GAAR: Runtime Governance for Scalable Agentic Retrieval and Tool- Orchestrated Enterprise AI Systems
This paper introduces GAAR, a runtime governance architecture positioned between planner agents and tool execution that significantly reduces policy violations and unsafe tool calls while improving faithfulness and audit compliance in enterprise AI systems, albeit with a modest increase in latency, as demonstrated through extensive synthetic benchmarking.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a world where computers don't just chat with you but actually do things. They can look up your bank records, book a flight, or fix a server crash. This is the exciting frontier of "Agentic AI." Think of these agents as super-smart digital interns. They are built on a foundation called Retrieval-Augmented Generation (RAG). If a normal AI is like a student trying to answer a test from memory, RAG is that same student allowed to open a textbook. It looks up facts before answering, which makes it much more accurate.
But here is the catch: when you give a digital intern the keys to the office, the building, and the bank account, you need a very strict manager. You can't just let the intern guess if they are allowed to open the safe. They need to check their ID, verify the time, confirm the boss said "yes," and make sure they didn't just read a fake instruction. This is the problem of Runtime Governance. It's the set of rules and checks that happen while the AI is working, ensuring it doesn't accidentally break the law, leak secrets, or do something dangerous. Without this, a helpful AI could become a chaotic one.
The Problem: The "Wild West" of Digital Interns
Enter GAAR (Governance-Aware Agentic Retrieval), a new system designed to be that strict, super-organized manager for AI agents. The researchers behind this paper noticed that while AI agents are getting better at planning multi-step tasks, they are often too trusting. An agent might find a document that looks useful, but what if it's outdated? What if the user asking the question isn't actually allowed to see it? What if the agent tries to use a tool (like sending an email) that it doesn't have permission to touch?
In the past, we've tried to fix this by putting up "guardrails" after the AI speaks (like a filter that blocks bad words) or by using simple, static rules. But the author argues these methods are like trying to stop a speeding car by putting a speed bump at the finish line. By then, the damage is done. They also argue that just letting the AI "self-correct" isn't enough because the AI might not realize it's breaking a complex company rule.
The Solution: The "Decision Passport"
The paper introduces GAAR as a middleware layer—a digital checkpoint that sits between the AI's "brain" (the planner) and its "hands" (the tools it uses).
Imagine the AI agent wants to perform a task, like "Send a report to the CEO." Instead of just doing it, the AI has to hand over a Decision Passport to the GAAR manager. This passport isn't just a request; it's a structured document that includes:
- The Evidence: "Here are the documents I found to back up this report."
- The Authority: "Here is proof that the person asking is allowed to see this."
- The Risk Check: "I've checked if this is a sensitive topic."
- The Audit Trail: "Here is a record of everything I'm about to do."
The GAAR manager then runs a rapid-fire inspection. It checks the passport against a rulebook (policies). If the evidence is stale (too old), the passport gets stamped "Revise." If the user doesn't have the right ID, it gets stamped "Block." If the risk is too high, it gets sent to a human for a "Human Review" stamp. Only when the passport is fully stamped and approved does the AI get to execute the action.
What the Numbers Say (The Simulation)
The researchers didn't just build this; they tested it in a massive, controlled simulation. They created a fake enterprise environment with 12,000 different scenarios (like a user asking for a refund, an IT worker trying to restart a server, or a manager checking a budget). They pitted GAAR against other methods, including standard AI, AI with tools, and AI with simple rule filters.
Here is what happened in these simulations:
- Safety First: GAAR reduced "policy violations" (breaking the rules) from 12.9% down to 5.0%. It also cut "unsafe tool calls" (using tools it shouldn't) from 8.6% down to 3.6%.
- Trustworthy Answers: The AI's answers became more "faithful" (sticking to the facts it found) rising from 0.79 to 0.86.
- The Paper Trail: Most impressively, GAAR improved "audit compliance" (making sure a record was kept of every decision) from 63.4% to 96.2%.
- The Cost: There was a small price to pay for this safety. The average time it took to get an answer went up from 2.7 seconds to 3.2 seconds. The author suggests this is a fair trade: waiting half a second longer is worth it to avoid a major security breach.
They also stress-tested the system with up to 100,000 episodes to see if it would crash under pressure. It slowed down slightly but kept working, proving it can scale.
The "What If" Scenarios and Limits
The paper also played "what if" with the system. They tried to trick it with fake attacks, like pretending to be a different user (role spoofing) or feeding it old rules (stale-policy substitution). GAAR caught most of these tricks, with detection rates around 94% to 97%. However, the author is very careful to note that these were simulated attacks, not real hackers trying to break in. They admit their test didn't cover every possible way a bad actor could try to fool the system, so it's not a "solved" security problem yet.
They also ran a "blame game" experiment (ablation study) to see which part of GAAR was the most important. They found that:
- Checking the evidence was the key to making answers accurate.
- Checking authority (who you are) was the key to stopping unsafe actions.
- The audit trail was essential for keeping a record of what happened.
The Bottom Line
This paper proposes that if we want AI agents to work in real companies, we can't just let them run wild. We need a system like GAAR that acts as a gatekeeper, checking every single step before the AI takes action. The results from their simulations suggest that this approach works: it makes AI safer, more honest, and easier to track, with only a tiny delay in speed.
However, the author is clear: this is a simulation. They haven't tested this in a live, real-world company yet. They suggest that future work needs to see how this holds up when real humans are involved and when the rules change on the fly. But for now, GAAR offers a promising blueprint for taming the wild digital interns of the future.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.