Verified Is Not Authorized: How Agent Guardrails Earn the Right to Act

TL;DR for operators

An agent guardrail that learns from incidents must solve three different problems: produce a better rule, verify that the rule is executable and internally consistent, and establish enough evidence to let it control real actions.

VEPA separates these responsibilities. An LLM proposes policy changes, a deterministic verifier rejects malformed or conflicting rules, and a Bayesian authority mechanism determines which verified rules may actively allow or refuse agent actions.

In replayed safety and security benchmarks, this architecture improves decision quality while producing fewer regressions than evaluated adaptive-memory alternatives. Its practical contribution is a disciplined process for changing enforcement policies without automatically deploying every plausible correction.

For organizations operating consequential AI agents, verified policy changes and authorized policy changes should be treated as different states. Verification establishes structural consistency; activation requires empirical support. Neither establishes complete operational safety.

A guardrail update can fix one failure and create another

Consider an enterprise agent that retrieves customer information and sends it to an external service. After an unauthorized disclosure, the organization introduces a restriction on external transfers.

The restriction may prevent similar disclosures while also blocking legitimate customer-support workflows. Correcting the original failure is therefore insufficient. The revised guardrail must distinguish prohibited actions from previously acceptable ones.

This becomes more difficult when the agent encounters new circumstances after deployment. Natural-language policies can be revised, but their enforcement still depends on how an LLM interprets each situation. Executable rules offer more reproducible decisions, although constructing and updating them introduces a separate problem: how can the organization establish that a new rule deserves enforcement authority?

In VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails, Nguyen and colleagues¹ investigate this problem through a framework that continuously evolves executable policies.

Their component ablation provides an initial indication of where reliability comes from. Removing deterministic verification reduces final-round F1 by 0.13 in the mixed-stream experiment. Replacing multi-objective search with greedy updates reduces it by 0.04, while removing evidence-aware activation reduces it by 0.03 (Section 5.1, Figure 6).

Verification makes the largest measured contribution in this experiment. Yet the framework still requires a separate mechanism to establish whether a structurally valid rule has enough empirical support to be deployed.

Policy evolution requires controlled changes, not just new instructions

VEPA first represents agent interactions as typed events. These records describe attributes such as the actor, intended action, data, recipient, purpose, authorization, context, and tool.

An LLM may extract information unavailable directly from execution traces. The resulting event is evaluated against a policy consisting of executable conditions associated with binary allow or refuse decisions.

When feedback reveals a failure, another LLM proposes changes using operations including Add, Delete, Rewrite, Split, and Merge.

Two controls govern what happens next.

First, a deterministic verifier checks whether the proposed rules use valid attributes, operators, and values. It also rejects policies containing overlapping rules that issue contradictory decisions.

Second, VEPA evaluates each viable update against accumulated evidence. A candidate that corrects recent failures may still perform poorly on cases the previous policy handled correctly.

Rather than selecting the first acceptable update, VEPA maintains multiple feasible candidates on a Pareto frontier. Its two objectives are failure correction and preservation of earlier correct decisions. Behavior-density sampling encourages exploration of candidates with different observed decision patterns, and a deterministic max-min criterion selects the final policy.

This converts guardrail adaptation into an explicit policy change-management problem.

The verifier establishes that a policy is well-formed and free of conflicting rule decisions within its formal representation. The optimization procedure then considers how well that policy performs on recorded examples. Neither step establishes correctness for every future event.

A verified rule still needs permission to enforce

VEPA introduces an additional distinction between a verified rule and an active rule.

For each verified rule, the system counts labeled events within its scope that support or contradict its decision. It models the rule’s error probability using a Beta-Bernoulli posterior:

Here, $c_t(r)$ counts contradictions, while $s_t(r)$ counts supporting observations. Additional contradictions raise the estimated error risk; consistent support reduces it.

A rule becomes active only when a selected posterior quantile is below a configured threshold. New evidence can subsequently remove its authority.

The experimental configuration uses a Beta(1,1) prior, a 5% risk threshold, and the posterior median as its activation criterion. Under those settings, a rule with no contradictions requires at least 13 supporting examples to activate. One contradiction raises the approximate support requirement to 32 examples.

These numbers describe the framework’s chosen statistical criterion, not a guaranteed maximum future error rate.

