Sapien: A Stateful Policy Engine for Autonomous AI Agents

arXiv:2610.00797 · cs.AI, cs.CL, cs.CR · Submitted 2026-09-30 · Read on arXiv

cs.AI, cs.CL, cs.CR

Submitted: 2026-09-30

Updated: 2026-09-30

Code: https://github.com/NousResearch/hermes-agent

Project page: https://openai.github.io/openai-agents-python/guardrails

Terminology

• AI Agents — 15× in this paper · explained in 2 episodes
• Benchmark — 13× in this paper · explained in 2 episodes
• Trace — 7× in this paper · explained in 2 episodes
• Agent Harness — 3× in this paper · explained in 2 episodes
• Agentic System — 3× in this paper · explained in 2 episodes
• Verification — 3× in this paper · explained in 2 episodes
• Benchmarking — 2× in this paper · explained in 3 episodes
• Core — 2× in this paper · explained in 2 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Adversarial Search — 1× in this paper · explained in 1 episode
• Agentic Workflows — 1× in this paper · explained in 1 episode
• Alignment — 1× in this paper · explained in 1 episode
• Deferral — 1× in this paper · explained in 2 episodes
• Fine-Tuning — 1× in this paper · explained in 5 episodes
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Network and Distributed System Security Symposium — 1× in this paper
• Perplexity — 1× in this paper · explained in 3 episodes
• Steering — 1× in this paper · explained in 2 episodes
• Structural Constraints — 1× in this paper · explained in 2 episodes

Sources

• Detecting Language Model Attacks with Perplexity
• LlamaFirewall: An open source guardrail system for building secure AI agents
• Securing AI Agents with Information-Flow Control
• Defeating Prompt Injections by Design
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• Baseline Defenses for Adversarial Attacks Against Aligned Language Models
• Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents
• ACE: A Security Architecture for LLM-Integrated App Systems
• The Tool Decathlon: Benchmarking Language Agents for Diverse, Realistic, and Long-Horizon Task Execution
• ceLLMate: Sandboxing Browser AI Agents
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Formal Policy Enforcement for Real-World Agentic Systems
• Measuring Agents in Production
• Progent: Securing AI Agents with Privilege Control
• PromptArmor: Simple yet Effective Prompt Injection Defenses
• Permissive Information-Flow Analysis for Large Language Models
• SAGA: A Security Architecture for Governing AI Agentic Systems

Related papers

• MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
• Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
• The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
• MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
• Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems
• VSAL: A Vision Solver with Adaptive Layouts for Graph Property Detection