Beyond Guardrails: Runtime Enforcement for Secure AI Agents-A Systematic Review of Action Control, Isolation, and Policy Enforcement

Abstract

Large language model (LLM) agents turn model-generated decisions into tool calls, API requests, code execution, data access, and transactions. When agent reasoning is manipulated or simply wrong, model-centric guardrails cannot by themselves stop the resulting action. We systematically reviewed runtime-enforcement mechanisms for autonomous and tool-using AI agents in literature published or publicly available from January 2023 to September 2026. Searches of Compendex and the Web of Science Core Collection, followed by deduplication, multi-stage screening, source-grounded eligibility assessment, and targeted snowballing, yielded 58 primary studies, which we coded by enforcement placement, security mechanism, and assurance type. Most studies enforce security at the tool/action boundary (33/58, 56.9%) or inside the agent runtime or harness (18/58, 31.0%), whereas only 7/58 (12.1%) work primarily at the OS/process/execution boundary. Authorization and privilege control (41/58, 70.7%) and action validation (34/58, 58.6%) are the most common mechanism families. Across very different mechanisms and assurance models, a common design emerges: the model proposes an action, and a separate enforcement point decides whether that action may take external effect. Durable authorization, multi-agent delegation, cross-layer enforcement, recovery from partially committed effects, and standardized evaluation remain open problems. These findings suggest that secure agent architectures should separate reasoning from execution authority and place consequential actions behind independently enforceable runtime boundaries.