Stop asking the agent nicely: three preprints compile policies into enforcement

Compile the policy, don't prompt it

The dominant way to keep an agent compliant today is to write the policy into its system prompt and hope the model obeys. In a preprint, the authors of NOMOS reject that wager and compile the policy instead: natural-language rules are transformed into deterministic, statically verified tool-call gates that sit in front of every state-changing call. The reported numbers are striking — policy violations among reference-encoded clauses on state-changing calls fall from 66.3% to 2.6% in airline scenarios, and the system posts a zero attack success rate on banking benchmarks. Because the gates are verified statically, there is no need for a second LLM watching the first at runtime, and decisions land in microseconds, on-premise. m:…0812

This suggests the compliance conversation is about to get much more concrete. A prompt instruction is a request; a compiled gate is a mechanism, and mechanisms are auditable in a way requests are not. The microsecond-latency detail matters because the classic objection to enforcement layers is that they slow the agent down or add another model call's worth of cost — static verification removes both objections at once. For executives signing off on agent deployments in regulated settings, the implication is to ask vendors not what their agents are told, but what is mechanically impossible for them to do. m:…0812

One monitor, any formalism

A second preprint tackles the fragmentation problem: every agent framework has its own way of emitting events, so a safety monitor built for one does not port to another. The authors of AgenticRV propose a formalism-agnostic runtime-verification architecture that separates the monitoring formalism from the execution boundary using canonical event adapters. The framework is reported to integrate with LangGraph, MCP, and A2A, and it formalizes the conditions under which blocking an unsafe operation is safe — notably, blocking does not require all monitors to remain in a permanent violation state, which keeps the architecture from deadlocking on its own alarms. m:…6632

The read here is standardization. Right now, safety tooling for agents is framework-specific craft work; a canonical event layer would let one set of policies follow the agent across LangGraph, MCP, and A2A deployments. That is the kind of boring infrastructure that determines whether governance scales beyond a single vendor's stack. The blocking formalization is the part a compliance team would actually cite in a review: it gives a principled answer to 'under what conditions may the monitor intervene,' which is currently answered by vibes in most deployments. m:…6632

Keep the secrets out of the model

The third preprint addresses the data side of the same problem. SecureClaw is a dual-boundary architecture: a trusted gateway replaces raw sensitive data with reference IDs so the LLM never sees plaintext during planning, and a PREVIEW-COMMIT protocol requires that external state changes be executed only by a trusted executor. The reported results — 0% attack success rate on the Agent Security Bench, 0.64% on AgentDojo, 3.23% leakage on AgentLeak's parity lane — are presented as evidence that security does not have to cost task utility. The design principle is isolation: the model plans over references, and only the trusted boundary touches the real world. m:…1904

Taken together, the three preprints describe a coherent stack: compile the policy into gates, monitor across frameworks through canonical events, and keep secrets behind a gateway so the model never holds what it could leak. None of this asks the model to be good; all of it assumes the model might not be. That is the posture shift worth noting. The industry spent two years trying to align agents through better instructions. This week's research suggests the durable answer is enforcement architecture — and the numbers, if they hold up in replication, say the enforcement is both fast and effective enough to stop being optional. m:…0812 m:…1904