Why action-level checks fail: you need to track the whole workflow, not just individual steps
The central reason workflow-level policy guidance fails outside demos is that most safeguards only check individual actions in isolation. A runtime guardrail might catch a forbidden action like granting an ineligible refund, but it cannot tell the agent that it forgot to verify the customer's identity or get confirmation before proceeding. This is exactly the gap identified in the PolicyGuide paper: compliance failures come from both forbidden actions and omitted procedural requirements, and action-local checks do not guide an agent through a multi-step procedure [2]. In other words, you can block a bad step, but you still can't ensure the agent follows the correct sequence of steps.
The solution proposed in PolicyGuide is to compile each domain policy into a workflow graph and use a verifier that checks the agent's state at every user-turn boundary. This proactive check reconciles open requests and returns step-specific remediation along a policy-compliant path. The result: on the τ2-bench benchmark (covering airline, retail, and telecom domains), the mean Pass@4 score—a measure of how often the agent completes the task correctly—rose from 0.42 to 0.62, a 48% relative improvement. The largest gain was in telecom, the most workflow-structured domain, where the score jumped from 0.19 to 0.61, a more than threefold increase [2]. This shows that the more procedural the task, the more value you get from workflow-level guidance—but it also shows that even with this approach, the system still fails 38% of the time on average.
The deeper hurdle: LLMs are stochastic, so you can't fully trust their reasoning or actions
Even if you build a workflow graph and checkpoints, the underlying LLM is still a probabilistic system. A separate analysis of LLM agents highlights that their stochastic nature conflicts with the safety and reliability requirements of control systems [3]. This means that even with a perfect workflow checker, the agent's reasoning and actions can still deviate unpredictably. The paper proposes a three-level guardrail model—controlling reasoning, actions, and consequences—but this is presented as a framework, not a proven solution. The implication is that workflow-level guidance alone is insufficient; you also need mechanisms to verify and control what the agent actually does, not just what it plans to do.
This is a fundamental tension: you can add checkpoints and verifiers, but you cannot eliminate the underlying unpredictability of the LLM. The PolicyGuide paper shows that workflow graphs help, but it also notes that the verifier itself is an LLM (GPT-5.4 in their experiments), which means the verification step is also probabilistic. This is a key limitation: the same stochasticity that causes compliance failures can also affect the verifier's judgments. So, while workflow-level guidance is a step forward, it does not solve the controllability problem entirely—it just moves the uncertainty to a different layer.
Portability and reconfiguration: making guidance work across different tools and domains
Another unsolved problem is that current agent architectures are often ad hoc and tightly coupled to specific environments, which limits portability and reuse. This is highlighted in the Clean Agent Architecture paper, which argues that tool-augmented agent designs are characterized by ad hoc architectures that are hard to adapt to new domains [1]. The paper proposes a pattern that separates stable workflow logic from volatile tool integrations, using standardized interfaces like the Model Context Protocol (MCP). However, this is presented as an early-stage architectural proposal, not a validated solution—the paper explicitly notes the absence of a full implementation and calls for empirical validation.
This matters for workflow-level policy guidance because if you can't easily move an agent from one domain to another, you can't easily apply the same policy guidance across different workflows. The PolicyGuide paper shows that their workflow graphs transfer to different LLM agents (Claude Sonnet 4.6 and Gemini 2.5 Pro), which is promising, but it doesn't address the broader portability of the entire agent architecture. So, while the workflow-graph approach is a step forward, the larger problem of building agents that can be reconfigured for new domains with minimal effort remains unsolved.
About These Sources
This answer is built on 3 studies (all preprints) — published in 2026, 3 from 2024 or later — selected as the most relevant from 3 studies that passed quality screening, drawn from 41 papers retrieved from a database of over 500 million.
Sources used in this answer
The Model Context Protocol in LLM Agent Architectures: The Clean Agent Architecture Pattern
The Clean Agent Architecture paper (Kulonen, 2026) argues that current tool-augmented LLM agents are ad hoc and tightly coupled to specific environments, and proposes a modular pattern using standardized interfaces like MCP, but it is an early-stage proposal without a full implementation.
PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents
PolicyGuide (Kang et al., 2026) compiles policies into workflow graphs and uses a proactive verifier at user-turn boundaries, raising mean Pass@4 from 0.42 to 0.62 on τ2-bench, with the largest gain in telecom (0.19 to 0.61), and transfers to other LLM agents.
The problem of controllability and verification in autonomous LLM agents
The controllability and verification analysis (Yevzhenko & Kurochka, 2026) identifies the stochastic nature of LLMs as a fundamental conflict with safety requirements and proposes a three-level guardrail model (reasoning, actions, consequences) as a framework, not a proven solution.