The Actionable Policy schema is presented, a YAML-based format for specifying what model responses can and cannot contain that enables exception-based policy governance, and a set of tools to help define the schema and enforce policy.
Abstract
When it comes to safety policies for generative AI, one size does not fit all. Each organization and use case needs to mitigate different risks depending on the application context, regulatory environment, organizational values, and user personas. Yet, existing policy specification approaches are designed for traditional access control and fail to capture the nuances of GenAI application: the enforcement of content-based constraints. We present two contributions to address this gap: (1) the Actionable Policy schema, a YAML-based format for specifying what model responses can and cannot contain. The schema enables exception-based policy governance, proposing exceptions to track policy violations; (2) synthetic data generation pipeline that produces policy-aligned training data for model alignment and testing, and a set of tools to help define the schema and enforce policy. Together, these enable organizations to specify policies once and enforce them throughout the GenAI application lifecycle: from model alignment to runtime monitoring. The Actionable Policy schema, example policies, and tools are available as open source: https://github.com/ibm-granite/granite.trust.policy-tools We welcome new ideas, contributions and feedback.
Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the $\tau^2$-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean $\mathrm{Pass}^4$ from $0.42$ to $0.62$, with the largest gain on telecom ($0.19$ to $0.61$), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.
Seongjae Kang, Taehyung Yu, Sung Ju Hwang· 1 citation
AI agents increasingly enter practitioner workflows through delegated, multi-step tasks, such as data analysis, document review, coding, and summarization. Existing governance debates tend to emphasize provider-level technical governance, which steers general model behavior, and policy, which defines the boundaries of legitimate use. Both are necessary, but neither fully specifies how domain-specific norms should guide the intermediate choices agents make during task execution. This article develops runtime configuration as a meso-level, agent-facing governance mechanism for this operational gap. Runtime configuration refers to persistent, inspectable, and revisable instructions and supporting materials loaded at use time that specify decision authority, documentation and evidence-preservation duties, and conditions for human escalation. These artifacts bridge domain practice and agent execution. They translate situated normative commitments into agent-facing guidance while connecting that guidance to technical controls, work outputs, and human review. We illustrate the framework through a case study of investigative journalism, comparing three conditions: an unconfigured baseline and two configured conditions that guided agent runs on a public-records data task. Across the runs, the clearest differences associated with configuration concerned the conditions of delegation rather than substantive accuracy: The runs differed in escalation, provenance, workflow recoverability, and the visibility of consequential decisions. The aim of runtime configuration is not to replace model alignment, policy, expertise, or institutional accountability. Instead, it makes situated delegation more inspectable by translating normative domain commitments into operational guidance for agentic work.
Nick Hagar, Nick Diakopoulos· AI and Ethics· 0 citations
SAGE-Fin is presented, a finance-specific authority-handoff contract that makes the proposed effect, not merely its text, the object of runtime control, and its results establish executable conformance, not independent safety accuracy.
Rui Tang, Qiang Liu, Yichi Zhang et al.· 0 citations
ReATest is introduced, an automated approach to enhancing PaC workflows through systematic test case generation from Rego specifications, which achieves an average 35.43% reduction in test suite size and retains 64.57% of the generated test cases.
Thanh-Binh Trinh, N. Le, Nguyen Viet Ha· Software quality journal· 0 citations
Existing agentic approaches for recommendation system optimization remain fundamentally reactive: they adjust parameters in response to observed metric changes but lack the ability to proactively design controlled experiments, personalize strategies at the user-segment level, or accumulate reusable experimental methodology across tasks. We present PILOT (Proactive Insight Learner for Online Tree-Experiments), an LLM-agent framework that organizes three roles within a constrained control loop where deterministic services enforce all safety, statistical, and permission boundaries: (1) an Experiment Manager that drives the full experiment lifecycle -- task intake, observation governance, anomaly recovery, and postmortem -- by selecting only from a rule-generated legal-command envelope; (2) a Search Planner that proposes candidate decision trees for user-segment-level personalization, invoked only when the Manager requests planning; and (3) a Memory Curator that asynchronously distills experiment outcomes into strategy-level domain knowledge and provenance-tracked methodology, failure-isolated from the main loop. The Manager makes the agent proactive, the Planner enables population-level personalization beyond global tuning, and the Curator turns every completed task into a learning opportunity for the next. Deployed on Taobao's platform with 5 experimental buckets, PILOT is compared against ROAM(Reactive Optimization with Agent-driven Moves), a free-exploration agent without lifecycle governance or structured hypothesis testing. PILOT achieves up to +1.40% IPV, +1.60% Core IPV, +0.96% transaction count, and +1.50% transaction amount, improving over ROAM's best results (+1.00% IPV, +0.90% Core IPV, +0.60% transaction count, +1.13% transaction amount) while raising search efficiency from 53.3% to 93.3% (+40 pp), with no human intervention throughout the experimental cycle.
Jiuning Lin, Ruiquan Lan, Xiaodong Zhu et al.· 0 citations
This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions through pre-admission vetting and task-aware runtime authorization, and compares ASP against heuristic and LLM-based policy realizations using identical inputs and output contracts.
A new method, called CW-Net, translates the reasoning process of an autonomous vehicle’s AI system into understandable concepts that explain its behavior.