STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control

Mengxi Luo; Changjia Chen; An Cao; Zirong Huang; Wanyi Dai

cs.AIAug 23, 2026

STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control

Authors: Mengxi Luo, Changjia Chen, An Cao, Zirong Huang, Wanyi Dai

Organizations: BMO Financial Group

Abstract

Policy-governed agents must interpret case evidence while reliably following authorized procedures. We present STAGE, an executable-graph framework that confines model judgment to policy-scoped nodes while placing procedural control in deterministic code. We evaluate STAGE on three public policy-following benchmarks and Smart Dispute, a proprietary banking benchmark. Compared with monolithic full-policy execution, STAGE improves task success and repeated-run reliability, with its largest observed gains on the deeper workflows. On $τ^2$ -bench Telecom and Smart Dispute, $\mathrm{Pass}^{3}$ improves by up to 55.0 and 65.7 percentage points, respectively. These results demonstrate the value of combining localized policy reasoning with deterministic procedural control for enterprise use.

Figures & tables

Figure 1: Stage illustration: Stage constructs, validates, and freezes an execution graph offline (left), then uses policy-scoped nodes to validate evidence, constrain capabilities, and route decisions online (right).

		$\mathrm{Pass}^{1}$ (%)			$\mathrm{Pass}^{3}$ (%)
Benchmark	Model	Base	Stage	$\mathbf{\Delta}$	Base	Stage	$\mathbf{\Delta}$
Referral Abuse	GPT-5.6 Luna	94.3	97.8	+3.5	88.0	95.5	+7.5
	Claude Haiku 4.5	90.7	96.0	+5.3	79.0	88.5	+9.5
	Claude Sonnet 5	99.7	99.5	$-0.2$	99.0	99.0	0.0
	DeepSeek V4 Flash	98.2	99.0	+0.8	95.5	97.0	+1.5
Telecom	GPT-5.6 Luna	45.8	92.5	+46.7	32.5	87.5	+55.0

Table 1: Single-run task success and repeated-run reliability.

\mathrm{Pass}^{1}

denotes single-run success, while

\mathrm{Pass}^{3}

requires successful completion in all three runs.

\Delta

is the percentage-point difference between Stage and the baseline.

Benchmark	Model	Full-policy nodes	LLM routing	Stage
Telecom	Haiku 4.5	22.5 (-27.5)	32.5 (-17.5)	50.0
	Sonnet 5	57.5 (-22.5)	77.5 (-2.5)	80.0
Smart Dispute	Haiku 4.5	34.3 (-34.3)	51.4 (-17.2)	68.6
	Sonnet 5	74.3 (-5.7)	65.7 (-14.3)	80.0

Table 2: Fixed-graph ablations for

\mathrm{Pass}^{3}

(%). Values below the scores show differences from Stage in percentage points.

Figure 2: Smart Dispute task success and mutually exclusive error composition by model, method, and realized execution-chain length, aggregated over three runs. Chain errors denote completed runs that violate the required path or order and take priority over terminal correctness. Execution or terminal errors comprise non-completion, process or tool failure, or an incorrect terminal result without a chain error.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Benchmark	Model	Tasks	Baseline	Stage	$\Delta$ (pp)
Referral abuse detection v2	GPT-5.6 Luna	200	94.33 [92.58, 96.09]	97.83 [96.55, 99.12]	$+3.50$
	Claude Haiku 4.5	200	90.67 [89.69, 91.64]	96.00 [91.54, 100.46]	$+5.33$
	Claude Sonnet 5	200	99.67 [99.18, 100.15]	99.50 [99.50, 99.50]	$-0.17$
	DeepSeek V4 Flash	200	98.17 [97.68, 98.65]	99.00 [98.16, 99.84]	$+0.83$
$\tau^{2}$ -bench Telecom	GPT-5.6 Luna	40	45.83 [43.40, 48.27]	92.50 [81.35, 103.65]	$+46.67$
	Claude Haiku 4.5	40	50.00 [41.57, 58.43]	71.67 [65.23, 78.10]	$+21.67$

Appendix

Table 3:

\mathrm{Pass}^{1}

results. Baseline and Stage values are percentages reported as means with 90% confidence intervals.

\mathrm{Pass}^{1}

is the average task-success rate across three runs. Confidence intervals are two-sided Student-

t

intervals across runs.

\Delta

denotes Stage minus Baseline in percentage points.

Benchmark	Model	Baseline	Full-policy nodes	LLM routing	Stage
Telecom	Haiku 4.5	50.00 [41.57, 58.43]	55.00 [47.70, 62.30]	58.33 [49.56, 67.11]	71.67 [65.23, 78.10]
	Sonnet 5	80.00 [80.00, 80.00]	80.00 [75.79, 84.21]	85.00 [80.79, 89.21]	91.67 [86.80, 96.53]
Smart Dispute	Haiku 4.5	12.37 [9.54, 15.19]	54.29 [54.29, 54.29]	61.90 [56.35, 67.46]	70.50 [64.95, 76.05]
	Sonnet 5	39.07 [27.87, 50.26]	86.67 [79.31, 94.02]	72.38 [69.60, 75.17]	88.57 [83.76, 93.37]

Appendix

Table 4:

\mathrm{Pass}^{1}

results for the monolithic baseline and fixed-graph ablation conditions. Values are percentages reported as means with 90% confidence intervals, using two-sided Student-

t

intervals across three runs. The best mean in each benchmark–model row is shown in bold.

Figure 3: Offline policy-to-graph construction. Semantic authoring produces a source-grounded procedural plan, while topology checks, compilation, and validation constrain the plan before approval and freezing.

