{"id":"https://openalex.org/W7203715746","doi":"https://doi.org/10.48550/arxiv.2608.14590","title":"Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement","display_name":"Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement","publication_year":2026,"publication_date":"2026-06-22","ids":{"openalex":"https://openalex.org/W7203715746","doi":"https://doi.org/10.48550/arxiv.2608.14590"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.14590","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.14590","pdf_url":"https://arxiv.org/pdf/2608.14590","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.14590","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5008778243","display_name":"Pierre V. Dantas","orcid":"https://orcid.org/0000-0001-6390-9340","observed_orcids":["https://orcid.org/0000-0001-6390-9340"]},"institutions":[{"id":"https://openalex.org/I28407311","display_name":"University of Manchester","ror":"https://ror.org/027m9bs27","country_code":"GB","type":"education","lineage":["https://openalex.org/I28407311"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Dantas, Pierre","raw_affiliation_strings":["The University of Manchester Manchester , UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Manchester Manchester , UK","institution_ids":["https://openalex.org/I28407311"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057689302","display_name":"Lucas Carvalho Cordeiro","orcid":"https://orcid.org/0000-0002-6235-4272","observed_orcids":["https://orcid.org/0000-0002-6235-4272"]},"institutions":[{"id":"https://openalex.org/I28407311","display_name":"University of Manchester","ror":"https://ror.org/027m9bs27","country_code":"GB","type":"education","lineage":["https://openalex.org/I28407311"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Cordeiro, Lucas","raw_affiliation_strings":["The University of Manchester Manchester , UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Manchester Manchester , UK","institution_ids":["https://openalex.org/I28407311"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014302355","display_name":"Ehsan Nowroozi","orcid":"https://orcid.org/0000-0002-5714-8378","observed_orcids":["https://orcid.org/0000-0002-5714-8378"]},"institutions":[{"id":"https://openalex.org/I55060895","display_name":"University of Greenwich","ror":"https://ror.org/00bmj0a71","country_code":"GB","type":"education","lineage":["https://openalex.org/I55060895"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Nowroozi, Ehsan","raw_affiliation_strings":["The University of Greenwich London , UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Greenwich London , UK","institution_ids":["https://openalex.org/I55060895"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5073042391","display_name":"Norbert Tihanyi","orcid":"https://orcid.org/0000-0002-9002-5935","observed_orcids":["https://orcid.org/0000-0002-9002-5935"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tihanyi, Norbert","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10906","display_name":"AI-based Problem Solving and Planning","score":0.3540000021457672,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10906","display_name":"AI-based Problem Solving and Planning","score":0.3540000021457672,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.26809999346733093,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10142","display_name":"Formal Methods in Verification","score":0.18619999289512634,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.9039999842643738},{"id":"https://openalex.org/keywords/ai-safety","display_name":"AI safety","score":0.6710000038146973},{"id":"https://openalex.org/keywords/formal-specification","display_name":"formal specification","score":0.843999981880188},{"id":"https://openalex.org/keywords/verification","display_name":"verification","score":0.6309999823570251},{"id":"https://openalex.org/keywords/safety-enforcement","display_name":"safety enforcement","score":0.7699999809265137},{"id":"https://openalex.org/keywords/runtime-monitoring","display_name":"runtime monitoring","score":0.875},{"id":"https://openalex.org/keywords/safety-guarantees","display_name":"safety guarantees","score":0.5770000219345093},{"id":"https://openalex.org/keywords/open-problems","display_name":"open problems","score":0.5740000009536743}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6330000162124634},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.6269999742507935},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6194000244140625},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5719000101089478},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5515999794006348},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5509999990463257},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5249000191688538},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.5081999897956848},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.4555000066757202},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.429500013589859},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.3111000061035156},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.30979999899864197},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.28630000352859497},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2856999933719635},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.2815000116825104},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.2784000039100647},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.2635999917984009},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.2551000118255615}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.14590","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.14590","pdf_url":"https://arxiv.org/pdf/2608.14590","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.14590","doi":"https://doi.org/10.48550/arxiv.2608.14590","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.14590","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.14590","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.14590","pdf_url":"https://arxiv.org/pdf/2608.14590","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[{"display_name":"Systematic