PolicyGraph — Contextual Policy Enforcement for Agent Disclosure
Published:
Status: Pilot complete · go/no-go recorded · part of the agent-authorization and tool-security line of work.
The question
An agent acting on personal data has to satisfy two constraints at once: never release a prohibited field, and never act on an authorization that has since gone stale. Defenses usually address one and quietly fail the other. PolicyGraph compares five defenses across attack and clean arms on 200 scenarios, with an 80-scenario group-disjoint test split, a clean split-leakage check and a recorded dataset hash.
Results so far
Under attack:
| Defense | Clean success | Prohibited-field leak | Stale-authorization release |
|---|---|---|---|
| none | 0.013 | 1.000 | — |
| prompt | 0.250 | 1.000 | 1.000 |
| isolation | 0.750 | — | 1.000 |
| output_filter | 0.588 | 0.000 | 1.000 |
| policygraph | 0.863 | 0.000 | 0.000 |
- Only PolicyGraph closes both failure modes, and it does so while posting the highest clean-task success of any arm under attack — utility and safety moving together rather than trading off.
- The output filter is the instructive near-miss. It stops the prohibited field completely and still releases on stale authorization every single time, because a filter inspects content and cannot see that permission has expired.
- A prompt-level instruction fails on both axes, leaking on every attack while costing task success.