# Policy Enforcement

Tool-using language-model agents often execute actions their domain policies forbid, and LeanGuard places policies written in Lean 4 between the model and its tools so that only admitted calls execute. On τ 2-bench, unguarded runs of five Qwen models executed at least 33 calls the Lean policy forbids, while LeanGuard executed none; on DTap, direct prompt-injection success fell from 57.9% to 5.9% and indirect success from 22.3% to 3.8%. Denials with feedback did not significantly change task success, and the read-only deployment blocks many benign writes.

Tool-using language-model agents often execute actions their domain policies forbid, and LeanGuard places policies written in Lean 4 between the model and its tools so that only admitted calls execute. On τ 2-bench, unguarded runs of five Qwen models executed at least 33 calls the Lean policy forbids, while LeanGuard executed none; on DTap, direct prompt-injection success fell from 57.9% to 5.9% and indirect success from 22.3% to 3.8%. Denials with feedback did not significantly change task success, and the read-only deployment blocks many benign writes.

Writing tool, resource and execution policies into a task agent's prompt does not reliably prevent violations. AgentPolicyForge uses executable environments to build policy benchmarks and iteratively train policy guards, yielding PolicyGym, which spans ten policy families with 698 scenarios for training-data generation and 254 separate held-out scenarios. On PolicyGym, the final guard-based configuration achieves a 40–44% relative reduction in attack success rate and fewer benign rejections than policy prompting alone.

Writing tool, resource and execution policies into a task agent's prompt does not reliably prevent violations. AgentPolicyForge uses executable environments to build policy benchmarks and iteratively train policy guards, yielding PolicyGym, which spans ten policy families with 698 scenarios for training-data generation and 254 separate held-out scenarios. On PolicyGym, the final guard-based configuration achieves a 40–44% relative reduction in attack success rate and fewer benign rejections than policy prompting alone.

VEPA writes an agent guardrail as executable symbolic rules, has an LLM propose patches from deployment feedback while a deterministic verifier admits only structurally valid, conflict-free policies, and reaches the highest F1 on events covered by its active policy across three agent safety benchmarks while expanding the scope of deterministic enforcement during deployment.

VEPA writes an agent guardrail as executable symbolic rules, has an LLM propose patches from deployment feedback while a deterministic verifier admits only structurally valid, conflict-free policies, and reaches the highest F1 on events covered by its active policy across three agent safety benchmarks while expanding the scope of deterministic enforcement during deployment.