It checks the operation, resource, and caller before a backend call is made.
• Narrow the query: It constrains query scope before the backend returns data, reducing unnecessary exposure.
• Shape the response: It can remove records or fields and mask values before the result reaches the agent.
• Apply semantic gates: An otherwise authorized request can be denied or held based on argument values or external state.

The design separates a maximum grant from agent-level restrictions. A data policy owner defines the ceiling; an agent policy may narrow that ceiling but cannot expand it. Under stated assumptions, the authors show that the resulting policy plan is order-independent and that agent-side rules cannot widen the owner’s grant.

Results and limitations

The authors release a simplified HTTP proxy derived from a production system. Its typed Cedar policy core is connected to the model through conformance tests. In experiments using Jira and ServiceNow mocks, four models were compared with and without OBPE, including 20 adaptive red-team tasks. A trace counted as a failure if protected data entered the agent’s context, an exact protected value appeared in the answer, or a forbidden effect was completed.

Across 3,621 trials, the failure rate fell from 57.6% to 0.2% with OBPE. The cluster-weighted reduction was 41.2 percentage points, with a 95% confidence interval of 27.7 to 54.9 points. Fulfillment declined from 79.1% to 60.9%, but paired safe-and-useful completion increased by 21.8 points, with an interval of 9.5 to 35.2 points. The trade-off matters: a secure system that rejects everything is not useful, while a highly capable agent that exposes data is not dependable.

The paper also draws important boundaries around its claims. Some answers reconstructed a value that never entered the context, and filtered row counts could act as an oracle. Therefore, shaping one execution is not the same as proving information noninterference. Write controls, durable approval, and temporal or aggregate policies were outside the evaluation as well.

Why it matters

OBPE’s broader message is architectural. Prompt instructions can help an agent understand a task, but they are a weak place to enforce hard security limits because the same fallible reasoner is interpreting the request and policing itself. A stronger design lets the model propose an action while an external layer decides what it may read, what data it may receive, and whether it may trigger an effect.

That boundary is not a complete governance system. It must still account for side channels, multi-step interactions, state changes, and authorized writes. But the paper offers a practical direction for enterprise agents: keep policy enforcement at the tool boundary, make the maximum grant explicit, and treat usefulness lost through enforcement as a measurable engineering cost rather than an invisible failure.

Source: arXiv