SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints
On the map: LLM agents and tool use → General LLM agent frameworks and benchmarks
Abstract (arXiv)
As language agents increasingly automate critical tasks, their ability to follow domain-specific standard operating procedures (SOPs), policies, and constraints when taking actions and making tool calls becomes essential yet remains underexplored. To address this gap, we develop an automated evaluation pipeline SOPBench with: (1) executable environments containing 167 tools/functions across seven customer service domains with service-specific SOPs and rule-based verifiers, (2) an automated test generation framework producing over 900 verified test cases, and (3) an automated evaluation framework to rigorously assess agent adherence from multiple dimensions. Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions. The original code serves as oracle rule-based verifiers to assess compliance, reducing reliance on manual annotations and LLM-based evaluations. We evaluate 18 leading models, and results show the task is challenging even for top-tier models (like GPT-4o, Claude-3.7-Sonnet), with variances across domains. Reasoning models like o4-mini-high show superiority while other powerful models perform less effectively (pass rates of 30%-50%), and small models (7B, 8B) perform significantly worse. Additionally, language agents can be easily jailbroken to overlook SOPs and constraints. Code, data, and over 24k agent trajectories are released at https://github.com/Leezekun/SOPBench.
Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Placed in General LLM agent frameworks and benchmarks, one of 16 directions in LLM agents and tool use. Builds on 37 of its 50 references that are in the map. First posted on arXiv 11 Mar 2025.
Builds on
37 of 50 references.
Closest ancestors · 6
Same direction, newest first
- 2025SOP-Agent: Empower General Purpose AI Agent with Domain-Specific SOPs16 Jan
- 2024IDEA: Enhancing the Rule Learning Ability of Large Language Model Agent through Induction, Deduction, and Abduction19 Aug
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains17 Jun
- 2024TravelPlanner: A Benchmark for Real-World Planning with Language Agents2 Feb
- 2023AgentBench: Evaluating LLMs as Agents7 Aug
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework1 Aug
Other references · 31
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
- 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
- 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,628
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,302
- 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
- 2023WizardLM: Empowering large pre-trained language models to follow complex instructionscited by 1,116
- 2024OpenHands: An Open Platform for AI Software Developers as Generalist Agentscited by 956
19 more
- 2023ChatDev: Communicative Agents for Software Developmentcited by 893
- 2024DeepSeek-V3 Technical Reportcited by 724
- 2023ChemCrow: Augmenting large-language models with chemistry toolscited by 609
- 2023API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMscited by 574
- 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 547
- 2023Identifying the Risks of LM Agents with an LM-Emulated Sandboxcited by 514
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 476
- 2023ToolAlpaca: Generalized Tool Learning for Language Models with 3000 Simulated Casescited by 383
- 2024CodeAgent: Enhancing Code Generation with Tool-Integrated Agent Systems for Real-World Repo-level Coding Challengescited by 278
- 2023SafetyBench: Evaluating the Safety of Large Language Modelscited by 189
- 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 161
- 2024Benchmarking Complex Instruction-Following with Multiple Constraints Compositioncited by 147
- 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 127
- 2024ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stagescited by 77
- 2025ComplexFuncBench: Exploring Multi-Step and Constrained Function Calling under Long-Context Scenariocited by 53
- 2024SysBench: Can Large Language Models Follow System Messages?cited by 26
- 2024RuleArena: A Benchmark for Rule-Guided Reasoning with LLMs in Real-World Scenarioscited by 26
- 2024Beyond Instruction Following: Evaluating Inferential Rule Following of Large Language Modelscited by 23
Built on by
Citing papers per year: 2025: 6; 2026: 15.
21 papers.
