If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary

Marc Millstone; Tyler Akidau; Johannes Brüderl; Marat Pekker

cs.AIAug 27, 2026

If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary

Authors: Marc Millstone, Tyler Akidau, Johannes Brüderl, Marat Pekker

Organizations: Redpanda Data

Abstract

Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.

Figures & tables

Panel of Figure 1 — Figure 1: OBPE mediates a complete tool exchange. The tier-aware composition gives the owner policy permit authority and lets agent policy narrow it. Request shaping and gating run before dispatch; response shaping runs before data enters model context. A deferred call waits outside the agent’s reach, and the boundary emits an audit record with its decision.

Panel of Figure 2 — Figure 2: From a typed call to a policy plan and its execution. Policy matching is separate from backend data. Deny ends the exchange. Defer shapes and stores a request without dispatch; permit continues through the backend and response plan. Credential $C$ remains an outer execution limit.

Operator	Stage	Acts on	Most-restrictive combination	Claim	Evidence
deny	gate	gate result	most restrictive gate result	Exact	Released
scope-query	request	query and record limit	conjunction; lowest limit	Exact	Released
filter-records	response	record set	owner keeper $\land$ agent keeper	Exact	Released
drop-write-field	request	gate and write map	remove absence-safe fields; deny otherwise	Exact	Implemented, unreachable
clamp-write-arg	request	write map	lowest value in the declared direction	Exact	Implemented, unreachable
strip-field	response	field set	intersection of retained fields	Exact	Released

Table 1: The operator surface. Claim distinguishes exact stage results from best-effort or operational properties. Evidence states where behavior is exercised or implemented.

Capability	Released artifact	Production implementation
Write controls	Write guard on supported partial updates. Drop and clamp only in synthetic tests.	Broader schema mappings for persisted write workflows.
Human deferral	Hold/no-dispatch and per-call transition tests. Terminal timeout and approved dispatch absent.	Durable, ordered approval log. Attribute-based access control protects inspection and resolution.
Temporal policy	No released execution.	Implemented over durable, trusted history.
Aggregate policy	No released execution.	Implemented over durable, trusted history.

Table 2: Released and production implementation surfaces. Production entries are descriptive, not artifact evidence.

	Comparison	How to read it
RQ1	Prompt only $\rightarrow$ Prompt + full OBPE, on four models.	Adds only the policy boundary. This is the primary test of what OBPE adds beyond detailed prompt rules; it is not a provider ranking.
RQ2a	Raw $\rightarrow$ Raw + full OBPE and Prompt only $\rightarrow$ Prompt + full OBPE, on Sonnet.	A $2\times 2$ prompt-rules $\times$ OBPE design. The two effects test OBPE with and without prompt help; their difference tests interaction.
RQ2b	Record controls $\rightarrow$ + strip fields $\rightarrow$ + mask fields and guard writes $\rightarrow$ + pattern masking, on Sonnet.	A cumulative ablation with all other inputs fixed. Adjacent steps isolate field stripping and pattern masking, but not masking from write guard.
RQ3	Prompt + output reviewer $\leftrightarrow$ Prompt + full OBPE, on Sonnet.	Compares a model that reviews assistant text with a boundary that mediates requests, responses, and backend effects. It is not a ranking of all LLM guardrails, and no local A2A experiment is claimed.

Table 3: Experimental comparisons. Each arrow changes one named mechanism.

Panel of Figure 3 — Figure 3: Absolute observed rates across all four models when full OBPE is added to the same six-rule prompt. Lower is better for trace failure; higher is better for the two utility outcomes. Judge B showed the same direction (Table 4 ). Paired, equally cluster-weighted estimates and CIs appear in the text.

Outcome	Raw	Prompt	Prompt+OBPE
Trace failure $\downarrow$	63.3%	57.6%	0.2%
Entered agent context $\downarrow$	55.1%	52.1%	0.0%
Exact final disclosure $\downarrow$	27.5%	3.7%	0.2%
Semantic disclosure, Judge A $\downarrow$	30.0%	8.8%	1.6%
Semantic disclosure, Judge B $\downarrow$	25.4%	8.2%	2.1%
Forbidden backend effect $\downarrow$	8.1%	5.5%	0.0%

Table 4: Descriptive rates across all four models. Arrows show the desired direction. Slightly different denominators reflect unavailable outcomes; the archive retains every count.

Policy configuration	Protected	Fulfilled (A)	Safe-useful (A)
Record controls	46.7%	75.1%	21.8%
+ field stripping	69.4%	70.0%	37.6%
+ masking and write guard	88.6%	65.7%	51.9%
+ pattern masking (full)	100.0%	66.2%	63.0%

Table 5: Descriptive Sonnet rates across the cumulative OBPE ladder. Protected means no deterministic trace failure; judge-scored columns report Judge A; higher is better in all columns.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

System or configuration	Agent- inaccessible	Deterministic	Interoperable	Resource aware	Boundary shaping	External gating
Envoy ext_proc with external policy [ 18 ]	P	P	Y	P	Y	P
AgentCore Policy, base [ 2 ]	Y	Y	P	P	N	N
AgentCore Policy with Dogwood temporal rules [ 4 , 17 ]	Y	Y	P	P	N	N
AgentCore Policy with model-based guardrails [ 3 ]	Y	P	P	P	P	N
Progent [ 35 ]	Y	P	P	P	N	P
CaMeL [ 13 ]	P	Y	P	P	N	P

Appendix

Table 6: Reviewed systems at the cited versions (Y = yes, P = partial or conditional, N = no). The table compares enforcement properties, not overall system quality. The OBPE row describes the released HTTP artifact, so interoperability and external gating remain partial.

