The Pulse
ActGov Inserts Policy Checks Before AI Agents Execute Tool Calls
An arXiv paper introduces ActGov, a runtime enforcement framework that validates proposed tool actions against task-scoped authorization and security policies before they produce external effects.
AI.info Team ·
AI agents increasingly carry out long-running workflows through external tools, allowing information from untrusted outputs to influence later actions. A paper submitted to arXiv on September 21, 2026, introduces ActGov, a runtime enforcement framework designed to validate an agent’s proposed tool action before it produces an external effect.
The paper presents the system as an alternative to defenses that isolate injected content or constrain agents with predefined plans and static policies. According to the abstract, those approaches can be brittle when workflows change and difficult to scale across expanding tool ecosystems. ActGov instead evaluates each proposed action as it is made, preserving an authorization check throughout a workflow that may branch in response to new observations.
ActGov separates action proposals from authorization
The framework has two named components. ActGov-Policy constructs a policy set from tool specifications, benign tasks and observed failure traces. The policy set is updated iteratively, with each change subjected to SMT-based counterexample checking. The abstract describes this process as a way to test whether a proposed policy contains a counterexample to its security requirements before the update is accepted.
ActGov-Runtime handles enforcement during execution. It abstracts each tool call into a finite collection of policy records and permits the call only when it remains within the authorization boundary assigned to the task and satisfies all applicable policies. The decision is made before the proposed action causes an external effect.
This structure leaves the language model responsible for proposing actions, but not for making the final authorization decision. The paper’s stated goal is to enforce fine-grained authorization without relying on the underlying model to correctly recognize malicious instructions. An action can therefore be evaluated against the deployed policy even when untrusted material has influenced the model’s proposal.
Per-action checks support branching workflows
The abstract emphasizes that ActGov is intended for long-horizon workflows in which the next action is not fixed in advance. Rather than requiring the agent to follow a predetermined sequence, the framework checks each new tool call against the task’s authorization boundary and the security constraints that apply at that point in execution.
That distinction matters for agents that use external tools repeatedly. A system may begin with one task objective, receive additional information from a tool, and then propose a different action. ActGov’s runtime component is described as evaluating the new call as its own policy record while preserving the authorization conditions established for the task.
The paper does not describe the framework as a guarantee that every possible attack will fail. Its abstract instead reports an evaluation on the AgentDojo and AgentDyn benchmarks across multiple models and attack configurations. The authors say ActGov consistently reduces the success rate of indirect prompt-injection attacks while preserving task utility and significantly outperforming existing defenses.
Evaluation covers AgentDojo and AgentDyn
The abstract identifies AgentDojo and AgentDyn as the evaluation settings, but it does not provide benchmark counts, model names, attack-success percentages or utility scores. It also does not give a breakdown of the attack configurations or report cross-domain transfer results.
The reported findings are presented at a general level: ActGov reduces the success rate of indirect prompt-injection attacks while retaining task utility. The paper says these results show that the framework can enforce fine-grained authorization over dynamic agent executions without depending on the language model to identify malicious instructions correctly.
The available source also does not specify the detailed policy categories, semantic scopes, formation levels, solver workflow or threat-model conditions described in some accounts of the system. Those implementation details and numerical results would require evidence from the full paper rather than the arXiv abstract.
Policy construction remains part of the design
ActGov’s approach places importance on how policies are formed before runtime enforcement begins. The ActGov-Policy component uses tool specifications, benign tasks and observed failure traces as inputs, then iteratively constructs and checks the policy set. Runtime enforcement applies the resulting policies to individual calls rather than asking the model to make an unrestricted security judgment from the surrounding text.
The paper’s central claim is therefore narrower than a promise to make agents generally secure. ActGov is presented as a mechanism for checking proposed tool actions against task-scoped authorization and security constraints before external effects occur. Its evaluation suggests that this can reduce indirect prompt-injection success while preserving useful work in the benchmark settings examined by the authors.
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation is authored by Kaiyuan Zhang, Yuke Peng, Ke Jiang and Yinqian Zhang.