ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
ActGov checks each proposed tool action at runtime before it can affect the outside world.
The paper frames the problem as LLM agents letting untrusted tool outputs steer later actions beyond the user’s authorization. ActGov builds policies from tool specs, benign tasks, and failure traces, then verifies updates with SMT counterexample checking. At runtime, it converts tool calls into finite policy records and allows only actions inside the task-scoped boundary. The authors report lower indirect prompt-injection success on AgentDojo and AgentDyn while preserving task utility. ArXiv · AI/CL/LG's note
The paper frames the problem as LLM agents letting untrusted tool outputs steer later actions beyond the user’s authorization. ActGov builds policies from tool specs, benign tasks, and failure traces, then verifies updates with SMT counterexample checking. At runtime, it converts tool calls into finite policy records and allows only actions inside the task-scoped boundary. The authors report lower indirect prompt-injection success on AgentDojo and AgentDyn while preserving task utility. ArXiv · AI/CL/LG's note
score 5