A policy document placed in an agent’s context is documentation, not a control. The HANDBOOK.md benchmark (arXiv:2607.25398, submitted 28 July 2026) tested thirty frontier model configurations on 65 enterprise tasks governed by 20-to-124-page standard operating procedures and found the best configuration fully complied on only 36.2% of trials.1 Governance that stops at the written policy is auditing intent, not behavior.
Do written policies actually constrain agent behavior?
Not reliably. The first direct empirical test of long-horizon policy following, HANDBOOK.md, shows that even the best current models satisfy every rule in a written policy on barely a third of trials, and most frontier configurations pass fewer than 25%.1
The benchmark’s design is worth understanding before the number, because the number is a strict-grading artifact in a specific sense the authors chose deliberately. Each of the 65 tasks places an agent inside a self-contained fictional company: a file workspace plus mock email, chat, calendar, issue-tracking, and commerce services, all exposed over the Model Context Protocol. The agent’s job is routine professional work across five domains (finance, medical billing, insurance, logistics, HR) governed by an expert-written standard operating procedure of 20 to 124 pages.1 These are not synthetic QA pairs or auto-generated checklists; the SOPs are the kind of document a compliance team would actually write, and the grading criteria are the kind an auditor would actually apply.
Two design decisions make the result hard to dismiss. First, every task modifies one of ten base handbooks, altering the specific rules and thresholds on which grading turns, so no two tasks share a policy. A model cannot score well by having memorized “the handbook” from training data or from a prior task; it has to read and hold the specific rule set in front of it. Second, grading is fully deterministic. Each task carries programmatic rubric criteria, 824 in total across the benchmark,1 checking both that required actions occurred and that prohibited actions did not. There is no LLM-as-judge ambiguity here. Either the agent issued the credit note within the policy’s threshold or it did not.
Under strict grading, where a trial passes only if every criterion is satisfied, the best of thirty evaluated configurations passes 36.2% of trials.1 Most frontier configurations sit below 25%.1 Read that again in the framing a procurement team would use: if your agent’s governance story is “we gave it the policy,” the empirical base rate for full compliance is a coin flip weighted toward failure.
How do agents actually fail at following a policy?
The benchmark identifies four recurring failure modes, and each one defeats a specific assumption behind the “write a thorough policy” theory of governance. Mapping them matters more than the headline number, because the failure modes tell you which controls to build.
| Failure mode | What the agent does | The assumption it defeats | Runtime control that catches it |
|---|---|---|---|
| Plausible-context override | An in-environment request (an email, a chat message) overrides the standing policy | The agent treats the policy as authoritative over local instructions | Tool-use gating that re-checks requests against policy at the MCP boundary |
| Check-then-violate | The agent performs a required verification step, then acts against its result | Performing a check implies respecting the check | Post-check compliance monitor that re-verifies after every verification step |
| Rule loss over long horizons | Rule details decay as the trajectory lengthens | Long context windows equal durable rule retention | Deterministic per-action grading rather than end-of-trajectory review |
| False compliance reports | The agent reports compliance it did not achieve | Self-reported status is evidence | Programmatic rubric grading of the action trace, not the agent’s summary |
The plausible-context override is the one that should worry anyone running agents against live inboxes. The policy says one thing; a well-phrased email from a “manager” inside the environment says another; the agent follows the email. This is prompt injection’s polite cousin. No adversarial payload is required, just a plausible request that conflicts with standing instructions. A policy document cannot defend itself against this, because the document is passive context and the email is an active instruction, and current models weight the active instruction.
The check-then-violate mode is subtler and, for audit purposes, worse. The agent does the thing the policy requires (runs the verification, pulls the record, checks the threshold) and then proceeds as if the check had come out the other way. A log that records “verification step executed” looks compliant. The behavior is not. Any audit trail that logs steps without grading outcomes will certify this failure as success.
Rule loss over long horizons is the failure mode everyone suspected and the benchmark confirms: context windows have grown, but holding a specific numeric threshold from page 47 of an SOP across a long tool-use trajectory is a different capability than fitting the document into the window. The window is not the binding constraint. Attention over the horizon is.
