Most agent guardrails are action-local: they can veto a single risky tool call, but they have no memory of the identity check the agent skipped three turns earlier. That gap is the whole problem with policy compliance in customer-service agents, and it’s what PolicyGuide goes after.

The design choice worth stealing: compile each domain policy into a workflow graph, then run a proactive verifier at user-turn boundaries. From persisted graph state, the verifier reconciles what the user has asked for against what the policy requires and returns step-specific remediation — not a blunt “denied,” but “you still need to confirm identity before this change.” Compliance failures in enterprise CSM are rarely one forbidden action; they’re the omitted confirmation, the skipped eligibility check, spread across a multi-turn conversation. Action-local checks structurally cannot see those.

The numbers back the framing: mean Pass^4 climbs from 0.42 to 0.62 across airline, retail, and telecom, with the biggest jump on telecom — the most workflow-structured domain. And because the verifier is separated from the actor, the same compiled workflows transfer across GPT-5.4, Claude Sonnet 4.6, and Gemini 2.5 Pro agents. The HF paper page has the full ablation and the red-team results.

Here’s my reservation: a policy-as-graph is only as correct as its last compilation. Real org policies drift weekly, and a stale graph will confidently guide an agent down a path that no longer complies. Who owns keeping that graph in sync with the living policy doc — and how do you test that it still matches?

tags: [ agentic-ai ] [ conversational-ai ] [ llm-ops ] [ research ]