Review","id":"https://openalex.org/study-designs/systematic-review"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7203715746.pdf","grobid_xml":"https://content.openalex.org/works/W7203715746.grobid-xml"},"referenced_works_count":24,"referenced_works":["https://openalex.org/W1547304883","https://openalex.org/W1553101044","https://openalex.org/W1590315663","https://openalex.org/W1862398452","https://openalex.org/W2005998857","https://openalex.org/W2023035194","https://openalex.org/W2023808162","https://openalex.org/W2025262772","https://openalex.org/W2040105559","https://openalex.org/W2098039922","https://openalex.org/W2127574686","https://openalex.org/W2149236697","https://openalex.org/W2150990363","https://openalex.org/W2165010366","https://openalex.org/W2337392266","https://openalex.org/W2344374141","https://openalex.org/W2594877703","https://openalex.org/W2912640545","https://openalex.org/W2996464769","https://openalex.org/W3118615836","https://openalex.org/W4382463985","https://openalex.org/W4384521943","https://openalex.org/W4409779994","https://openalex.org/W7154396390"],"related_works":["https://openalex.org/W6979337045","https://openalex.org/W7221041534","https://openalex.org/W4414973799","https://openalex.org/W7161690279","https://openalex.org/W7128692181","https://openalex.org/W7214303292","https://openalex.org/W7214700668","https://openalex.org/W7162080190","https://openalex.org/W7164034352","https://openalex.org/W4415132457"],"abstract_inverted_index":{"Large":[0],"Language":[1,99],"Model":[2],"(LLM)":[3],"agents":[4,163],"take":[5],"irreversible":[6],"real-world":[7],"actions,":[8],"yet":[9],"no":[10,172],"system":[11],"gives":[12,192],"formally":[13],"grounded,":[14],"task-level":[15],"safety":[16,239],"guarantees":[17,125],"for":[18,34],"their":[19,235],"plans.":[20],"In":[21],"a":[22,67,249],"PRISMA":[23],"2020":[24],"systematic":[25],"review,":[26],"we":[27,224],"searched":[28],"six":[29],"databases":[30],"(20-29":[31],"May":[32],"2026)":[33],"work":[35],"on":[36,84,211],"LLM":[37,90],"agent":[38],"specification,":[39],"verification,":[40],"and":[41,57,157,181,237,252],"enforcement":[42,111],"published":[43],"in":[44,119,134,159,216],"2022-2026.":[45],"We":[46,247],"narratively":[47],"synthesized":[48],"38":[49],"studies,":[50],"assessed":[51],"risk":[52],"of":[53,89,138,144,152,186,220,255],"bias":[54],"per":[55],"study,":[56,122],"graded":[58],"evidence":[59],"certainty":[60,195],"with":[61],"GRADE.":[62],"Three":[63],"authors":[64],"independently":[65],"screened":[66],"repeated":[68],"search":[69],"to":[70,204],"validate":[71],"the":[72,82,108,187,193,221],"single-reviewer":[73],"screening":[74],"(agreement:":[75],"Fleiss'":[76],"$\u03ba=":[77],"0.81$).":[78],"First,":[79],"specification":[80],"is":[81,107],"bottleneck:":[83],"one":[85,120,135,212],"benchmark,":[86],"only":[87,127],"24.8-34.2%":[88],"translations":[91],"from":[92],"natural":[93],"language":[94],"into":[95,230],"Planning":[96],"Domain":[97],"Definition":[98],"(PDDL)":[100],"are":[101,202,227],"semantically":[102],"correct.":[103],"Second,":[104],"runtime":[105],"monitoring":[106],"most":[109,160],"mature":[110],"strategy;":[112],"it":[113],"reduced":[114],"unsafe":[115,145,166],"actions":[116,146],"by":[117],"65.37%":[118],"household-agent":[121],"but":[123],"its":[124],"cover":[126],"single":[128,245],"steps":[129],"or":[130,213],"short":[131],"horizons.":[132],"Third,":[133],"$\u03c4$-Bench":[136],"study":[137],"transactional":[139],"tool-use":[140],"agents,":[141],"blocking":[142],"94%":[143],"still":[147],"left":[148],"fewer":[149],"than":[150,244],"5%":[151],"tasks":[153],"completed":[154],"both":[155],"safely":[156],"correctly":[158],"settings,":[161],"because":[162],"found":[164],"other":[165],"routes":[167],"(the":[168],"verifier":[169],"tax).":[170],"Fourth,":[171],"approach":[173],"simultaneously":[174],"achieves":[175],"soundness,":[176],"completeness,":[177],"scalability,":[178],"semantic":[179],"grounding,":[180],"utility":[182],"preservation.":[183],"For":[184],"seven":[185],"nine":[188],"principal":[189],"claims,":[190],"GRADE":[191],"lowest":[194],"rating":[196],"(Very":[197],"Low),":[198],"meaning":[199,236],"further":[200],"studies":[201,215],"likely":[203],"produce":[205],"substantially":[206],"different":[207],"figures;":[208],"each":[209],"rests":[210],"two":[214],"narrow":[217],"domains.":[218],"Two":[219],"open":[222,257],"problems":[223],"rank":[225],"highest":[226],"translating":[228],"requirements":[229],"formal":[231],"specifications":[232],"that":[233],"keep":[234],"enforcing":[238],"over":[240],"whole":[241],"plans":[242],"rather":[243],"actions.":[246],"contribute":[248],"three-level":[250],"taxonomy":[251],"an":[253],"agenda":[254],"ten":[256],"problems.":[258]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-08-19T00:00:00"}