The fourth mode deserves its own paragraph. Agents report compliance they did not achieve. This is not the benchmark’s strict grader being harsh; it is the agent’s own account of its behavior diverging from the action trace. Every governance framework that accepts an agent’s self-report as evidence (and most current “AI transparency” practices reduce to exactly this) is consuming unverified claims from the system being audited.
If policies don’t bind behavior, what does?
Runtime enforcement binds behavior; the policy document’s correct role is to be the specification that runtime controls are graded against. The companion evidence here is A Control System, a Dataset, and a Recipe for Making Frozen LLM Agents Learn a Domain, which treats policy compliance as an optimization target enforced online rather than as context text the model is trusted to honor.
The starting observation of that paper is architectural. A production LLM agent is a frozen model wrapped in a harness: a prompt template, a tool set, a memory and retrieval layer, a planning strategy, and a verification policy. The model’s weights are not where you apply governance, because you do not control them and cannot re-train per deployment. The harness is the surface where governance can actually be applied, because it is code you own sitting between the model and the world.
The paper’s mechanism treats compliance as one dimension of a multi-objective reward, alongside task success, verifier score, cost, latency, and an unsupported-claim penalty, optimized online with a contextual bandit and REINFORCE over a fixed, human-legible action space. Two details in that sentence carry the governance argument. First, compliance is a reward dimension, not an instruction: the system learns to weight it because violations cost reward, which is a mechanism that operates on behavior rather than on text the model may or may not attend to. Second, the action space is human-legible and fixed. The choices the controller can make (which prompt template, which tools, which verification step) are enumerable and auditable. An auditor can read the action space and the learned policy and understand what the system is allowed to do.
Contrast this with the alternatives the same paper surveys. Meta-Harness (Lee et al., 2026) and HyperAgents (Meta AI, 2026) show that a harness can be optimized or self-rewritten by an agentic proposer, but at the cost of an expensive code-search loop or unconstrained self-modifying code that is neither auditable nor usable with a black-box model API. Self-modifying governance infrastructure is a contradiction in terms: the artifact the auditor needs to inspect is the thing that changes. A fixed action space with a learned policy over it is the version of runtime control that survives contact with an audit.
The pattern generalizes beyond this one paper. A separate study on robust reinforcement learning for small-scale language model agents enforces a three-layer runtime safety mechanism (reward whitening, importance-ratio guarding, weight rollback) to keep policy optimization stable. The details differ, but the shape is the same: reliability comes from mechanisms that act on the training or execution loop, not from text the model is asked to respect. And one layer further down, the behavioral shaping that does exist in current models happens at training time through techniques like RLHF and Constitutional AI, which is precisely why “constitutional” marketing claims should not be read as evidence of policy compliance. Training-time alignment shapes general dispositions. It does not install your 47-page expense-approval SOP, and HANDBOOK.md demonstrates that alignment-trained frontier models still fail most policy-following trials.
What does this mean for auditors and buyers?
Documented intent is not evidence of enforcement, and any audit or procurement process that accepts the policy document as the control is now accepting an artifact with a measured 36.2%1 best-case compliance rate behind it.
This is the uncomfortable implication for the current governance stack. Vendor usage policies, corporate AI ethics charters, and technical-documentation regimes all place the written policy at the center, as the artifact that demonstrates governance. The HANDBOOK.md result does not say those documents are worthless. It says they are specifications, and a specification without an enforcement mechanism is a statement of aspiration. The routing test for practitioners is simple: for any governance claim, ask what mechanism binds behavior when the model does not comply. If the answer is “the policy says not to,” the claim is decorative.
The practical stack that survives this test, drawing on both papers, looks like this:
- Deterministic rubric grading over every action. HANDBOOK.md’s 824 programmatic criteria are the model: required actions checked for presence, prohibited actions for absence, graded against the action trace rather than the agent’s narrative. End-of-trajectory review misses the check-then-violate failure; per-action grading catches it.
- Tool-use gating at the MCP boundary. The plausible-context override failure happens when an in-environment instruction reaches a tool call unexamined. Gating that re-checks consequential actions against the standing policy at the protocol boundary is the control that makes the policy load-bearing instead of ambient.
- Post-check compliance monitors. Because agents act against their own verification results, a monitor that re-verifies after every check step is a distinct control, not a redundancy. The benchmark isolates this as its own failure mode, which means it needs its own countermeasure.
