LLM-based agents are increasingly being deployed in contexts requiring complex authorization policies: customer service protocols, approval workflows, data access restrictions, and regulatory compliance. Embedding these policies in prompts provides no enforcement guarantees. We present PCAS, a Policy Compiler for Agentic Systems that provides deterministic policy enforcement. Enforcing such policies requires tracking information flow across agents, which linear message histories cannot capture. Instead, PCAS models the agentic system state as a dependency graph capturing causal relationships among events such as tool calls, tool results, and messages. Policies are expressed in a Datalog-derived language, as declarative rules that account for transitive information flow and cross-agent provenance. A reference monitor intercepts all actions and blocks violations before execution, providing deterministic enforcement independent of model reasoning. PCAS takes an existing agent implementation and a policy specification, and compiles them into an instrumented system that is policy-compliant by construction, with no security-specific restructuring required. We evaluate PCAS on three case studies: information flow policies for prompt injection defense, approval workflows in a multi-agent pharmacovigilance system, and organizational policies for customer service. On customer service tasks, PCAS improves policy compliance from 48% to 93% across frontier models, with zero policy violations in instrumented runs.

翻译：基于大语言模型（LLM）的智能体正日益部署于需要复杂授权策略的场景中：客户服务协议、审批工作流、数据访问限制以及法规遵从性。将这些策略嵌入提示中无法提供任何执行保证。本文提出PCAS（智能体系统策略编译器），一种能够提供确定性策略执行保障的机制。执行此类策略需要追踪智能体间的信息流，而线性消息历史无法捕捉这种流动。为此，PCAS将智能体系统状态建模为依赖图，该图捕获了工具调用、工具结果和消息等事件间的因果关系。策略采用基于Datalog衍生的语言进行表述，通过声明式规则来考虑传递性信息流和跨智能体溯源。参考监视器会拦截所有操作并在执行前阻止违规行为，从而提供独立于模型推理的确定性执行。PCAS接收现有智能体实现和策略规范作为输入，并将其编译成通过构造即符合策略的仪表化系统，无需进行特定于安全性的重构。我们在三个案例研究中评估PCAS：用于提示注入防御的信息流策略、多智能体药物警戒系统中的审批工作流，以及客户服务的组织策略。在客户服务任务中，PCAS将前沿模型的策略遵从率从48%提升至93%，且在仪表化运行中实现了零策略违规。