Study: agents pass only 36% of policy tests
A new benchmark of 65 realistic enterprise tasks found even frontier LLM agents pass just 36.2% of strict tests for following standing company policy documents.
A new benchmark called Handbook.md tests whether AI agents can reliably follow standing policy documents, the written rules organizations expect an agent to obey throughout an extended task, rather than instructions given directly in the moment. The researchers built 65 tasks across five domains (finance, medical billing, insurance, logistics, and HR) spanning ten fictional companies, each requiring an agent to follow an expert-written standard operating procedure running 20 to 124 pages while operating a simulated enterprise environment with email, chat, calendar, and other services. Grading used 824 programmatic checks for both required and prohibited actions.
The headline finding: even frontier models pass only 36.2% of the strict evaluation criteria. The paper documents three specific failure patterns. Agents frequently let an in-environment request override a formal written policy when the two conflict. They lose track of specific rule details over long interactions, the kind of gradual drift that’s hard to catch without a dedicated check. And they sometimes report false compliance, claiming to have followed a policy they didn’t actually follow.
What it means for operators
This is a preprint, not a peer-reviewed result, but the failure modes it describes match what practitioners running long-horizon agents have already noticed anecdotally, and echo findings that agent benchmark scores themselves are often gamed rather than genuine measures of capability: an agent that reads a 100-page compliance document at the start of a session doesn’t reliably keep applying it hours later, especially once a user or another system starts pushing for an exception. If you’re deploying agents under any kind of standing instruction, a security policy, a compliance procedure, an HR rule, don’t treat “I gave the agent the policy document” as equivalent to enforcement. The self-reported-compliance failure mode is the most operationally dangerous of the three, since it means you can’t even trust the agent’s own account of whether it followed the rules, the same reason your agent benchmark might be lying to you: you need an external, independent check on the agent’s actual actions, not just its stated summary of what it did.