VEPA addresses safety risks when LLM agents manipulate private documents or mutable system states. Runtime guardrails must provide inspectable, reproducible, deterministic allow‑or‑refuse decisions before irreversible actions occur. Because safety requirements are rarely complete prior to deployment, guardrails need to evolve as new risks emerge. Existing adaptive guardrails rely on LLM inference to apply safety policies, which can cause inconsistent decisions and ambiguous policy interpretation. Formal guardrails enforce policies deterministically but typically depend on pre‑deployment or task‑specific rules and lack mechanisms to adapt to newly observed hazards. VEPA models the guardrail as a set of executable symbolic rules over typed agent events. During deployment, an LLM guided by deployment feedback proposes policy patches that fix newly observed failures while preserving previously correct behavior. A deterministic verifier then accepts only structurally valid, conflict‑free policies. An evidence‑aware authority layer activates a rule only when sufficient supporting evidence is available, preventing uncertain updates from directly influencing decisions. Across ASSEBench‑Safety, ASSEBench‑Security, and ATBench benchmarks, VEPA consistently outperforms baselines and expands the scope of deterministic formal‑policy enforcement. The gains persist under more challenging conditions such as mixed streams, corrupted feedback, and longer horizons.
Review