In particular, using the posterior median is less conservative than requiring a high posterior quantile to fall below the threshold. Furthermore, evidence used to construct and select a rule may also contribute to evaluating its authority. The reported posterior condition therefore does not provide an automatic selection-adjusted or anytime-valid reliability guarantee.

The substantive design principle is that structural validity and empirical authorization are separate decisions. An organization can retain a valid policy improvement without immediately allowing it to control agent behavior.

Benchmark evidence favors controlled policy evolution

The study evaluates 3,293 recorded agent events from ASSEBench-Safety, ASSEBench-Security, and ATBench. These include unauthorized access, data leakage, prompt injection, unsafe modifications, and related risks.

Methods predict outcomes on unseen sequential batches before receiving feedback. The standard experiment uses ten deployment rounds, five shuffled-stream seeds, and labels revealed for 50% of events after each round.

The strongest evidence is comparative performance under matched event streams and feedback conditions.

The central comparison evaluates methods on events covered by VEPA’s active formal policy. This measures decision quality within the selected coverage set, rather than complete-stream reliability.

That distinction matters because VEPA’s active formal-policy coverage expands over deployment, reaching approximately 80% on ASSEBench-Safety, 89% on ASSEBench-Security, and 88% on ATBench at final evaluation.

For uncovered events, the hybrid system can use an LLM fallback. Its full-stream results are reported separately and should not be conflated with covered-event performance.

The sparse-feedback, corrupted-feedback, and longer-horizon experiments test robustness rather than establishing independent new mechanisms. Their results suggest that VEPA’s relative advantage survives several controlled departures from the default protocol. They do not establish resistance to arbitrary feedback poisoning or unrestricted changes in deployment conditions.

Enterprise deployment needs an explicit authority boundary

For organizations deploying agents with privileged tools or sensitive data, Cognaptus draws a practical inference from the architecture: policy updates can be managed as versioned, testable enforcement artifacts rather than only revised instructions.

A governance workflow could preserve the distinction between proposed rules, verified rules, and active rules. Incident feedback would generate candidate updates; verification would screen structural defects; regression testing would compare decisions against established cases; and an evidence threshold would govern activation.

Monitoring would need to report formal-policy coverage alongside decision quality. False allows, unnecessary refusals, previously correct decisions lost after an update, and changes in rule authority measure different operational risks.

The business value depends on the application. In a customer-service agent, unnecessary refusals can interrupt legitimate work. In an agent handling privileged access, a false allow may have materially different consequences. VEPA’s decision-specific risk thresholds provide a mechanism for representing such differences, although the reported experiments use identical threshold settings for allow and refuse rules.

Organizations would also need to account for costs beyond executing rules. The authors report approximately 0.25 milliseconds for evaluating a three-predicate rule against an already parsed event. That figure excludes neural parsing, policy generation, feedback collection, and policy-search computation.

The formal guarantee begins after event parsing

VEPA’s deterministic enforcement applies to active symbolic rules operating on fixed typed events.

If the neural parser misrepresents the agent’s intended action or authorization, the verifier cannot correct that upstream interpretation. Likewise, the LLM fallback operates outside the symbolic enforcement guarantee.

The rule language also depends on a fixed schema and categorical vocabulary. An unfamiliar combination of existing attributes may be representable, but a new kind of risk requiring attributes outside that vocabulary needs a schema extension. Rich temporal and multi-step requirements are not generally captured by simple conjunctions of predicates.

Finally, the experiments replay recorded agent trajectories. They do not demonstrate how evolving guardrails perform when their interventions alter subsequent agent behavior in a live environment. Growing evidence archives and repeated policy search also create unresolved scalability considerations.

These boundaries constrain what can be claimed from the results: VEPA provides evidence of stronger adaptive guardrail performance within its evaluated protocol, together with formal structural guarantees inside its symbolic enforcement layer.

Verification is necessary; authority must be earned

VEPA advances agent governance by separating three decisions that adaptive guardrails often combine: what new rule to propose, whether its structure is valid, and whether evidence supports allowing it to enforce decisions.

The benchmark results favor this separation, especially where organizations need to correct newly observed failures without substantially degrading earlier correct behavior.

The next challenge is extending that discipline beyond benchmark replay: reliable event interpretation, statistically calibrated activation under adaptive selection, and evaluation in environments where enforcement changes what the agent does next.

For consequential agent systems, the lesson is precise: a rule becoming formally valid is not the same event as that rule becoming trustworthy enough to control operations.

Cognaptus: Automate the Present, Incubate the Future.