Compile Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents

Jul 16, 2026

Enterprise agents must execute long-horizon, conditional, safety-critical SOPs reliably. The work compiles machine-readable SOP constraints into executable pseudo-code and runs them with a program-guided (PG) stack machine that pages only the active frame while an LLM performs semantic execution. A three-arm SOPBench study across six models shows compiled text never significantly hurts and yields up to 16.0 points over official prose. Runtime guidance is capability-gated: strong models benefit, weak models degrade. Mechanism probes attribute the effect to spontaneous state discipline, and targeted cursor paging largely recovers refusal gains. Practical guidance: compile first, then enable active-frame paging only after a model-level discipline check.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages9

Reading Time23 min

Abstract

Introduction

Related Work

Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents Chenglin Yu 1 , Li Yin2 , Ying Yu3 , Hongxia Yang4 , Ming Li 1 ,5 1Department of Industrial and Systems Engineering, The Hong Kong Polytechnic University 2Department of Data and Systems Engineering, The University of Hong Kong 3College of Economics and Management, Zhejiang Normal University 4Department of Computing, The Hong Kong Polytechnic University 5Research Institute for Generative AI, The Hong Kong Polytechnic University [Correspondence: ming.li@polyu.edu.hk](Correspondence: ming.li@polyu.edu.hk) arXiv :2607 . 1 1346v 1 [ cs .AI] 13 Jul 2026 Abstract Enterprise agents must follow long-horizon, conditional, safetycritical standard operating procedures (SOPs) . We compile machine-readable SOP constraints into executable pseudo-code and run them with a program-guided (PG) stack machine that pages the active frame while an LLM performs semantic execution. A three-arm SOPBench study across six models separates representation from runtime: compiled text never significantly hurts and gains up to 16.0 points where official prose underperforms. Runtime guidance is capability-gated. Two strong models independently show positive seven-domain PG contrasts (58:19 and 75:31 discordant pairs), whereas weak models are harmed. A full-program cursor ablation—active frame first, complete program retained—recovers much of the strong-model refusal gain; selective visibility adds a smaller improvement. Paired probe and audit measurements track this divide to spontaneous state discipline rather than reconstruction ability. On Bank the three primary arms rise 70.4→86.4→92 . 8, with 100% refusal correctness. Practical guidance: compile first; enable active-frame paging only after a model-level discipline check. 1 Introduction Deploying language agents in customer-facing operations is, toa first approximation, a procedure-following problem. Banks, clinics, and service desks encode their obligations as standard operating procedures (SOPs): long-horizon workflows with conditional branches and safety-critical refusal rules—what todo, what to verify first, when to decline. On SOPBench [Liet al., 2025], the best official configuration passes 82.4% of Bank tasks on the subset we study, with the best refusal accuracy reaching 90.7%—an error rate a compliance office would not accept. The dominant practice puts the entire SOP into the prompt as text. Resident prose (∼ 104 characters per turn on Bank) competes with the dialog for attention [Liu et al., 2024a], and verbalization strips executable structure: alternative order, gate short-circuits, the boundary between what must hold and how to verify it. The symptoms: skipped checks, premature actions, incorrect refusals. We treat the SOP as a program rather than a text. An offline, deterministic compiler translates the benchmark’s machinereadable dependency constraints—the same source its verbalizer renders as the baseline prose—into a two-layer pseudo-code program: process functions, one per user goal, and rule subroutines pairing each constraint with its verification recipe and an evidence-bearing return. An online program-guided (PG) runtime executes it as a two-layer virtual machine: a symbolic stack machine does the bookkeeping (stack, cursor, variables, recovery) and pages only the active frame into context, while the LLM converses, calls tools, and judges evidence. Enforcement is deliberately soft—attention, not permissions—at the price that correctness depends on faithful local-frame execution: a design bet we measure. A three-arm design (official text; compiled text; compiled program plus runtime) separates the two layers on identical tasks, and six models spanning capability tiers chart where each layer pays. The compiled representation never significantly hurts and pays where official prose underperforms; a content ×format factorial shows the code-format package is

FAQs

文中如何将SOP约束转化为可执行形式？

通过离线的、确定性的编译器，将基准提供的机器可读依赖约束翻译为两层伪代码程序：以用户目标为粒度的进程函数，以及将每条约束与其验证配方和可提供证据的返回绑定的规则子程序。

程序引导（PG）运行时如何与LLM协同工作？

运行时以两层虚拟机方式执行：符号堆栈机负责栈、游标、变量与恢复等账务，并仅将“当前活动帧”分页到上下文；LLM则进行对话、工具调用与基于证据的判断，从而实现程序约束的软执行。

“能力门控（capability-gated）”对不同模型的效果有什么差异？

结果显示，运行时指导对强模型带来独立的正向提升，而弱模型在Bank七个领域上会出现显著下降（文中提到约14–26分的损失）。机制验证表明差异与“自发的状态纪律”有关，而非仅由重建能力导致。

Jul 16, 2026

Upload by Clementine