SCOPE compiles agent policies into programs of small models

A paper titled "SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs" tackles how to enforce policies on LLM agents. The authors start from a shift in the problem: enforcement used to mean single-turn content moderation, but it now involves compound, application-specific policies judged over multi-turn transcripts and tool-call trajectories.

They describe the two usual options and their weaknesses. Fine-tuned guardrail models are efficient but degrade on compound policies. LLM-as-a-judge approaches reach higher accuracy, but they cost a lot at inference and tend to produce unstable predictions. Neurosymbolic methods, which split a policy into narrow neural decisions combined under explicit logic, look like a natural alternative. The authors argue that the existing ones fall short because their symbolic layers lack the required expressiveness and are optimized against fixed data rather than against the policy itself.

SCOPE is their answer. It compiles a policy into an executable program made of neural predicates. Those predicates are run by small models and deterministic extractors, and ordinary code composes their outputs into a verdict. The program is optimized jointly with its training data: the system adversarially generates counterexamples that target the places where the program deviates from the policy, and uses them to improve both.

The authors evaluate SCOPE on a benchmark of real-world policy tasks, comparing it with prompt optimization, task decomposition and workflow generation methods. They report that SCOPE achieves the highest average accuracy across tasks and models. Programs optimized with the weakest executor transfer to other models without further optimization, which the authors say allows production deployment on inexpensive models, where the programs reach accuracy comparable to frontier reasoning models.

The authors also say that, unlike monolithic models, SCOPE produces substantially more stable predictions, and that each verdict can be interpreted through the predicate outputs that produced it. They validate the key components of the method with an ablation study. Their conclusion is that SCOPE enables reliable, interpretable and efficient policy enforcement at production scale. The abstract gives no numeric results, so how large the gains are cannot be read from it.

Key facts

SCOPE compiles a natural-language policy into an executable program of neural predicates, run by small models and deterministic extractors, with code composing their outputs.
The program is optimized jointly with its training data, using adversarially generated counterexamples that target where the program deviates from the policy.
On a benchmark of real-world policy tasks, SCOPE reports the highest average accuracy against prompt optimization, task decomposition and workflow generation baselines.
Programs optimized with the weakest executor transfer to other models without further optimization and, on inexpensive models, reach accuracy the authors call comparable to frontier reasoning models.
The authors say SCOPE gives substantially more stable predictions than monolithic models, and each verdict is interpretable through the predicate outputs behind it.

Why it matters

Agent guardrails now have to judge compound, application-specific policies across multi-turn transcripts and tool-call trajectories, not just single messages. The authors say both main options fall short: fine-tuned guardrail models degrade on such policies, and LLM judges are accurate but expensive and unstable. SCOPE proposes a third route, where the policy becomes a program with explicit logic and small models handle only narrow decisions. Because the verdict follows from predicate outputs, it can be inspected.

Who it affects

Teams that must enforce custom policies on LLM agents, and so choose between fine-tuned guardrail models and LLM-as-a-judge setups, are the target audience. The claim about deployment on inexpensive models is aimed at anyone for whom inference cost or unstable verdicts are a problem. Researchers working on neurosymbolic methods and prompt or workflow optimization are the other group, since those are the baselines SCOPE is compared with.

How to use it

The abstract describes the workflow: write the policy in natural language, compile it into a predicate program, optimize the program with adversarially generated counterexamples, then run it on a small model. The authors report that a program optimized with the weakest executor can be moved to other models without re-optimizing. The source does not mention a code release, license or availability.

How solid is it

This is a paper abstract, and all claims are the authors' own. The abstract does not quantify its results: 'highest average accuracy', 'comparable' and 'substantially more stable' come without figures. The benchmark is not named and the number of tasks is not stated. The baseline methods are not named individually, and neither are the models used as the weakest executor, as other executors or as the frontier reasoning models. An ablation study is mentioned as validating the key components. Independent verification is not part of the source.

Risks and caveats

Without numbers, it is not possible to judge how big the accuracy edge is, or how close 'comparable to frontier reasoning models' really is. No limitations of SCOPE are stated beyond the mention of the ablation study. The claim of production-scale readiness is the authors' conclusion, not something the abstract demonstrates with deployment data. Treat the transfer and stability claims as hypotheses to test on your own policies.

“SCOPE thus enables reliable, interpretable, and efficient policy enforcement at production scale.”

— From the paper's abstract