NOMOS makes written policies safer for tool-using agents

If a language model extracts a rule incorrectly, a deterministic enforcer will follow the mistake exactly. Can a system make these gates operable without asking another model to judge every call, while also detecting rules that are structurally valid but reject legitimate work? NOMOS addresses that design question for tool-using agents.

NOMOS adds static rule repair, deterministic fact-based call blocking, and transcript replay to make extracted policy gates operable and screen harmful bindings.

First, NOMOS checked extracted rules against tool schemas and static tables, then replayed them on recorded undefended runs.

An independent checker measured policy-breaking calls among tool calls that changed data: with the gate, rates fell from 66.3% to 2.6% on airline and from 30.8% to 6.9% on retail.

Airline task success improved significantly when estimated over two to four trials per task; retail raw task success did not. The evidence supports safer execution, not universal task improvement, because refused calls and missing compiled clauses shape the measured result.

The conclusion is limited to the tested policies, tools, and evaluators: unencoded clauses can remain unenforced, structured tool data is trusted, and the gate controls tool calls rather than text. The study did not establish behavior in unseen domains or under poisoned records.