AgentSpec is a domain-specific language for the runtime enforcement of constraints on LLM agents, proposed by Wang, Poskitt and Sun in AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents. A program is a set of rules, each opening with the keyword rule and an identifier and closing with end; in between, trigger names the event that activates the rule, check lists predicates that must all evaluate to true for the rule to take effect, and enforce lists the interventions to apply. A rule is violated when its trigger occurs and every predicate holds, and each violated rule’s enforcements then transform the agent’s trajectory before execution continues. The paper’s motivating example is a rule triggered before a money-transfer action that checks whether the recipient is not a family member and, if so, enforces user inspection — pausing the agent until the user approves or rejects the transfer.
Usage
Triggers are events the enforcement layer monitors during execution. Three are general — a state change, the moment before an action executes, and the agent finishing its task — and a domain can add its own: tool invocations such as a Python REPL call for a code agent, object manipulations such as pick or pour for a robotic agent, and environmental events such as pedestrian_detected or rain_started for an automated driving system. Predicates are Boolean functions over the user input and the trajectory so far, such as is_destructive_cmd for code or is_fragile_object for robotics; they can be written by a developer or generated by an LLM acting as a Python programmer given the agent’s domain, tools and safety requirement.
Four enforcements are predefined:
user_inspection— the agent pauses and asks the user to approve or reject the action.llm_self_examine— an LLM-based self-examination mechanism (the paper cites Reflexion for it) evaluates the context and produces a corrective response.invoke_action— executes a specified action with key-value parameters, such as adjusting a vehicle’s following distance.stop— terminates the trajectory.
The reference implementation integrates with LangChain by intercepting the agent’s iteration step, and its authors describe the same principle as applicable to other frameworks such as AutoGen.
When It Applies
AgentSpec assumes that the risk to be controlled can be expressed as an observable event plus checkable conditions at a discrete execution point — typically just before a high-impact or irreversible action — and that someone can write, or review LLM-generated, predicate implementations for the domain. Its authors position this external, developer-defined enforcement against approaches that rely on an LLM to interpret safety constraints, arguing that separating enforcement from the agent’s reasoning makes behaviour consistent across runs and model versions and makes the rules auditable.
Its stated limitation is that enforcement is deterministic and local: it does not reason about whether a sequence of currently permitted actions will lead to an unsafe state several steps later, which the authors leave to future probabilistic extensions. It can also be misapplied through its rules: in the paper’s experiments, LLM-generated rules overfit to their in-context examples (flagging only explicitly listed sensitive files), missed complex object properties, and became over-rigid when requirements were vague, in one case banning pouring outright. Evidence for the approach comes from a single paper’s evaluation on three agents and three datasets, with rules for the main experiments written by the authors.
Related Terms
- Guardrails — the broader family of controls AgentSpec belongs to, in its deterministic, pre-execution sense
- Agent Hooks — another way of intercepting an agent’s actions before they execute
- Human-in-the-loop — what the
user_inspectionenforcement implements