Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.
Figures & tables
Figure 1: OBPE mediates a complete tool exchange. The tier-aware composition gives the owner policy permit authority and lets agent policy narrow it. Request shaping and gating run before dispatch; response shaping runs before data enters model context. A deferred call waits outside the agent’s reach, and the boundary emits an audit record with its decision.
Figure 2: From a typed call to a policy plan and its execution. Policy matching is separate from backend data. Deny ends the exchange. Defer shapes and stores a request without dispatch; permit continues through the backend and response plan. Credential C remains an outer execution limit.
Operator
Stage
Acts on
Most-restrictive combination
Claim
Evidence
deny
gate
gate result
most restrictive gate result
Exact
Released
scope-query
request
query and record limit
conjunction; lowest limit
Exact
Released
filter-records
response
record set
owner keeper ∧ agent keeper
Exact
Released
drop-write-field
request
gate and write map
remove absence-safe fields; deny otherwise
Exact
Implemented, unreachable
clamp-write-arg
request
write map
lowest value in the declared direction
Exact
Implemented, unreachable
strip-field
response
field set
intersection of retained fields
Exact
Released
Table 1: The operator surface. Claim distinguishes exact stage results from best-effort or operational properties. Evidence states where behavior is exercised or implemented.
Capability
Released artifact
Production implementation
Write controls
Write guard on supported partial updates. Drop and clamp only in synthetic tests.
Broader schema mappings for persisted write workflows.
Human deferral
Hold/no-dispatch and per-call transition tests. Terminal timeout and approved dispatch absent.
Durable, ordered approval log. Attribute-based access control protects inspection and resolution.
Temporal policy
No released execution.
Implemented over durable, trusted history.
Aggregate policy
No released execution.
Implemented over durable, trusted history.
Table 2: Released and production implementation surfaces. Production entries are descriptive, not artifact evidence.
Comparison
How to read it
RQ1
Prompt only → Prompt + full OBPE, on four models.
Adds only the policy boundary. This is the primary test of what OBPE adds beyond detailed prompt rules; it is not a provider ranking.
RQ2a
Raw → Raw + full OBPE and Prompt only → Prompt + full OBPE, on Sonnet.
A 2×2 prompt-rules × OBPE design. The two effects test OBPE with and without prompt help; their difference tests interaction.
RQ2b
Record controls → + strip fields → + mask fields and guard writes → + pattern masking, on Sonnet.
A cumulative ablation with all other inputs fixed. Adjacent steps isolate field stripping and pattern masking, but not masking from write guard.
RQ3
Prompt + output reviewer ↔ Prompt + full OBPE, on Sonnet.
Compares a model that reviews assistant text with a boundary that mediates requests, responses, and backend effects. It is not a ranking of all LLM guardrails, and no local A2A experiment is claimed.
Table 3: Experimental comparisons. Each arrow changes one named mechanism.
Figure 3: Absolute observed rates across all four models when full OBPE is added to the same six-rule prompt. Lower is better for trace failure; higher is better for the two utility outcomes. Judge B showed the same direction (Table 4 ). Paired, equally cluster-weighted estimates and CIs appear in the text.
Outcome
Raw
Prompt
Prompt+OBPE
Trace failure ↓
63.3%
57.6%
0.2%
Entered agent context ↓
55.1%
52.1%
0.0%
Exact final disclosure ↓
27.5%
3.7%
0.2%
Semantic disclosure, Judge A ↓
30.0%
8.8%
1.6%
Semantic disclosure, Judge B ↓
25.4%
8.2%
2.1%
Forbidden backend effect ↓
8.1%
5.5%
0.0%
Table 4: Descriptive rates across all four models. Arrows show the desired direction. Slightly different denominators reflect unavailable outcomes; the archive retains every count.
Policy configuration
Protected
Fulfilled (A)
Safe-useful (A)
Record controls
46.7%
75.1%
21.8%
+ field stripping
69.4%
70.0%
37.6%
+ masking and write guard
88.6%
65.7%
51.9%
+ pattern masking (full)
100.0%
66.2%
63.0%
Table 5: Descriptive Sonnet rates across the cumulative OBPE ladder. Protected means no deterministic trace failure; judge-scored columns report Judge A; higher is better in all columns.
AgentCore Policy with model-based guardrails [ 3 ]
Y
P
P
P
P
N
Progent [ 35 ]
Y
P
P
P
N
P
CaMeL [ 13 ]
P
Y
P
P
N
P
Appendix
Table 6: Reviewed systems at the cited versions (Y = yes, P = partial or conditional, N = no). The table compares enforcement properties, not overall system quality. The OBPE row describes the released HTTP artifact, so interoperability and external gating remain partial.
Obligation
Purpose
Evidence or control
Query joins use conjunction
Preserves caller and policy filters
Vertical refusal and query-join tests
Pattern masks use canonical order
Prevents rule-order dependence
Golden fixture
Mask placeholders are inert
Prevents remasking
Golden fixture
Full redaction supersedes partial rewrites
Fixes one content normal form, not a semantic meet
Composition fixture
Caps are enforced after fetch
Backend cannot evade the cap
Proxy invariant
Row filters see unprojected records
Projection cannot change predicates
Proxy fetch contract
Appendix
Table 7: Preconditions for Propositions 1 – 2 and INV-SG. Each result holds only when the corresponding obligation is satisfied.
