Building a Foundational Guardrail for General Agentic Systems via
  Synthetic Data
Authors: name: Yue Huang; name: Hang Hua; name: Yujun Zhou; name: Pengcheng Jing; name: Manish Nagireddy; name: Inkit Padhi; name: Greta Dolcetti; name: Zhangchen Xu; name: Subhajit Chaudhury; name: Ambrish Rawat; name: Liubov Nedoshivina; name: Pin-Yu Chen; name: Prasanna Sattigeri; name: Xiangliang Zhang
Published: 2025-10-10 18:42:32

Abstract: While LLM agents can plan multi-step tasks, intervening at the planning
stage-before any action is executed-is often the safest way to prevent harm,
since certain risks can lead to severe consequences once carried out. However,
existing guardrails mostly operate post-execution, which is difficult to scale
and leaves little room for controllable supervision at the plan level. To
address this challenge, we highlight three critical gaps in current research:
data gap, model gap, and evaluation gap. To close the data gap, we introduce
AuraGen, a controllable engine that (i) synthesizes benign trajectories, (ii)
injects category-labeled risks with calibrated difficulty, and (iii) filters
outputs via an automated reward model, producing large and reliable corpora for
pre-execution safety. To close the guardian model gap, we propose a
foundational guardrail Safiron, combining a cross-planner adapter with a
compact guardian model. The adapter unifies different input formats, while
Safiron flags risky cases, assigns risk types, and generates rationales;
trained in two stages with a broadly explored data recipe, Safiron achieves
robust transfer across settings. To close the evaluation gap, we release
Pre-Exec Bench, a realistic benchmark covering diverse tools and branching
trajectories, which measures detection, fine-grained categorization,
explanation, and cross-planner generalization in human-verified scenarios.
Extensive experiments demonstrate consistent gains of the proposed guardrail
over strong baselines on Pre-Exec Bench, and ablations further distill
actionable practices, providing a practical template for safer agentic systems.