IBM-attributed JevAct paper gates agent tool calls against policy before they run

A new arXiv paper introduces JevAct, a runtime gate that checks selected agent tool calls against compiled policy checks and returns feedback for revision.

A paper posted to arXiv on October 28, "Think Before You Act: Decision Gate for LLM Agents", describes JevAct, a layer that intercepts selected agent actions before they execute. It checks them for policy compliance and premature task termination, then sends targeted feedback to the agent so it can revise. If you run agents that touch real systems, this is the verification step between "the model proposed a call" and "the call ran."

Per the abstract, JevAct compiles domain policies into executable state checks plus structured questions. A "prefill-only decision model" answers those questions with probability-based judgments rather than generated text. Deterministic checks cover tool-state facts, and the decision model covers conversational context. The authors say it works independently of the agent model and needs no changes to the model's parameters or tools.

The paper evaluates eleven agents on τ²-bench Airline and Telecom and on BFCL. It reports "particularly consistent gains" on Telecom and BFCL, while Airline results are "more mixed." The abstract gives no reason for the Airline gap. In a post on X, @omarsar0 attributes the paper to IBM. The post says that on Telecom, all eight agents improved by 16.9 points on average in three-run success, and Opus 4.6 rose from 39.5% to 80.7%. We could not confirm those figures against the paper.

Still unclear: whether the code or decision model is released, and how much latency and cost each checked call adds. Until then, treat this as a pattern to copy rather than a drop-in tool. Existing options cover parts of it. NeMo Guardrails has action rails, and LangGraph's interrupt_before provides human approval checkpoints, per Itsourcecode. AlexDLY argues that text-level rails catch structured tool calls poorly, so you may end up writing your own allowlists anyway.

Sources