Sort:
By area:
- 2025LLM Agents Should Employ Security Principlescited by 28
- 2025A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agentscited by 12
- 2026Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?cited by 6
- 2026Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agentscited by 4
- 2025SOP-Maze: Evaluating Large Language Models on Complicated Business Standard Operating Procedurescited by 3
- 2025TOD-ProcBench: Benchmarking Complex Instruction-Following in Task-Oriented Dialoguescited by 2
- 2026SAGE: A Service Agent Graph-guided Evaluation Benchmarkcited by 2
- 2026Tool-Making and Self-Evolving LLM Agents in Low-Latency Systemscited by 2
- 2025LogicIF: Towards Complex Logic Instruction Followingcited by 1
- 2025Analyzing and Internalizing Complex Policy Documents for LLM Agentscited by 1
- 2026COVENANT: Natural-Language Workflow Compilation for Aligned Agent Executioncited by 1
- 2026CentaurBench: Benchmarking LLM Capabilities on Augmenting vs. Automating Real-World Work Taskscited by 1
9 more
- 2026FM SO.P: A Progressive Task Mixture Framework with Automatic Evaluation for Cross-Domain SOP Understandingcited by 0
- 2026VAKRA: Evaluating Multi-Hop Reasoning Across APIs and Retrieval Under Tool-Use Policiescited by 0
- 2026ττ-Bench: An Environment for End-To-End, Realistic Agent Constructioncited by 0
- 2026The Unreliable Progress Bar: Can LLM Agents Reliably Report Task Progress Throughout Execution?cited by 0
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Errorcited by 0
- 2026Symbolic Temporal Supervision of LLM Agents Using Contractscited by 0
- 2026MCPGen: Benchmarking LLMs on Executable MCPWorkflow Developmentcited by 0
- 2026From Alignment to Access Control: A Framework for GenAI Policy Enforcementcited by 0
- 2026HEXIS: Compiling Agent Skills into Extended Finite State Machinescited by 0
- 2026HEXIS: Compiling Agent Skills into Extended Finite State Machines24 Sep 2026
- 2026From Alignment to Access Control: A Framework for GenAI Policy Enforcement22 Sep 2026
- 2026MCPGen: Benchmarking LLMs on Executable MCPWorkflow Development20 Sep 2026
- 2026Symbolic Temporal Supervision of LLM Agents Using Contracts16 Sep 2026
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Error13 Sep 2026
- 2026The Unreliable Progress Bar: Can LLM Agents Reliably Report Task Progress Throughout Execution?8 Sep 2026
- 2026ττ-Bench: An Environment for End-To-End, Realistic Agent Construction4 Sep 2026
- 2026CentaurBench: Benchmarking LLM Capabilities on Augmenting vs. Automating Real-World Work Tasks19 Aug 2026
- 2026VAKRA: Evaluating Multi-Hop Reasoning Across APIs and Retrieval Under Tool-Use Policies12 Aug 2026
- 2026Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?5 Aug 2026
- 2026COVENANT: Natural-Language Workflow Compilation for Aligned Agent Execution28 Jul 2026
- 2026Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents13 Jul 2026
9 more
- 2026Tool-Making and Self-Evolving LLM Agents in Low-Latency Systems9 Jul 2026
- 2026SAGE: A Service Agent Graph-guided Evaluation Benchmark10 Apr 2026
- 2026FM SO.P: A Progressive Task Mixture Framework with Automatic Evaluation for Cross-Domain SOP Understanding10 Feb 2026
- 2025A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agents23 Dec 2025
- 2025TOD-ProcBench: Benchmarking Complex Instruction-Following in Task-Oriented Dialogues20 Nov 2025
- 2025Analyzing and Internalizing Complex Policy Documents for LLM Agents13 Oct 2025
- 2025SOP-Maze: Evaluating Large Language Models on Complicated Business Standard Operating Procedures10 Oct 2025
- 2025LogicIF: Towards Complex Logic Instruction Following12 Aug 2025
- 2025LLM Agents Should Employ Security Principles29 May 2025
- 2025LLM Agents Should Employ Security Principlescited by 28
- 2025A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agentscited by 12
- 2026Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?cited by 6
