Compositional Policy Violations: When Step-Level Co... | AI Research

Compositional Policy Violations: When Step-Level Compliance Fails In Agentic AI Workflows
This paper identifies a critical governance failure in modern agentic AI workflows, where individual steps in a process may be perfectly compliant, yet the final outcome violates organizational policy. While current AI safety systems focus on "step-level" monitoring—checking individual prompts or actions in isolation—the authors argue that many important policies, such as authority limits and referral thresholds, are properties of the entire workflow trace. They define this mismatch as a Compositional Policy Violation (CPV) and propose a new architecture to detect these failures by evaluating policies over complete execution histories rather than isolated steps.

The Problem: Why Step-Level Checks Fail

Governance for agentic workflows has largely converged on step-scoped predicates, such as input-output classifiers and guardrails. These tools ask if a specific action is permitted based on the information available at that moment. However, the authors demonstrate that this approach is structurally insufficient. Because a workflow accumulates context and permissions over time, a decision made at the end of a process is a function of the entire history. If a policy depends on the aggregate state of a request, a check that only sees a single step is "blind" to the violation, regardless of how accurate or sophisticated that monitor is. The ai agents story also surfaces in Stanford Researchers Develop TRACE to Fix..., adding another angle.

A Taxonomy of Compositional Failures

The authors introduce a four-part taxonomy to categorize how these violations occur:

• Authority Creep: Occurs when a sequence of individually authorized operations shifts the representation of a request, causing a final routing gate to evaluate the case under the wrong authority tier.

• Threshold Laundering: Happens when a gate checks a quantity against a limit correctly, but a later step in the workflow modifies that quantity, causing the final result to exceed the limit without being re-checked.

• Cumulative Sum Violation: Occurs when multiple individual actions are compliant on their own, but their aggregate total exceeds a policy limit (e.g., several small purchases that, when combined, exceed a daily spending cap).

• Context Collapse: Arises when information is summarized or transformed at each hand-off, causing the final record to drift so far from the original submission that the final gate evaluates a case that no longer matches the policy’s intent. The ai agents story also surfaces in Andrew Ng Launches OpenWorker to Deliver..., adding another angle.

Provenance-Aware Detection

To address these failures, the paper proposes a shift from step-level monitoring to a provenance-aware runtime architecture. Instead of relying on the derived representations passed between agents, this approach evaluates policies over the complete execution trace. By recomputing guarded quantities directly from raw provenance data, the system can verify if the final, composed state of a workflow adheres to governing policies. This ensures that even if individual agents perform their tasks correctly, the overall workflow is held to the standards required by the organization.

Key Takeaways for AI Governance

The authors emphasize that CPVs are not caused by "bad" agents or faulty individual monitors, but by the structural way workflows are composed. Because the evidence required to identify a violation is often absent from any single step, the solution is not to improve individual monitors, but to implement governance that can reason across the entire execution history. This requires moving beyond local, turn-based checks toward systems that understand the full context and temporal evolution of an AI-driven decision. The same ai agents question is explored in Artificial Id, which adds a research perspective. as detailed in the full paper on Arxiv