Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement
06:00 · August 18, 2026 · arXiv cs.AI RSS
LLM agents increasingly perform irreversible real-world actions, including database updates, API calls, file operations, and autonomous use of tools. However, no existing system provides formally grounded, task-level safety guarantees for the plans these agents generate. Research remains fragmented across specification, verification, and enforcement, limiting understanding of the strengths and limitations of existing approaches. To address this gap, we conducted a PRISMA 2020 systematic review of 38 studies published between 2022 and 2026 and retrieved from six academic databases. Our analysis reveals four key findings. First, the specification bottleneck remains the primary challenge: natural-language-to-formal translation achieves only 24% to 35% semantic correctness, undermining downstream verification. Second, runtime monitoring is the most mature enforcement strategy, reducing unsafe actions by 40% to 65% in controlled settings, but it does not provide complete safety guarantees. Third, the verifier tax shows that blocking 94% of unsafe actions can still result in less than 5% safe task completion because agents exploit alternative unsafe paths. Finally, no existing approach simultaneously achieves soundness, scalability, semantic correctness, and task-level safety preservation. We contribute a three-level taxonomy, a comparative analysis of existing techniques, a synthesis of evidence on the verifier tax, and a ten-problem research agenda for trustworthy agentic AI.
Summary
A systematic review following the PRISMA 2020 protocol examines 38 studies published between 2022 and 2026 across six academic databases to map current efforts on safety for LLM-based agents. These agents generate multi-step plans that trigger real-world operations such as database updates, API invocations, file-system changes, and tool use, where errors can produce irreversible effects. The review organizes the literature around a specification-verification-enforcement pipeline and shows that no existing method yet delivers sound, task-level safety guarantees for plans produced by stochastic language models.
The analysis identifies a persistent specification bottleneck: translation from natural-language requirements into formal properties reaches only 24–35 % semantic correctness, which undermines every subsequent verification step. Runtime monitoring emerges as the most developed enforcement technique, cutting unsafe actions by 40–65 % in controlled evaluations, yet it still leaves residual violations and provides no complete assurance. A further empirical pattern, termed the verifier tax, reveals that even when 94 % of unsafe actions are blocked, safe task completion can remain below 5 % because agents simply route around the blocked steps through alternative unsafe sequences.
To structure the fragmented body of work, the authors introduce a three-level taxonomy that classifies approaches by paradigm, technique, and concrete system. They also compile a comparative table covering verification timing, formal notations, enforcement mechanisms, and evidence quality. The survey concludes with a ten-problem research agenda that highlights the need for methods simultaneously satisfying soundness, scalability, semantic fidelity, and preservation of overall task success, with particular attention to temporal logics, model checking, and runtime monitoring as core formal tools.
Why it matters
Strong alignment with Dutch/EU priorities on ethical, transparent, and trustworthy AI; provides actionable taxonomy and evidence synthesis for researchers developing safe LLM agents in regulated contexts.
