LLM agent actions controlled by runtime policy enforcement system
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Cryptography and SecurityArtificial Intelligence
Summary
Large language models (LLMs) can run complex tasks by using external tools, but sometimes they do things outside what they're allowed to do, which can be risky. The authors created ActGov, a system that checks every action an LLM wants to take before it actually happens, making sure it follows set rules and permissions. It updates these rules dynamically and stops bad instructions even when the LLM doesn’t recognize them as harmful. Their testing showed ActGov effectively blocks common attacks while still letting useful tasks finish.
What this means in practice
- •For software security teams: Block unauthorized actions from AI agents in automated workflows by validating each tool call against dynamic security policies.
- •For cloud platform operators: Ensure AI-driven service integrations adhere to task-specific permissions to reduce risks from malicious or faulty agent commands.
Authors
Kaiyuan Zhang, Yuke Peng, Ke Jiang, Yinqian Zhang
Abstract
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing defenses isolate injected content or constrain execution with predefined plans and static policies, but these approaches are brittle under dynamic workflows and scale poorly across extensible tool ecosystems. In this work, we present ActGov, a runtime enforcement framework that validates each LLM-proposed tool action before it causes external effects. Built on a unified semantic model of authorization, actions, runtime context, and security constraints, the ActGov-Policy component iteratively constructs a policy set from tool specifications, benign tasks, and observed failure traces, with each update verified through SMT-based counterexample checking. At runtime, ActGov-Runtime abstracts each tool call into finite policy records and permits it only if it remains within the task-scoped authorization boundary and satisfies all applicable policies. This per-action enforcement preserves authorization throughout long-horizon, dynamically branching workflows. We evaluate ActGov on the AgentDojo and AgentDyn benchmarks across multiple models and attack configurations. It shows that ActGov consistently reduces the success rate of indirect prompt-injection attacks while preserving task utility, significantly outperforming existing defenses. These results demonstrate that ActGov can enforce fine-grained authorization over dynamic agent executions without relying on the underlying LLM to correctly identify malicious instructions.