Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Tool-augmented Large Language Models (TaLLMs) extend LLMs with the ability to invoke external tools, enabling them to interact with real-world environments. However, a major limitation in deploying TaLLMs in sensitive applications such as customer service and business process automation is a lack of reliable compliance with domain-specific operational policies regarding tool-use and agent behavior. Current approaches merely steer LLMs to adhere to policies by including policy descriptions in the LLM context, but these provide no guarantees that policy violations will be prevented. In this paper, we introduce an SMT solver-aided framework to enforce tool-use policy compliance in TaLLM agents. Specifically, we use an LLM-assisted, human-guided approach to translate natural-language-specified tool-use policies into formal logic (SMT-LIB-2.0) constraints over agent-observable state and tool arguments. At runtime, planned tool calls are intercepted and checked against the constraints using the Z3 solver as a pre-condition to the tool call. Tool invocations that violate the policy are blocked. We evaluated on the TauBench benchmark and demonstrate that solver-aided policy checking reduces policy violations while maintaining overall task accuracy. These results suggest that integrating formal reasoning into TaLLM execution can improve tool-call policy compliance and overall reliability.
Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 8 of its 13 references that are in the map. First posted on arXiv 20 Mar 2026.
Builds on
8 of 13 references.
References · 8
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
- 2023API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMscited by 574
- 2023Chameleon: Plug-and-Play Compositional Reasoning with Large Language Modelscited by 352
- 2023ToolkenGPT: Augmenting Frozen Language Models with Massive Tools via Tool Embeddingscited by 238
- 2023MetaTool Benchmark for Large Language Models: Deciding Whether to Use Tools and Which to Usecited by 209
- 2023TaskBench: Benchmarking Large Language Models for Task Automationcited by 138
- 2024A Complete Survey on LLM-based AI Chatbotscited by 71
- 2024Proof of Thought : Neurosymbolic Program Synthesis allows Robust and Interpretable Reasoningcited by 17
Built on by
Citing papers per year: 2026: 15.
15 papers.
Sort:
By area:
- 2026Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agentscited by 8
- 2026PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agentscited by 5
- 2026AgentLTL: A Trace-Verification Framework for Measuring, Enforcing, and Training Procedural Compliance in Tool-Using LLM Agentscited by 4
- 2026ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesiscited by 3
- 2026PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agentscited by 2
- 2026Owner-Harm: A Missing Threat Model for AI Agent Safetycited by 1
- 2026Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Controlcited by 1
- 2026When Retrieval Metrics Mislead: Measuring Policy Signal in Long-Horizon Tool-Use Agentscited by 0
- 2026Learning Context-Free Grammars for Grammar-Constrained Decoding via Declarative Agentic Programming with Guaranteescited by 0
- 2026Multi-Agent Scheduling with LLM-Assisted Contract Net Negotiation for Stream Processing in Mobile Edge Computingcited by 0
- 2026CAPRI: Contract-Aware Proof Repair for Isabellecited by 0
- 2026STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Controlcited by 0
3 more
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Errorcited by 0
- 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agentscited by 0
- 2026NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agentscited by 0
- 2026NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents8 Oct 2026
- 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agents30 Sep 2026
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Error13 Sep 2026
- 2026STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control23 Aug 2026
- 2026PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents20 Aug 2026
- 2026CAPRI: Contract-Aware Proof Repair for Isabelle13 Aug 2026
- 2026Learning Context-Free Grammars for Grammar-Constrained Decoding via Declarative Agentic Programming with Guarantees6 Aug 2026
- 2026Multi-Agent Scheduling with LLM-Assisted Contract Net Negotiation for Stream Processing in Mobile Edge Computing19 Jul 2026
- 2026Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents8 Jul 2026
- 2026AgentLTL: A Trace-Verification Framework for Measuring, Enforcing, and Training Procedural Compliance in Tool-Using LLM Agents1 Jul 2026
- 2026ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesis29 Jun 2026
- 2026PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents28 Jun 2026
- 2026PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agentscited by 5
- 2026AgentLTL: A Trace-Verification Framework for Measuring, Enforcing, and Training Procedural Compliance in Tool-Using LLM Agentscited by 4
- 2026ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesiscited by 3
- 2026Owner-Harm: A Missing Threat Model for AI Agent Safetycited by 1
- 2026Learning Context-Free Grammars for Grammar-Constrained Decoding via Declarative Agentic Programming with Guaranteescited by 0
- 2026Multi-Agent Scheduling with LLM-Assisted Contract Net Negotiation for Stream Processing in Mobile Edge Computingcited by 0
- 2026STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Controlcited by 0
- 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agentscited by 0
- 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agents30 Sep 2026
- 2026STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control23 Aug 2026
- 2026Learning Context-Free Grammars for Grammar-Constrained Decoding via Declarative Agentic Programming with Guarantees6 Aug 2026
- 2026Multi-Agent Scheduling with LLM-Assisted Contract Net Negotiation for Stream Processing in Mobile Edge Computing19 Jul 2026
- 2026AgentLTL: A Trace-Verification Framework for Measuring, Enforcing, and Training Procedural Compliance in Tool-Using LLM Agents1 Jul 2026
- 2026ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesis29 Jun 2026
- 2026PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents28 Jun 2026
- 2026Owner-Harm: A Missing Threat Model for AI Agent Safety20 Apr 2026
- 2026PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agentscited by 2
- 2026Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Controlcited by 1
- 2026When Retrieval Metrics Mislead: Measuring Policy Signal in Long-Horizon Tool-Use Agentscited by 0
- 2026CAPRI: Contract-Aware Proof Repair for Isabellecited by 0
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Errorcited by 0
- 2026NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agentscited by 0
- 2026NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents8 Oct 2026
- 2026Policy Loopholes in Agent Evaluation: When Policy Ambiguity Masquerades as Agent Error13 Sep 2026
- 2026PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents20 Aug 2026
- 2026CAPRI: Contract-Aware Proof Repair for Isabelle13 Aug 2026
- 2026When Retrieval Metrics Mislead: Measuring Policy Signal in Long-Horizon Tool-Use Agents22 Jun 2026
- 2026Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control18 May 2026
Similar, not cited
Close in wording, no citation either way
- 2026MANTRA: Synthesizing SMT-Validated Compliance Benchmarks for Tool-Using LLM Agents
- 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
- 2026Evaluating Implicit Regulatory Compliance in LLM Tool Invocation via Logic-Guided Synthesis
- 2026The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestration
- 2025Towards Enforcing Company Policy Adherence in Agentic Workflows
- 2026From Natural Language Policies to Executable Obligations: A Verification Harness for Dependable In-Car LLM Agents
- 2026PolicyBank: Evolving Policy Understanding for LLM Agents
- 2026ToolGate: Contract-Grounded and Verified Tool Execution for LLMs