PolicyBank: Evolving Policy Understanding for LLM Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
LLM agents operating under organizational policies must comply with authorization constraints typically specified in natural language. In practice, such specifications inevitably contain ambiguities and logical or semantic gaps that cause the agent's behavior to systematically diverge from the true requirements. We ask: by letting an agent evolve its policy understanding through interaction and corrective feedback from pre-deployment testing, can it autonomously refine its interpretation to close specification gaps? We propose PolicyBank, a memory mechanism that maintains structured, tool-level policy insights and iteratively refines them -- unlike existing memory mechanisms that treat the policy as immutable ground truth, reinforcing "compliant but wrong" behaviors. We also contribute a systematic testbed by extending a popular tool-calling benchmark with controlled policy gaps that isolate alignment failures from execution failures. While existing memory mechanisms achieve near-zero success on policy-gap scenarios, PolicyBank closes up to 82% of the gap toward a human oracle.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 24 of its 44 references that are in the map. First posted on arXiv 16 Apr 2026.
Builds on
24 of 44 references.
Closest ancestors · 9
Same direction, newest first
- 2026Formal Policy Enforcement for Real-World Agentic Systems18 Feb
- 2025VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation3 Oct
- 2025DoomArena: A framework for Testing AI Agents Against Evolving Security Threats18 Apr
- 2025Progent: Securing AI Agents with Privilege Control16 Apr
- 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning26 Mar
- 2025AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection17 Feb
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
- 2024ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agents9 Oct
Other references · 15
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,276
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,191
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 2,006
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,402
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,242
- 2023ExpeL: LLM Agents Are Experiential Learnerscited by 876
- 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memorycited by 779
- 2025τ2-Bench: Evaluating Conversational Agents in a Dual-Control Environmentcited by 627
- 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 556
- 2025ReasoningBank: Scaling Agent Self-Evolving with Reasoning Memorycited by 284
Built on by
Citing papers per year: 2026: 3.
3 papers.
Similar, not cited
Close in wording, no citation either way
- 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
- 2026From Natural Language Policies to Executable Obligations: A Verification Harness for Dependable In-Car LLM Agents
- 2026PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents
- 2026Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents
- 2026Policy-Invisible Violations in LLM-Based Agents
- 2026Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agents
- 2026AutoCedar: An Agentic Framework for Verifier-Guided Access Control Policy Synthesis
- 2026When Memory Updates but Behavior Does Not: Repairing Implicit Stale Dependencies in Personalized Agent Responses