ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
ActGov is a runtime guardrail for LLM agents that checks every proposed tool call against task-scoped authorization and security policies before the call can affect the outside world, aiming to stop indirect prompt-injection attacks in long, dynamic tool-use workflows. The nice idea is that it treats agent safety as per-action policy validation over a semantic abstraction of tools, context, and permissions, with policies iteratively refined and SMT-checked rather than trusting the model to spot malicious instructions; its main caveat is that effectiveness still depends on the completeness and fidelity of tool specifications, policy abstractions, and observed failure traces.
Abstract
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing defenses isolate injected content or constrain execution with predefined plans and static policies, but these approaches are brittle under dynamic workflows and scale poorly across extensible tool ecosystems. In this work, we present ActGov, a runtime enforcement framework that validates each LLM-proposed tool action before it causes external effects. Built on a unified semantic model of authorization, actions, runtime context, and security constraints, the ActGov-Policy component iteratively constructs a policy set from tool specifications, benign tasks, and observed failure traces, with each update verified through SMT-based counterexample checking. At runtime, ActGov-Runtime abstracts each tool call into finite policy records and permits it only if it remains within the task-scoped authorization boundary and satisfies all applicable policies. This per-action enforcement preserves authorization throughout long-horizon, dynamically branching workflows. We evaluate ActGov on the AgentDojo and AgentDyn benchmarks across multiple models and attack configurations. It shows that ActGov consistently reduces the success rate of indirect prompt-injection attacks while preserving task utility, significantly outperforming existing defenses. These results demonstrate that ActGov can enforce fine-grained authorization over dynamic agent executions without relying on the underlying LLM to correctly identify malicious instructions.