Large language models cannot decide what rules verifiers can check
Not Self-Decidable: LLMs Cannot Draw the Boundary of What an Agent Verifier Can Check
Artificial IntelligenceComputation and LanguageCryptography and Security
Summary
Sometimes software agents need to check if actions follow certain rules, but some rules require outside judgment rather than a simple automatic check. The authors found that large language models (LLMs) can’t reliably tell which rules can be checked automatically and which need a judge. They tested various LLMs on legal and financial rules and saw the models often make mistakes and disagree. To fix this, the authors propose a method that only accepts automatic checks when multiple models agree and double-check the results, reducing errors but also limiting coverage.
What this means in practice
- •For compliance teams: Use model agreement and intervention-based validation to reduce errors in automatic rule checking for finance and legal compliance systems.
- •For healthcare software developers: Implement multi-model corroboration to improve automated verification of externally imposed healthcare rules within clinical decision support tools.
Authors
Anthony Rhodes
Abstract
A verifier for an agent faces rules of two kinds: the ones a fixed check can settle and the ones that require a judge. A team that derives its own checks fixes that split up front. Where the requirements come from outside, as in finance, healthcare and law, the agent enforces rules it did not write, so the split falls to runtime, recurring for every predicate of every rule on every action at a rate no reviewer can audit. Every escalation scheme assumes a model can make that decision itself, that it is self-decidable. Across six corpora, including the EU AI Act, FINRA guidance and a deployed credit agent, we collect roughly 22,000 labels from four models built by three labs. They agree almost perfectly where the answer is obvious and collapse on regulatory text; their errors run in opposite directions, so no model can be trusted as the conservative choice; and on the deployed agent's own rule-set they err together, over-claiming that a fixed check will do, the direction that never gets escalated. We introduce CoVer (corroborate-then-verify), which treats unanimity as a nomination, admitting a predicate only when the check synthesized for it survives intervention, reading fields the agent cannot write and holding under deterministic rewording. That gate rejects most of what corroboration wrongly admits, at a cost in coverage we report rather than tune away. The obvious alternative, agreement with a reference judge, certifies nothing: it climbs from 30% to 77% across calibration bands while the genuinely decidable share does not move, because a judge drawn from the population under indictment ratifies the blind spot it shares. Self-decidability is not a capability to elicit from a model but a boundary the verifier must construct.