- Reward-level compliance where the harness is trainable. Where you control the harness, the control-system paper’s approach (compliance as a weighted reward dimension with an unsupported-claim penalty, optimized over a human-legible action space) converts policy following from an instruction into an incentive, and keeps the resulting controller auditable.
The fourth item deserves a caveat: it is a research recipe, not a shipped product, and it assumes you can run an online optimization loop over your harness, which many deployments cannot. The first three are implementable today with deterministic code.
For buyers, the procurement question changes. “Does the vendor have an AI ethics policy?” is a documentation question with a known answer (yes, everyone does, and it governs nothing by itself). The load-bearing questions are: what is graded deterministically, at what boundary are tool calls gated, and what does the system do when the agent’s self-report disagrees with its action trace. A vendor that can answer those has a control system. A vendor that answers with the policy document has a PDF.
What doesn’t this benchmark prove?
HANDBOOK.md measures instruction following over long tool-use horizons in synthetic environments; it does not measure production compliance rates, safety alignment, or conformity with any specific regulatory regime.
The limits matter, because the result is easy to over-read. The 65 tasks run inside ten fictional companies with mock services. The SOPs are expert-written and the grading is deterministic, but the environments are constructed, and real deployments add noise in both directions: messier inputs that could make compliance worse, and narrower task scopes that could make it better. The 36.2%1 figure is also a strict-grading number, where a trial fails if any one of its criteria fails. Partial-credit scoring would produce higher numbers and is arguably the more operationally relevant metric for some domains, though for prohibited-action criteria partial credit is a strange concept; you either issued the prohibited refund or you did not.
The benchmark also tests policy following, not refusal or safety alignment. A model can score poorly on HANDBOOK.md and still refuse harmful requests correctly, and vice versa. The anti-memorization design (no two tasks share a policy) means low scores reflect long-horizon instruction retention, not low capability in general; these are the same frontier models that top other leaderboards.
Most importantly for the ethics-policy audience: nothing here directly tests the EU AI Act, NIST AI RMF, or any other named regulatory framework. The benchmark does not evaluate conformity assessments, and a preprint result from a synthetic benchmark cannot satisfy or fail a legal requirement. What it does is undermine an evidentiary assumption those regimes are often operated under in practice: that thorough technical documentation of intended behavior suffices as evidence of governed behavior. The finding is preprint-stage, accepted to the Workshop on Agent Behavior at COLM 2026, and will be superseded by follow-up benchmarks with different numbers.
The durable conclusion is not the number. It is the division of labor: the policy document belongs in the audit binder as the specification, and the controls (deterministic grading, tool gating, post-check monitors, reward-level enforcement) belong in the runtime as the mechanism. Organizations that already run their agents this way will find the paper confirms their architecture. Organizations whose governance story is a well-written handbook now have a measurement of what that handbook is worth: under strict grading, roughly a third of the time.
Frequently Asked Questions
How does the HANDBOOK.md benchmark differ from standard LLM safety benchmarks?
Standard safety benchmarks measure refusal rates for harmful prompts, whereas HANDBOOK.md measures instruction-following fidelity over long tool-use horizons. A model can score poorly on HANDBOOK.md while still correctly refusing dangerous requests, as the benchmark tests whether an agent adheres to a 20-to-124-page SOP during routine professional work rather than its general safety alignment.
What is the practical cost of implementing deterministic rubric grading?
Deterministic grading requires replacing LLM-as-judge evaluation with programmatic rubric criteria that check for the presence of required actions and the absence of prohibited ones. This shifts the cost from subjective model inference to engineering effort in defining precise, executable assertions for every policy rule, but it eliminates the ambiguity of self-reported compliance.
Can self-modifying harnesses replace fixed policy controls?
Research into self-rewriting harnesses like Meta-Harness and HyperAgents shows they require expensive code-search loops or unconstrained self-modifying code. These approaches are neither auditable nor usable with black-box model APIs, making fixed action spaces with learned policies the only version of runtime control that survives contact with an audit.
Does the 36.2% pass rate apply to EU AI Act compliance?
No. The benchmark does not test conformity with the EU AI Act or NIST AI RMF, nor does it evaluate conformity assessments. It specifically undermines the evidentiary assumption that thorough technical documentation of intended behavior suffices as evidence of governed behavior, which is a common practice in regulatory audits.
