ActionGuard — A Deterministic Authorization Monitor with Risk-Conditioned Step-Up
Published:
Status: Full run complete · part of the agent-authorization and tool-security line of work.
The question
Risk models are attractive for agent authorization because they generalize, and dangerous for the same reason. ActionGuard fixes the architecture so that generalization can only ever add friction: the deterministic policy resolves first and returns a block on a deny before the risk model is consulted. There is no code path from a low risk score to an allow, and a test asserts exactly that across risk scores from 0.0 to 1.0. A machine-learned score may escalate scrutiny — step-up approval, reversible staging — never grant.
Results so far
Nine arms over 320 stratified scenarios on Qwen2.5-7B, the same scenario set and seeds across arms — 2,880 trajectories.
| Arm | Violation rate | Per 1K actions | Task success |
|---|---|---|---|
| no_guard | 0.147 | 46.5 | 1.000 |
| prompt_only | 0.131 | 44.8 | 1.000 |
| risk_only (unsafe control) | 0.041 | 13.3 | 1.000 |
| policy_only | 0.000 | 0.0 | 1.000 |
| full | 0.000 | 0.0 | 1.000 |
- Deterministic policy alone drives violations to zero at no measured task cost — and the full stack matches it, adding approvals and staging without further violation reduction to find.
- A prompt-level instruction is close to useless here, moving violations only from 0.147 to 0.131.
- The risk-only control is the cautionary arm: it cuts violations to 0.041 and looks attractive, which is precisely why it is labelled unsafe — it is the configuration where a score could authorize.