In plain words
A tool-using agent can follow every action-by-action check and still break a rule that applies to the whole task. This paper formalizes that problem and introduces AL-Synth, a computer tool that builds small examples of such failures.
For some purpose rules, a violation only becomes visible by comparing two executions. In tests, most language-model judges missed the example when shown one action at a time, but most identified it when shown both executions. The proof applies to genuinely relational purpose rules, not every kind of authorization rule.
The research
Can an authorization guard that checks each tool call separately enforce a rule about what an agent may disclose for a task’s purpose? The paper asks this because a sequence of allowed actions can violate a global rule, and purpose may depend on comparing more than one execution.
The paper formalizes a blind spot in tool-call guards and introduces AL-Synth to build examples that expose when episode-wide rules fail.
Can a guard that checks one tool action at a time enforce a rule about purpose? The authors formalize a violation as two executions with the same task and purpose-authorized context but different disclosures.
They prove each execution is compliant alone, so a monitor that sees only one and avoids false alarms on compliant executions must miss the pair.
AL-Synth builds such examples from symbolic agent models. In judge tests, eight of nine models never blocked the witness action by action, while eight identified it in all 30 repetitions when shown both executions.
This supports the formal conclusion: detecting this kind of violation requires comparing executions or accepting false alarms.
The formal limit applies when purpose is genuinely relational on locally authorized executions. The synthesizer is validated on small symbolic models, not in a scalability study, and tasks are synthetic.
Separately, the judge campaign evaluates models as judges, live-agent studies cover two model families, and guardrail coverage is inferred from published designs.
Analysis
Deep
- Original paper authors
- Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple
- Submitted to arXiv
- License
- arXiv non-exclusive