If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary | AI Paper Digest

TL;DR Highlight

Enforcing policy at a tool boundary outside the agent cut trace failures from 57.6% to 0.2%.

Who Should Read

Backend developers whose agents borrow human credentials and who worry about data leaks and prompt injection through tool calls.

Core Mechanics

Prompts only made answers more discreet
- Six prompt rules cut exact final-answer disclosure from 27.5% to 3.7%.
- Data entering model context barely moved, from 55.1% to 52.1%.
- Forbidden backend effects only fell from 8.1% to 5.5%.
OBPE is a tool boundary outside the agent
- A proxy between agent and backend mediates every request and response.
- It narrows queries on the way in and filters records, strips fields, or masks values on the way out.
- The agent cannot choose its policy or spoof its identity under the stated assumptions.
Two policy tiers, and the agent tier only narrows
- The data owner's policy sets the maximum grant (the ceiling).
- Agent policy can only shrink it, never widen it.
- The model proves the policy plan is independent of rule match order.
Allowed calls can still be held
- Argument values or external state can turn a call into deny or defer (wait for approval).

Evidence

Trace failure fell sharply in the primary contrast
- Prompt-only was 57.6% versus 0.2% with prompt plus OBPE (four models, 3,621 trials).
- The equally cluster-weighted reduction was 41.2 points [95% CI 27.7, 54.9].
Safe-useful completion rose
- Judge A went from 22.0% to 58.9% and Judge B from 22.1% to 54.4%.
- Paired cluster-weighted gains were 21.8 points [9.5, 35.2] and 19.1 points [6.9, 32.2].
OBPE beat an output reviewer
- On Sonnet, the Haiku 4.5 output-reviewer arm had 58.6% trace failure versus 0.0% for OBPE.
- The reviewer needed 930 extra model calls; OBPE added none.
Red-team and operator ladder results
- In 20 adaptive red-team tasks, trace failure was 173/231 (74.9%) prompt-only versus 2/227 (0.9%) with OBPE.
- On Sonnet, record controls alone protected 46.7% of trials and the full operator set protected 100.0%.

How to Apply

Strip sensitive fields in a proxy wrapper
- Pick one tool call you use today and wrap it to delete password, email, and internal-note fields before the response reaches the model.
- Use a field allowlist in code instead of hiding things with prompts.
Put an allowlist for reads and writes in front of the agent
- Beyond the agent's credential, list the allowed actions, resources, and query scope per task in an owner policy.
- Use per-agent policy only to narrow that scope.
AND policy conditions into queries and cap results
- Combine the caller's filter with the policy filter using AND, and re-truncate results after fetch regardless of backend behavior.
- Deny before dispatch if the conditions can't be combined.
Route risky calls to approval
- For after-hours deploys or amounts over a threshold, send an approval request on a channel the agent cannot read.
- Bind approval to the full request snapshot and deny on timeout.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the paper's method: real OBPE is enforced by proxy code, not prompts)

Below are the tool definitions and a sample response used by our agent.
{{tool definitions and sample response JSON}}

Assume we add a policy enforcement layer at this tool boundary and summarize in a table:
1. Response fields that must never enter model context (to remove)
2. Fields that need masking and the masking method
3. Policy conditions to AND into the query before the call, and a result cap
4. Call conditions on arguments or state that should be deferred for approval
5. Paths where filtered counts or naming conventions could let a value be inferred

Next step: ask for a Python function that removes the fields from item 1 in a real response.

Terminology

OBPE (Out-of-Band Policy Enforcement)Policy enforced by a proxy outside the agent's reasoning. Like a building security gate that controls entry regardless of an employee's judgment.

CedarA typed authorization policy language for permit and forbid rules. The paper uses it as the core permit-or-forbid decision engine.

deferA result that neither runs nor rejects a call but holds it until an external approval arrives. Like a request waiting in an approval queue.

trace failureProtected data entered model context, an exact protected value appeared in the answer, or a forbidden backend effect completed. Determined deterministically from logs.

safe-useful completionAllowed work finished with no trace failure and no semantic disclosure. Only safely completed work counts.

lethal trifectaAn agent with private data access, untrusted content, and external communication. With all three, harm can occur even while it follows its task.

Related Papers

Original Abstract (Expand)

Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.