mlsanityData to 7 Oct 2026

Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agents

arXiv 2603.20449 ↗First posted 20 Mar 2026cs.SE cs.AIcited by 15

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Tool-augmented Large Language Models (TaLLMs) extend LLMs with the ability to invoke external tools, enabling them to interact with real-world environments. However, a major limitation in deploying TaLLMs in sensitive applications such as customer service and business process automation is a lack of reliable compliance with domain-specific operational policies regarding tool-use and agent behavior. Current approaches merely steer LLMs to adhere to policies by including policy descriptions in the LLM context, but these provide no guarantees that policy violations will be prevented. In this paper, we introduce an SMT solver-aided framework to enforce tool-use policy compliance in TaLLM agents. Specifically, we use an LLM-assisted, human-guided approach to translate natural-language-specified tool-use policies into formal logic (SMT-LIB-2.0) constraints over agent-observable state and tool arguments. At runtime, planned tool calls are intercepted and checked against the constraints using the Z3 solver as a pre-condition to the tool call. Tool invocations that violate the policy are blocked. We evaluated on the TauBench benchmark and demonstrate that solver-aided policy checking reduces policy violations while maintaining overall task accuracy. These results suggest that integrating formal reasoning into TaLLM execution can improve tool-call policy compliance and overall reliability.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 8 of its 13 references that are in the map. First posted on arXiv 20 Mar 2026.

Builds on

8 of 13 references.

References · 8

  1. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  2. 2023API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMscited by 574
  3. 2023Chameleon: Plug-and-Play Compositional Reasoning with Large Language Modelscited by 352
  4. 2023ToolkenGPT: Augmenting Frozen Language Models with Massive Tools via Tool Embeddingscited by 238
  5. 2023MetaTool Benchmark for Large Language Models: Deciding Whether to Use Tools and Which to Usecited by 209
  6. 2023TaskBench: Benchmarking Large Language Models for Task Automationcited by 138
  7. 2024A Complete Survey on LLM-based AI Chatbotscited by 71
  8. 2024Proof of Thought : Neurosymbolic Program Synthesis allows Robust and Interpretable Reasoningcited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 15.

15 papers.

Sort:

By area:

  1. 2026Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agentscited by 8
  2. 2026PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agentscited by 5
  3. 2026AgentLTL: A Trace-Verification Framework for Measuring, Enforcing, and Training Procedural Compliance in Tool-Using LLM Agentscited by 4
  4. 2026ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesiscited by 3
  5. 2026PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agentscited by 2
  6. 2026Owner-Harm: A Missing Threat Model for AI Agent Safetycited by 1
  7. 2026Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Controlcited by 1
  8. 2026When Retrieval Metrics Mislead: Measuring Policy Signal in Long-Horizon Tool-Use Agentscited by 0
  9. 2026Learning Context-Free Grammars for Grammar-Constrained Decoding via Declarative Agentic Programming with Guaranteescited by 0
  10. 2026Multi-Agent Scheduling with LLM-Assisted Contract Net Negotiation for Stream Processing in Mobile Edge Computingcited by 0
  11. 2026CAPRI: Contract-Aware Proof Repair for Isabellecited by 0
  12. 2026STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Controlcited by 0
3 more
  1. 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Errorcited by 0
  2. 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agentscited by 0
  3. 2026NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026MANTRA: Synthesizing SMT-Validated Compliance Benchmarks for Tool-Using LLM Agents
  2. 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
  3. 2026Evaluating Implicit Regulatory Compliance in LLM Tool Invocation via Logic-Guided Synthesis
  4. 2026The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestration
  5. 2025Towards Enforcing Company Policy Adherence in Agentic Workflows
  6. 2026From Natural Language Policies to Executable Obligations: A Verification Harness for Dependable In-Car LLM Agents
  7. 2026PolicyBank: Evolving Policy Understanding for LLM Agents
  8. 2026ToolGate: Contract-Grounded and Verified Tool Execution for LLMs