- 2026Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agentscited by 4
- 2026SAGE: A Service Agent Graph-guided Evaluation Benchmarkcited by 2
- 2026Tool-Making and Self-Evolving LLM Agents in Low-Latency Systemscited by 2
- 2025LogicIF: Towards Complex Logic Instruction Followingcited by 1
- 2025Analyzing and Internalizing Complex Policy Documents for LLM Agentscited by 1
- 2026COVENANT: Natural-Language Workflow Compilation for Aligned Agent Executioncited by 1
- 2026ττ-Bench: An Environment for End-To-End, Realistic Agent Constructioncited by 0
- 2026The Unreliable Progress Bar: Can LLM Agents Reliably Report Task Progress Throughout Execution?cited by 0
- 2026Symbolic Temporal Supervision of LLM Agents Using Contractscited by 0
- 2026Symbolic Temporal Supervision of LLM Agents Using Contracts16 Sep 2026
- 2026The Unreliable Progress Bar: Can LLM Agents Reliably Report Task Progress Throughout Execution?8 Sep 2026
- 2026ττ-Bench: An Environment for End-To-End, Realistic Agent Construction4 Sep 2026
- 2026Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses?5 Aug 2026
- 2026COVENANT: Natural-Language Workflow Compilation for Aligned Agent Execution28 Jul 2026
- 2026Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents13 Jul 2026
- 2026Tool-Making and Self-Evolving LLM Agents in Low-Latency Systems9 Jul 2026
- 2026SAGE: A Service Agent Graph-guided Evaluation Benchmark10 Apr 2026
- 2025A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agents23 Dec 2025
- 2025Analyzing and Internalizing Complex Policy Documents for LLM Agents13 Oct 2025
- 2025LogicIF: Towards Complex Logic Instruction Following12 Aug 2025
- 2025LLM Agents Should Employ Security Principles29 May 2025
- 2025SOP-Maze: Evaluating Large Language Models on Complicated Business Standard Operating Procedurescited by 3
- 2025TOD-ProcBench: Benchmarking Complex Instruction-Following in Task-Oriented Dialoguescited by 2
- 2026CentaurBench: Benchmarking LLM Capabilities on Augmenting vs. Automating Real-World Work Taskscited by 1
- 2026FM SO.P: A Progressive Task Mixture Framework with Automatic Evaluation for Cross-Domain SOP Understandingcited by 0
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Errorcited by 0
- 2026MCPGen: Benchmarking LLMs on Executable MCPWorkflow Developmentcited by 0
- 2026From Alignment to Access Control: A Framework for GenAI Policy Enforcementcited by 0
- 2026HEXIS: Compiling Agent Skills into Extended Finite State Machinescited by 0
- 2026HEXIS: Compiling Agent Skills into Extended Finite State Machines24 Sep 2026
- 2026From Alignment to Access Control: A Framework for GenAI Policy Enforcement22 Sep 2026
- 2026MCPGen: Benchmarking LLMs on Executable MCPWorkflow Development20 Sep 2026
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Error13 Sep 2026
- 2026CentaurBench: Benchmarking LLM Capabilities on Augmenting vs. Automating Real-World Work Tasks19 Aug 2026
- 2026FM SO.P: A Progressive Task Mixture Framework with Automatic Evaluation for Cross-Domain SOP Understanding10 Feb 2026
- 2025TOD-ProcBench: Benchmarking Complex Instruction-Following in Task-Oriented Dialogues20 Nov 2025
- 2025SOP-Maze: Evaluating Large Language Models on Complicated Business Standard Operating Procedures10 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2026One-Eval: An Agentic System for Automated and Traceable LLM Evaluation
- 2026MANTRA: Synthesizing SMT-Validated Compliance Benchmarks for Tool-Using LLM Agents
- 2025Agent-S: LLM Agentic workflow to automate Standard Operating Procedures
- 2026CirrusBench: Evaluating LLM-based Agents Beyond Correctness in Real-World Cloud Service Environments
- 2026HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following
- 2026OmegaUse-SOP: SOP Engineering for Professional Computer Use from Human Demonstrations
- 2025AgentCompass: Towards Reliable Evaluation of Agentic Workflows in Production
- 2026A2E : An End-to-End Agent Auditing Engine