Obligation	Purpose	Evidence or control
Query joins use conjunction	Preserves caller and policy filters	Vertical refusal and query-join tests
Pattern masks use canonical order	Prevents rule-order dependence	Golden fixture
Mask placeholders are inert	Prevents remasking	Golden fixture
Full redaction supersedes partial rewrites	Fixes one content normal form, not a semantic meet	Composition fixture
Caps are enforced after fetch	Backend cannot evade the cap	Proxy invariant
Row filters see unprojected records	Projection cannot change predicates	Proxy fetch contract

Appendix

Table 7: Preconditions for Propositions 1 – 2 and INV-SG. Each result holds only when the corresponding obligation is satisfied.

Condition	Formal role	Released artifact	Conformance	Not released
O1 identity/mediation	All claims	Bound identity; HTTP path	Identity/path tests; released grid	MCP; remote A2A
O2–O3 fixed semantics	Permutation invariance	Staged path; sensitivity chain	Stage/full-path tests; mutations	Product-order registry
O4 safe writes	Write monotonicity	Guard live; drop/clamp unreachable	Guard full path; drop/clamp synthetic	Broader write workflows
O5 trusted decisions	Defer/history	Hold path; nonterminal in-memory transition	Hold/no-dispatch tests	Terminal timeout; durable, temporal, aggregate
Owner ceiling	Propositions 1 – 3	Two-tier staged path	Tier attribution; mutation checks	Production deployment

Appendix

Table 8: Evidence boundary for O1–O5 and the owner ceiling. The formal results assume each condition; the remaining columns state what is implemented, tested, or outside the released artifact.

Panel of Figure 4 — Figure 4: Product order for two principal-risk dimensions. Arrows point toward greater vulnerability; the shaded nodes are incomparable. Production implements the richer registry, while the released proxy uses a one-dimensional chain.

Annotation	Meaning
@id	Stable policy name used for lookup and audit.
@transform	Selects the wrapper decision or shaping operator.
@field_group	Names a response allowlist; matched groups meet by intersection.
@cap_limit	Positive collection cap; matched caps meet by minimum.
@pattern_mask_fields , @pattern_mask_rules	Name fields to scan and schema-defined pattern categories.
@write_guard_fields	Names fields the agent may not originate; omission must preserve stored state.

Appendix

Table 9: Released OBPE annotation contract. Comma-separated values name entries in the connector schema.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 279 papers

Governance by Construction for Generalist Agents
May 20, 2026Segev Shlomov, Iftach Shoham, Alon Oved +7LLM Guardrails AI Agent Governance
IBM Haifa, Israel
AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards
Oct 20, 2026Chao Shang, Wanyu Du, Yi Zhang +1Tool Access Control for LLM Agents LLM Guardrails
AWS AI Labs
PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents
Jun 28, 2026Seongjae Kang, Taehyung Yu, Sung Ju HwangTool-Augmented Language Model Agents LLM Guardrails
KAIST

May 20, 2026J/K move · Enter open · S save

Governance by Construction for Generalist Agents

Segev Shlomov, Iftach Shoham, Alon Oved, Ido Levy+6

IBM Haifa, Israel

LLM Guardrails AI Agent Governance

Open paper AskPDF arXiv

Enterprise agents are increasingly expected to operate autonomously across tools and interfaces, yet production deployments require governance by construction. Systems must specify which actions are allowed, when human oversight is required, and what information may be exposed, without rebuilding the agent for each domain. This demo presents CUGA's policy system, a modular policy-as-code layer that composes with a generalist LLM agent to deliver predictable, auditable, and compliance-aware behavior in compound workflows without model fine-tuning. We present a runtime governance architecture that enforces policy interventions at every critical stage of execution. Rather than passively constraining behavior, policies intercept the agent at five structural checkpoints: upstream of planning (Intent Guard), within the system prompt to steer reasoning (Playbook), at the tool-call boundary to enforce proper usage (Tool Guide), outside the reasoning loop as a Human-in-the-Loop gate for high-risk actions (Tool Approvals), and at the output stage to filter and structure the final response (Output Formatter). Together, these stages embed governance continuously across the agent's execution pipeline rather than treating it as an afterthought. Using a healthcare scenario and a multi-layered enforcement intervention, the demo shows dynamic playbook injection for structured tool-sequence enforcement, intent guards that block malicious or accidental harmful requests, and human-in-the-loop tool approval checkpoints for potentially destructive actions. The artifact illustrates how typed governance primitives enable faster, safer deployment of enterprise agentic systems while improving policy adherence and execution consistency.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

Governance by Construction for Generalist Agents

AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards

PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents