The Tripartite Safety Framework

As LLM agents transition from chat interfaces to autonomous systems capable of executing actions, traditional prompt-based safety measures are insufficient. This survey proposes a structured approach to agent safety based on three pillars: specification, verification, and enforcement.

Defining and Verifying Agent Behavior

Safety begins with specification, which involves defining the boundaries of an agent's permissible actions. This requires moving beyond natural language instructions to formalize constraints. Once specified, verification methods—such as static analysis of agent code or formal logic checking—are used to ensure that the agent's decision-making process adheres to these specifications before deployment. The goal is to mathematically or logically guarantee that an agent will not deviate from its intended operational parameters.

Runtime Enforcement and Guardrails

Because LLMs are inherently probabilistic, static verification is rarely enough. Enforcement mechanisms act as a final layer of defense during execution. These include:

• Sandboxing: Isolating the agent’s environment to prevent unauthorized system access.
• Policy-based Guardrails: Implementing middleware that intercepts agent outputs and tool calls to validate them against safety policies in real-time.
• Human-in-the-loop (HITL): Requiring explicit approval for high-stakes actions, effectively turning the agent into a co-pilot rather than a fully autonomous actor.

Moving Toward Production-Ready Agents

The survey highlights that the primary challenge in agent safety is the tension between agent autonomy and system reliability. Developers must shift from relying on model alignment (training the model to be 'good') to architectural alignment (building systems that are 'safe by design'). This involves treating agents as software components that require the same rigorous testing, monitoring, and constraint-based design as any other critical infrastructure.