Benchmark	Model	Graph condition	$\mathrm{Pass}^{1}$	$\mathrm{Pass}^{3}$	Avg. output	Avg. input	Avg. total
			(%)		(K tokens/case)
Telecom	Claude Haiku 4.5	Full-policy nodes	55.0	22.5	11.44	1890.39	1901.83
		Stage	71.7	50.0	10.53	1173.36	1183.89
	Claude Sonnet 5	Full-policy nodes	80.0	57.5	5.81	881.08	886.89
		Stage	91.7	80.0	5.52	377.26	382.78
Smart Dispute	Claude Haiku 4.5	Full-policy nodes	54.3	34.3	3.85	193.44	197.29

Appendix

Table 5: Fixed-graph policy-localization results. Both conditions use the same graph and coordinator. Only the policy context supplied to each node changes. Token counts are averages per case in thousands, and total tokens are the sum of input and output tokens.

		Output tokens		Input tokens
Benchmark	Model	Base	Stage	Base	Stage
Referral Abuse	GPT-5.6 Luna	0.68	2.70	35.39	152.21
	Claude Haiku 4.5	1.61	15.99	9.86	81.92
	Claude Sonnet 5	1.78	3.74	14.07	70.48
	DeepSeek V4 Flash	2.68	11.29	14.15	97.36
Telecom	GPT-5.6 Luna	2.40	5.57	253.15	209.47

Appendix

Table 6: Preliminary average input and output tokens per case, reported in thousands. Bold input-token values identify settings in which Stage consumes fewer input tokens than the baseline. The current production implementation of Stage additionally generates notes, evidence, and source references for auditing and human review. The baseline does not generate comparable artifacts.

Panel of Figure 4 — Figure 4: Reconstructed benchmark execution graphs. Referral Abuse is sequential, Retail provides the shallowest routing structure, Telecom adds broader request routing and a nested technical-support decision, and Smart Dispute contains the deepest sequence and most conditional structure. The panels include only non-sensitive node titles and outcome labels.

System	Backbone	Retail $\mathrm{Pass}^{1}$	Telecom $\mathrm{Pass}^{1}$
Stage	GPT-5.6 Luna	68.3	92.5
Stage	Claude Haiku 4.5	58.3	71.7
Stage	Claude Sonnet 5	68.3	91.7
Stage	DeepSeek V4 Flash	55.8	81.7
PolicyGuard ( Kang et al., 2026a )	GPT-5.4	64.5	40.6
SkillX ( Wang et al., 2026a )	Qwen3-32B	66.9	43.8

Appendix

Table 7: Published

\mathrm{Pass}^{1}

results on the

\tau^{2}

-bench Retail and Telecom domains. Values are percentages rounded to one decimal. Results are reported by their respective sources and are not directly controlled because systems use different backbones, harnesses, and evaluation configurations. Bold values indicate the highest reported score in each column. “n.r.” indicates that a result was not reported.

Agentic Workflows

Agentic workflows coordinate AI agents, tools, and humans across multi-step tasks, emphasizing reliable execution, efficiency, and oversight.

See all 219 papers

Governance by Construction for Generalist Agents
May 20, 2026Segev Shlomov, Iftach Shoham, Alon Oved +7LLM Guardrails AI Agent Governance
IBM Haifa, Israel
Formal Policy Enforcement for Agentic Systems
Feb 18, 2026Nils Palumbo, Sarthak Choudhary, Jihye Choi +4Runtime Enforcement for AI Agents AI Agent Governance
University of Wisconsin–Madison · Cornell University · Langroid
Stateful Governance for Concurrent Agentic Systems
Aug 3, 2026Yuxiang Peng, Xiaodi WuAgentic Workflows AI Agent Governance
Purdue University · West Lafayette, Indiana, USA · University of Maryland, College Park +1

May 20, 2026J/K move · Enter open · S save

Governance by Construction for Generalist Agents

Segev Shlomov, Iftach Shoham, Alon Oved, Ido Levy+6

IBM Haifa, Israel

LLM Guardrails AI Agent Governance

Open paper AskPDF arXiv

Enterprise agents are increasingly expected to operate autonomously across tools and interfaces, yet production deployments require governance by construction. Systems must specify which actions are allowed, when human oversight is required, and what information may be exposed, without rebuilding the agent for each domain. This demo presents CUGA's policy system, a modular policy-as-code layer that composes with a generalist LLM agent to deliver predictable, auditable, and compliance-aware behavior in compound workflows without model fine-tuning. We present a runtime governance architecture that enforces policy interventions at every critical stage of execution. Rather than passively constraining behavior, policies intercept the agent at five structural checkpoints: upstream of planning (Intent Guard), within the system prompt to steer reasoning (Playbook), at the tool-call boundary to enforce proper usage (Tool Guide), outside the reasoning loop as a Human-in-the-Loop gate for high-risk actions (Tool Approvals), and at the output stage to filter and structure the final response (Output Formatter). Together, these stages embed governance continuously across the agent's execution pipeline rather than treating it as an afterthought. Using a healthcare scenario and a multi-layered enforcement intervention, the demo shows dynamic playbook injection for structured tool-sequence enforcement, intent guards that block malicious or accidental harmful requests, and human-in-the-loop tool approval checkpoints for potentially destructive actions. The artifact illustrates how typed governance primitives enable faster, safer deployment of enterprise agentic systems while improving policy adherence and execution consistency.

Abstract

Agentic Workflows

Explore similar work

Governance by Construction for Generalist Agents

Formal Policy Enforcement for Agentic Systems

Stateful Governance for Concurrent Agentic Systems