PolicyGuide：從守護單一行動到引導整個工作流程——面向政策合規的LLM智能體

摘要

客服大型語言模型代理在使用者代理行事時必須遵循組織政策。合規失敗可能源於被禁止的行為（例如核准不合資格的變更）或遺漏的程序要求（例如身分驗證或確認）。執行期防護措施可以介入有風險的行為，但僅針對單一動作的檢查無法引導代理完成多步驟程序。遵循工作流程的系統支援既定流程的執行，但其主要目標是完成工作流程，而非保障代理行為的安全。相對地，PolicyGuide 將每個領域政策編譯成工作流程圖，並在使用者回合邊界呼叫主動式驗證器。驗證器從持續保存的圖狀態中，調解待處理的要求，並沿著符合政策的路徑回傳針對特定步驟的補救措施。在 τ^2-bench 的航空、零售與電信領域中，搭配 GPT-5.4 代理與驗證器，PolicyGuide 將平均 Pass^4 從 0.42 提升至 0.62，其中電信領域的增幅最大（從 0.19 到 0.61），該領域最具工作流程結構。相同的工作流程可遷移至 Claude Sonnet 4.6 與 Gemini 2.5 Pro 代理。補充評估發現，在對抗性使用者情境下，觀察到的攻擊成功率為最低；而在作者設計的工作流程層級驗證中，程序合規性表現最強。

English

Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the τ^2-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean Pass^4 from 0.42 to 0.62, with the largest gain on telecom (0.19 to 0.61), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.