AI agents can follow every rule at each step and still break the overall policy governing them.
A paper posted to arXiv on September 17 defines this failure mode as a Compositional Policy Violation, or CPV: a case where organizational rules such as referral thresholds, authority limits, and review requirements apply to an entire agentic execution, not to any single step, but the monitoring tools in use today (input-output classifiers, per-turn rails, span-level evaluators) only ever check one step at a time. The authors sort these failures into four types: Authority Creep, where permissions expand gradually across steps; Threshold Laundering, where a quantity is split to stay under a limit at each checkpoint; Cumulative Sum Violation, where small compliant increments add up to a non-compliant total; and Context Collapse, where information needed to catch the violation gets dropped between steps. Their proposed fix is a provenance-aware runtime that checks policy against the full execution trace, recalculating the guarded numbers from raw inputs instead of trusting whatever the pipeline says those numbers are.
This matters because agentic AI is already making calls in lending, insurance, and other regulated workflows, where the actual rule is almost never did this one step behave but did the whole case get handled properly. A system can pass every per-step audit and still, in aggregate, extend authority it shouldn't have or launder a number under a threshold, and no amount of tuning the step-level checkers will catch it, because the violation simply isn't visible at that scale.
It's the AI version of structuring a bank deposit to dodge a reporting threshold: each piece looks fine, the pattern doesn't. Expect governance vendors to claim this is solved well before anyone ships a runtime that actually recomputes provenance end to end.