Why action-level guards aren't enough — and what workflow-level guidance adds
The core shift is from checking each action in isolation to guiding the agent through an entire procedure. PolicyGuide's authors note that runtime safeguards can catch a forbidden action (like granting an ineligible change), but they don't help an agent remember to do required steps like identification or confirmation. That's why they compile each policy into a workflow graph and run a proactive verifier at user-turn boundaries, which reconciles open requests and returns step-specific remediation. The result: on the τ2-bench benchmark (airline, retail, telecom), average Pass 4 scores rose from 0.42 to 0.62 — a 48% relative improvement — with the largest gain in telecom (0.19 to 0.61), the most workflow-structured domain. That tells you the more procedural the task, the more workflow-level guidance helps.
Another approach, from Zwerdling et al., takes a complementary route: compile policy documents into verifiable guard code attached to tool use, then enforce compliance before each agent action. They tested it on the τ-bench Airlines domain and saw encouraging preliminary results. So while PolicyGuide focuses on proactive, whole-workflow verification, this method is more about deterministic, transparent guards at the action level — but both aim to close the gap between 'knowing the policy' and 'following the procedure.'
Can you make agents more compliant without raising cost or losing auditability?
Yes, according to FRAMES, a closed-loop framework that evolves agent skills while keeping accuracy and cost in balance. It cold-starts deployable skills from existing assets, then mutates them using consensus, selects for Pareto-optimal accuracy vs. cost, and includes an anti-regression guarantee — meaning improvements don't accidentally break other cases. Deployed on an internal production system, FRAMES achieved the best accuracy-cost trade-off among baselines, and the same gains were reproduced on τ-bench. That's important for real-world adoption: compliance improvements that double inference cost or make the agent's reasoning opaque won't fly in enterprise settings.
The anti-regression guarantee is especially relevant to the workflow-level trend. When you change a policy or a skill, you don't want to fix one compliance issue and create another. FRAMES explicitly guards against that, which is a practical concern that the other papers don't address directly. So over the next two years, expect to see more systems that not only guide workflows but also manage the evolution of those workflows safely.
What will actually change in enterprise agents — and what's still hard
The practical upshot is that enterprise agents will become more reliable at following multi-step procedures, not just avoiding single bad actions. PolicyGuide's transfer to different agents (Claude Sonnet 4.6 and Gemini 2.5 Pro) suggests these workflow-level systems are model-agnostic, which is good for enterprises that switch LLM providers. It also reported the lowest attack-success rate under adversarial users, meaning workflow-level guidance can also improve security against prompt-injection-like attempts.
But there are real challenges. Zwerdling et al. explicitly outline key challenges for real-world deployment, such as handling ambiguous policies and scaling guard code to complex workflows. Also, the gains are not uniform: PolicyGuide's improvement was much smaller in airline (0.42 to 0.62 overall, but the paper notes the largest gain in telecom), suggesting that domains with less structured procedures may benefit less. So the next two years will likely see these systems mature, but enterprises should expect to invest in policy formalization and workflow design to get the full benefit.
About These Sources
This answer is built on 3 studies (all preprints) — published from 2025 to 2026, 3 from 2024 or later — selected as the most relevant from 3 studies that passed quality screening, drawn from 33 papers retrieved from a database of over 500 million.
Sources used in this answer
PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents
PolicyGuide, which compiles policies into workflow graphs and uses a proactive verifier at user-turn boundaries, raised mean Pass 4 on τ2-bench from 0.42 to 0.62 across airline, retail, and telecom, with the largest gain in telecom (0.19 to 0.61), and transferred to other LLM agents.
FRAMES: Guarded and Dual-Objective Skill Evolution for Agents in Policy-Governed Enterprise Workflows
FRAMES, a closed-loop skill evolution framework with consensus-based mutation, Pareto selection over accuracy and cost, and an anti-regression guarantee, achieved the best accuracy-cost trade-off among baselines on an internal production system and reproduced gains on τ-bench.
Towards Enforcing Company Policy Adherence in Agentic Workflows
A deterministic, modular framework that compiles policy documents into verifiable guard code associated with tool use, enforced at runtime before each agent action, showed encouraging preliminary results on the τ-bench Airlines domain and outlined key challenges for real-world deployment.