{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.08082", "title": "POLAR: Ontology-Guided Risk Prevention for Tool-Calling LLM Agents", "summary": "POLAR replaces reactive post-error safety mechanisms and unstructured natural-language guardrails with a pre-execution structural check that scores action reversibility via a two-layer ontology and prunes calls below a threshold. It costs additional inference calls to derive candidate inverse action sequences and their scoring, adding latency and API expense per candidate action, plus the engineering burden of maintaining the domain ontology. It can fail by pruning valid actions in domains with poor ontology coverage, and the paper's own results show regressions on retail tasks and stronger agent models, so adoption can reduce task success rather than protect it.", "rationale": "The method is implementable on constrained infrastructure but shows net task regressions in most model-domain cells and does not measure prevented harm, so production adoption is not yet justified without stronger evidence.", "technique": "Ontology-guided pre-execution action reversibility check", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-06", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.08082", "independent_implementations": 1, "total_implementations": 2, "stars": 131, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "POLAR replaces reactive post-error safety mechanisms and unstructured natural-language guardrails with a pre-execution structural check that scores action reversibility via a two-layer ontology and prunes calls below a threshold. It costs additional inference calls to derive candidate inverse action sequences and their scoring, adding latency and API expense per candidate action, plus the engineering burden of maintaining the domain ontology. It can fail by pruning valid actions in domains with poor ontology coverage, and the paper's own results show regressions on retail tasks and stronger agent models, so adoption can reduce task success rather than protect it.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.08082", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Improves mean task reward by 0.11 to 0.18 points on the airline domain of tau^2-bench for four of six agents, but only eight of eighteen model-domain cells improve overall, with regressions on retail and stronger agents.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.08082", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }