PolicyGuide：从守护单个动作到引导完整工作流的策略合规LLM智能体

摘要

客服大语言模型（LLM）智能体在代表用户执行操作时，必须遵循组织政策。合规失败既可能源于禁止性操作（例如批准不符合资格的变更），也可能源于遗漏程序性要求（例如身份验证或确认）。运行时防护机制可以对高风险操作进行干预，但仅针对单步操作的检查无法引导智能体完成多步骤流程。工作流遵循系统支持按预设流程执行，但其主要目标在于工作流完成，而非对智能体行为进行安全保障。相比之下，PolicyGuide 将每个领域策略编译为工作流图，并在每轮用户交互结束时调用主动验证器。验证器基于持久化的图状态，协调未决请求，并沿合规路径返回针对具体步骤的补救措施。在 τ^2-bench 基准的航空、零售和电信领域中，使用 GPT-5.4 作为智能体和验证器，PolicyGuide 将平均 Pass^4 从 0.42 提升至 0.62，其中电信领域提升幅度最大（从 0.19 到 0.61），该领域也是工作流结构化程度最高的领域。相同的工作流可迁移至 Claude Sonnet 4.6 和 Gemini 2.5 Pro 智能体。补充评估显示，在对抗性用户场景下，观测攻击成功率最低；在作者设计的工作流级验证中，程序合规性最强。

English

Customer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirmation. Runtime safeguards can intervene on risky actions, but action-local checks do not guide an agent through a multi-step procedure. Workflow-following systems support prescribed process execution, but primarily target workflow completion rather than safeguarding agent behavior. PolicyGuide instead compiles each domain policy into a workflow graph and invokes a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles open requests and returns step-specific remediation along a policy-compliant path. Across the τ^2-bench airline, retail, and telecom domains with a GPT-5.4 agent and verifier, PolicyGuide raises mean Pass^4 from 0.42 to 0.62, with the largest gain on telecom (0.19 to 0.61), the most workflow-structured domain. The same workflows transfer to Claude Sonnet 4.6 and Gemini 2.5 Pro agents. Complementary evaluations find the lowest observed attack-success rate under adversarial users and the strongest procedural compliance in an author-designed workflow-level validation.