If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary
Marc Millstone, Tyler Akidau and colleagues put policy enforcement outside agent reasoning entirely, at a trusted tool boundary that narrows the query before the backend call and filters the response, with a proof that agent policy cannot widen the data owner's grant.
Ask this paper
The framing: Give an agent a human credential and it inherits the reach without the judgment that limited it; every over-broad request stays credential-valid the whole way.
Why not prompts: A prompted guardrail asks one fallible reasoner to both interpret the task and enforce its limits, which is the structural objection this paper builds around.
OBPE mechanics: Authorize the typed operation and resource, narrow the query pre-call, then filter records and fields or mask values in the response, with semantic gating that can deny or hold an authorized call on argument values or external state.
The proof: Under stated conditions the policy plan is order-independent and agent policy can only narrow the data-owner ceiling, never widen it.
Numbers: Across 3,621 trials against Jira and ServiceNow mocks with 20 adaptive red-team tasks, trace failure fell from 57.6% to 0.2% (cluster-weighted -41.2 points); fulfillment fell from 79.1% to 60.9% while paired safe-useful completion rose 21.8 points.
Abstract
Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.