What's this about?
LLM agents interact with the world through tool calls, which brings file modification, information leakage and unauthorized actions into scope. Existing guardrails mostly evaluate completed trajectories. StepGuard learns step-level guardrails with scalable supervision, and explicitly balances safety against utility. 14 upvotes.
Why is pre-execution monitoring different?
Because after the fact is after the fact. A trajectory-level guardrail can tell you the agent leaked a credential; it cannot stop it. Step-level checking means intercepting at the point of action — which is harder, because you have less information (you see the intent, not the outcome) and a much tighter latency budget. The safety-utility balance is the whole problem: a guard that blocks anything ambiguous makes the agent useless, and one that doesn't isn't a guard.
Why does this matter to you?
- It is the same architecture Anthropic describes deploying this week — a classifier that blocks before the tool call.
- "Scalable supervision" is the operative constraint: you cannot have a human on every step, so the guard has to be automatic and cheap.
- Directly applicable to any pipeline where an agent takes consequential actions on your infrastructure.