Condition
Formal role
Released artifact
Conformance
Not released
O1 identity/mediation
All claims
Bound identity; HTTP path
Identity/path tests; released grid
MCP; remote A2A
O2–O3 fixed semantics
Permutation invariance
Staged path; sensitivity chain
Stage/full-path tests; mutations
Product-order registry
O4 safe writes
Write monotonicity
Guard live; drop/clamp unreachable
Guard full path; drop/clamp synthetic
Broader write workflows
O5 trusted decisions
Defer/history
Hold path; nonterminal in-memory transition
Hold/no-dispatch tests
Terminal timeout; durable, temporal, aggregate
Owner ceiling
Propositions 1 – 3
Two-tier staged path
Tier attribution; mutation checks
Production deployment
Appendix
Table 8: Evidence boundary for O1–O5 and the owner ceiling. The formal results assume each condition; the remaining columns state what is implemented, tested, or outside the released artifact.
Figure 4: Product order for two principal-risk dimensions. Arrows point toward greater vulnerability; the shaded nodes are incomparable. Production implements the richer registry, while the released proxy uses a one-dimensional chain.
Annotation
Meaning
@id
Stable policy name used for lookup and audit.
@transform
Selects the wrapper decision or shaping operator.
@field_group
Names a response allowlist; matched groups meet by intersection.
@cap_limit
Positive collection cap; matched caps meet by minimum.
@pattern_mask_fields , @pattern_mask_rules
Name fields to scan and schema-defined pattern categories.
@write_guard_fields
Names fields the agent may not originate; omission must preserve stored state.
Appendix
Table 9: Released OBPE annotation contract. Comma-separated values name entries in the connector schema.
Enterprise agents are increasingly expected to operate autonomously across tools and interfaces, yet production deployments require governance by construction. Systems must specify which actions are allowed, when human oversight is required, and what information may be exposed, without rebuilding the agent for each domain. This demo presents CUGA's policy system, a modular policy-as-code layer that composes with a generalist LLM agent to deliver predictable, auditable, and compliance-aware behavior in compound workflows without model fine-tuning. We present a runtime governance architecture that enforces policy interventions at every critical stage of execution. Rather than passively constraining behavior, policies intercept the agent at five structural checkpoints: upstream of planning (Intent Guard), within the system prompt to steer reasoning (Playbook), at the tool-call boundary to enforce proper usage (Tool Guide), outside the reasoning loop as a Human-in-the-Loop gate for high-risk actions (Tool Approvals), and at the output stage to filter and structure the final response (Output Formatter). Together, these stages embed governance continuously across the agent's execution pipeline rather than treating it as an afterthought. Using a healthcare scenario and a multi-layered enforcement intervention, the demo shows dynamic playbook injection for structured tool-sequence enforcement, intent guards that block malicious or accidental harmful requests, and human-in-the-loop tool approval checkpoints for potentially destructive actions. The artifact illustrates how typed governance primitives enable faster, safer deployment of enterprise agentic systems while improving policy adherence and execution consistency.
Customized agent deployments define policies over tools, resources, and execution conditions. Providing these policies in the task agent's prompt does not reliably prevent violations. Training a guard requires examples of tool calls that comply with or violate those policies. We introduce AgentPolicyForge, a framework that uses executable environments to construct policy benchmarks and iteratively train policy guards. With this framework, we construct PolicyGym, a dataset across ten policy families using 698 scenarios for training data generation and 254 separate held-out scenarios for human-reviewed test sets. Tool calls are executed and their outcomes recorded to help determine whether they comply with the policy. Every violating case uses a permitted tool, requiring checks of arguments, resources, and context rather than tool identity alone. The case construction process supports iterative guard training: an attacker generates requests using retrieved strategies, and the guard is fine-tuned on balanced, environment-verified examples. Training improves policy enforcement even with a fixed archive. Updating the archive further reduces in-domain attack success compared with keeping it fixed. We compare policy-aware task agent self-regulation with a trained policy guard. On PolicyGym, the final guard-based configuration achieves a 40-44% relative reduction in attack success rate and fewer benign rejections than policy prompting alone.
LLM agents handle user requests on behalf of organizations through tool calls and must follow the company policies stated in their system prompts. Prior work approaches this as a safeguarding problem -- external checks that block non-compliant agent actions. We argue that policy adherence is a broader problem: real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value. Meeting this bar requires (i) full conversation context, (ii) self-reasoning over the policy and the current dialogue, and (iii) conversation-specific remediation that guides the agent's next turn -- three capabilities that prior safeguard work has often underestimated. We introduce POLICYGUARD, a sub-agent verifier that shares the agent's view of the dialogue, reasons over the policy in context, and provides actionable feedback for the agent's next turn. On tau^2-BENCH airline across three vendors (GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro) with four trials per setting, POLICYGUARD improves PASS4 by +12.0 / +6.0 / +12.0 pp. Per-call analyses show POLICYGUARD achieves higher policy-violation recall while blocking roughly half as often as argument-level guards.