Compositional Policy Violations: When Step-Level Compliance Fails In Agentic AI Workflows
Ashwini Kurady, Sri Sai Charith Grandhi, Rajesh Gupta, Sumit Mamoria
cs.AI · cs.MA
Quick verdict
Proposes a four-class taxonomy of compositional policy violations in agentic workflows plus a detection architecture; sharp concept, entirely unevaluated.
Summary
The paper argues that governance for agentic AI workflows is misaligned with the policies organizations actually hold: classifiers, per-turn rails, and span evaluators judge single steps, while referral thresholds, authority limits, and review requirements are properties of whole executions. It defines a Compositional Policy Violation (CPV) — every step locally compliant, the composed execution in breach — and offers a four-class taxonomy: Authority Creep (individually authorized judgment calls accumulate until they reroute who may decide), Threshold Laundering (a correct gate runs before the guarded quantity finalizes), Cumulative Sum Violation (no gate exists at the aggregate scope), and Context Collapse (faithful summaries progressively discard decision-relevant facts). Each class is illustrated with hypothetical underwriting or purchasing workflows (Tables 1-2), and Section 4 argues the correct repair — relocating, adding, or widening a gate — is dictated by where the guarded quantity mutates. Section 5 sketches a provenance-aware detector (ingestion, state reconstruction, policy evaluation, compositional detection) governed by history-completeness and recount-from-raw-provenance invariants, and Section 5.6 candidly lists failure modes including oracle collusion and cost. Main limitations: the work is entirely conceptual — no implementation, dataset, experiment, or real case study; Table 2's drift numbers are undefined and internally inconsistent; the central impossibility claim about step-level monitors is asserted informally; and the admitted cost of Context Collapse re-derivation may make that repair impractical.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Every step of an agentic workflow can pass its own step-scoped check while the composed execution violates a workflow-level policy, and no improvement in step-level monitor accuracy can detect this class.
- CPVs form four classes — Authority Creep, Threshold Laundering, Cumulative Sum Violation, and Context Collapse — distinguished by which evidence is absent from every step.
- The correct repair (relocating, adding, or widening a gate) is dictated by where the guarded quantity mutates over the workflow, not by design preference.
- Sound detection requires evaluating policies over complete execution traces and recomputing guarded quantities from raw provenance rather than the pipeline's derived representation.
Strengths
Precise definition with a genuinely sharp distinguishing property
Section 3 defines a CPV via three joint conditions and a 'no single culprit' argument; the order-dependence example in 3.1 (swapping consolidation and reclassification moves which step crosses the escalation line, so responsibility depends on scheduling rather than on any component) cleanly separates CPVs from race conditions, stale-state errors, and ordinary misbehavior.
Candid self-limitation, rare for a paper proposing an architecture
Section 5.6 enumerates provenance loss ('undetectable in principle'), oracle collusion between an LLM detector and an LLM pipeline, extraction error, entity resolution, hidden state, and cost — including that Context Collapse re-derivation 'approaches the cost of the un-automated decision itself'. Section 2 likewise concedes trace-level monitoring is not novel and separates non-adversarial CPVs from adversarial fragmentation attacks (Ahad et al. [10]).
Repair guidance, not just detection
Careful separation of superficially similar classes
Regulatory and empirical anchoring of the taxonomy
Weaknesses
Entirely unevaluated
Illustrative numbers are undefined and internally inconsistent
Central impossibility claim is asserted, not formalized
The flagship repair may be self-defeating
Architecture stays at block-diagram level
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a Compositional Policy Violation (CPV) in agentic AI?
A CPV is a failure where every individual step of an agentic workflow passes its own local check, yet the workflow as a whole violates a governing policy such as a referral threshold, authority limit, or review requirement. Because the violation exists only in the composition of individually compliant steps, step-level monitors and guardrails cannot see it.
What are the four types of compositional policy violations in this paper?
Authority Creep: individually authorized judgment calls accumulate until the pipeline quietly reroutes who is entitled to decide. Threshold Laundering: a correct gate checks a value before the value finishes changing, and nothing re-checks. Cumulative Sum Violation: individually compliant actions sum past a limit that no gate watches at the aggregate scope. Context Collapse: faithful summaries progressively discard decision-relevant facts until the reviewer approves a case that no longer resembles the original submission.
Has this paper implemented or tested its CPV detection architecture?
No. The paper is conceptual: it defines the taxonomy, derives where each repair belongs, and describes a four-stage provenance-aware architecture in component terms, but it reports no implementation, dataset, experiment, or real-world deployment.
How does this work differ from guardrails like Llama Guard or NeMo Guardrails?
Those systems evaluate single prompts, responses, turns, or actions in isolation. The paper argues they are structurally blind to violations defined over the whole execution trace — for example, a total that crosses a threshold only after the gate has already run — and that detection requires retaining raw provenance and recomputing guarded quantities over the complete trace.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Review is based on the embedded text extraction; Figures 1-6 are diagrams that could only be judged from their captions and surrounding prose.
- The extract appears complete (title through reference [21], including both tables), but silent truncation at page boundaries cannot be fully excluded.
- The Table 2 inconsistencies are as they appear in the extracted text; the typeset PDF could conceivably render these values differently.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.