PolicyGuide Moves LLM Agents from Action Blocking to Workflow Guidance

Introduction

For a customer-service agent, policy compliance is more than avoiding an obviously forbidden operation. Many service requests are governed by procedures: the agent may need to identify the customer, verify eligibility, explain a consequence, obtain confirmation, and only then change an account or invoke a backend tool. Skipping one of these steps can create a compliance failure even when the final action looks harmless in isolation.

A different control granularity

Most runtime safeguards are action-local. They inspect an impending refund, account change, or tool call and decide whether it should be allowed. This is useful for preventing a clearly disallowed action, but it does not necessarily help the agent recover from an incomplete conversation. A blocked action leaves an important question unanswered: which prerequisite is missing, and how can the dialogue proceed without abandoning the user’s request?

PolicyGuide addresses this gap by compiling each domain policy into a workflow graph. The graph represents required steps and the permitted relationships between them. At user-turn boundaries, a proactive verifier reads the persisted graph state, reconciles open requests, and produces remediation tailored to the current step. Instead of returning only a refusal, it can steer the agent toward the next policy-compliant part of the workflow.

What the evaluation reports

The paper evaluates the method on the airline, retail, and telecom domains of τ²-bench, using a GPT-5.4 agent together with the verifier. Mean Pass^4 increases from 0.42 without the proposed guidance to 0.62 with it. The most pronounced change appears in telecom, where the score moves from 0.19 to 0.61. The authors associate this pattern with workflow structure: when a domain has clearer procedures and dependencies, an explicit graph offers more useful guidance.

The workflows also transfer to agents based on Claude Sonnet 4.6 and Gemini 2.5 Pro, according to the reported experiments. Additional evaluations consider adversarial users and an author-designed workflow-level validation. PolicyGuide records the lowest observed attack-success rate in the adversarial comparison and the strongest procedural compliance in that validation. These findings are encouraging, but they remain tied to the listed benchmarks, models, policies, and verifier configuration rather than constituting a universal guarantee for enterprise deployments.

Why it matters

The central contribution is a shift from checking isolated tool calls to managing dialogue state together with process state. For organizations, a policy can become an executable workflow representation rather than only a collection of prohibited rules. For the agent, compliance becomes operational guidance: if a request is open but a prerequisite is absent, the system can identify the missing step and continue along an approved route.

This design also exposes practical challenges. Someone must translate changing policies and exceptions into reliable graphs, preserve state across turns, and decide how to handle cases that do not fit a predefined path. Nevertheless, PolicyGuide points toward a layered architecture in which planning, workflow memory, and independent verification work together. That architecture may be particularly valuable in customer service, where a successful answer is not enough unless the way it was reached is also acceptable.

Source: Hugging Face Daily Papers