Abstract
Large language models increasingly orchestrate services, but attacker-controlled inputs can induce access-control violations, data leakage, omitted mandatory steps, and quota overruns. Prompt-based defences reduce these failures without eliminating them. We place two runtime checks between an untrusted proposer and service execution. Our deontic policy automaton checks each proposed action against explicit permissions, prohibitions, and obligations. Under correct catalogue labels, complete mediation, and an adequate policy, no action violating the policy’s safety fragment executes. Terminally pending obligations are detected but cannot be forced. A mislabelled action falls outside this guarantee. Our conformal guard handles residual violations, and we calibrate its detector threshold on labelled data. The pass-through bound holds only while deployment violation scores stay exchangeable with calibration scores, and adaptive low-scoring rewrites break it and are admitted. On Deon-Bench , the automaton agrees with ground truth on 100% of 900 traces across six violation classes. For content egress that the policy cannot identify, the calibrated layer admits 8.9% of leaks against a 10% target, rising to 32.8% under adaptive obfuscation. Across six proposer models, our guard reduces attack success for policy-expressible injections from 87–100% to 0%, with microsecond-scale monitoring overhead. Keywords: Agentic service composition, Runtime verification, Conformal prediction, Prompt injection, Deontic logic