Put the gate where the agent cannot reason past it

Segev Shlomov et al. · 1 authors · IBM Research, Haifa · 2026 · arXiv:2605.20874

Put the gate where the agent cannot reason past it

Opening

A policy written inside the system prompt competes with the task for the model’s attention, and the model decides which one wins. This demo moves governance out of the conversation and into fixed points along the execution pipeline, where a rule fires whether or not the agent agrees with it.

What the paper does

CUGA’s policy system is a modular policy-as-code layer that composes with a generalist LLM agent, with no model fine-tuning. Instead of asking the model to behave, it intercepts the agent at five structural checkpoints and enforces a typed governance primitive at each one. The demo runs a healthcare scenario with a multi-layered enforcement intervention: dynamic playbook injection for tool sequences, an intent guard at the front, human-in-the-loop approval for potentially destructive tool calls, and an output filter at the end.

Findings

  1. Five fixed points along one pipeline — policies intercept the agent upstream of planning, inside the system prompt, at the tool-call boundary, outside the reasoning loop, and at the output stage.

policies intercept the agent at five structural checkpoints: upstream of planning (Intent Guard), within the system prompt to steer reasoning (Playbook), at the tool-call boundary to enforce proper usage (Tool Guide), outside the reasoning loop as a Human-in-the-Loop gate for high-risk actions (Tool Approvals), and at the output stage to filter and structure the final response (Output Formatter)

  1. The human gate sits outside the reasoning loop — high-risk actions pause outside the agent’s own deliberation, while intent guards block harmful requests before planning starts.

dynamic playbook injection for structured tool-sequence enforcement, intent guards that block malicious or accidental harmful requests, and human-in-the-loop tool approval checkpoints for potentially destructive actions

  1. No retraining required — the layer adds governance to a generalist agent while leaving the model itself untouched.

a modular policy-as-code layer that composes with a generalist LLM agent to deliver predictable, auditable, and compliance-aware behavior in compound workflows without model fine-tuning

Caveat

This is a demo paper: the abstract reports no measured adherence or block rates, no comparison against systems without the policy layer, and no latency or dollar cost for the five checkpoints. How much risk each stage removes is not established.

What this means for 5ac

Our controls already sit at three of the five points: triage before a worker spawns, a HITL kanban card for customer-facing actions, and delivery checks at the end. The map makes the missing two visible: nothing intercepts inside the tool-call boundary beyond the harness defaults, and nothing filters output before it reaches a customer. Reading the five points as a gap list is cheaper than buying a governance layer.

Source