ActGov builds its policy set from tool specs and failure traces, with each update SMT-verified

arXiv 2609.24446·medium signalXBlueskyLinkedInCopy link

ActGov validates every LLM-proposed tool action before it causes an external effect, on the premise that plan-based and static-policy defenses are brittle once workflows branch dynamically across an extensible tool ecosystem. Its policy component iteratively constructs the policy set from tool specifications, benign tasks and observed failure traces, with each update checked by SMT-based counterexample search; at runtime each tool call is abstracted into finite policy records and permitted only inside the task-scoped authorization boundary. On AgentDojo and AgentDyn across multiple models and attack configurations it reduced indirect prompt-injection success while preserving task utility. The design point worth stealing: enforcement never asks the LLM to identify malicious instructions.