> Paper: LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents > Authors: Md Nayem Uddin, Amir Saeidi, Eduardo Blanco, Chitta Baral > arXiv: 2606.20529
This forum post opens with a familiar failure scenario: a user asks an AI agent to cancel order #12345, then immediately asks it *not* to cancel—yet the agent cancels anyway. The post argues the agent didn't "forget"; it never explicitly "remembered" in the first place.
Key points
The problem: implicit "black-box" memory
Modern tool-calling agents rebuild task state on every decision by re-reading a giant prompt containing system instructions, tool descriptions, policies, dialogue history, and tool results. This has two fatal flaws:
- Information loss and pollution: long conversations get truncated; facts get buried; older information can override newer instructions. The paper calls this decision-making grounded in "stale, missing, or incorrect information."
- Weak policy checking: constraints (e.g., "orders containing gifts require supervisor approval") are checked implicitly, so a syntactically valid tool call can still violate policy.
- Improved Pass@k task completion, especially on complex multi-turn, multi-tool tasks
- Largest gains on strict multi-turn consistency, confirming explicit state management fixes "forgetting"
- Significantly reduced policy violations via pre-call constraint checking
- Explainability: the ledger is a white box—decisions can be traced to specific facts and policies, aiding debugging, audit, and compliance
- Persistence: ledgers can survive across sessions, building long-term user understanding (preferences, history, membership tier)
- Fidelity: keeping information structured avoids the lossy round-trips of plain-text extraction
- Ledger updates still depend on accurate NLP extraction
- Incomplete policies mean incomplete constraint checking
- Pre-call checks add latency, problematic for real-time voice agents
- Future: auto-extracting constraints from policy documents, probabilistic state, multi-agent shared ledgers, user-editable ledgers
- Uddin, M. N., et al. (2026). LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents. arXiv:2606.20529.
- Schick, T., et al. (2023). Toolformer: Language Models Can Teach Themselves to Use Tools. arXiv:2302.04761.
- Qin, Y., et al. (2023). Tool Learning with Foundation Models. arXiv:2304.08354.
- Karpas, E., et al. (2022). MRKL Systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning. AI21 Labs.
The solution: an explicit ledger
LedgerAgent separates task state from the prompt, maintaining it in a structured ledger with three layers:
1. Facts — user intent, order number, amounts, special tags (e.g., "gift"), time requirements 2. Constraints — policy rules, system limits, user requirements 3. Conditions — what's confirmed, pending, or on hold
The ledger is updated after each user message, tool call, and policy check, then rendered into a structured view before each decision—highlighting unsatisfied constraints, like an accountant preparing financial statements rather than handing over raw receipts.
Pre-execution policy interception
After the agent generates a tool call but *before* execution, the system checks the ledger:
1. Does order #12345 involve a gift? → Yes 2. What's the policy? → Supervisor approval required 3. Approval obtained? → No 4. Block the call, return an error, let the agent re-plan (e.g., contact the supervisor first)
Experimental results
Tested across four customer service domains (e-commerce orders, flight changes, hotel bookings, tech-support tickets) with a mixed panel of open models (Llama, Mistral) and closed models (GPT-4):
Why structured state matters
Cognitive science framing
The post likens the prompt to limited human working memory (4–7 chunks), while the ledger acts like cognitive offloading—an external notebook—letting the agent focus on reasoning rather than retrieval.
Limitations and future work
Conclusion
The post closes with the paper's central message: AI reliability depends not only on model scale but on system architecture. A ledger gives an agent structure, persistence, inspectability, and enforceable constraints—so that instead of saying "Sorry, I don't understand," it can cite line 3 of its records and policy 3.2 to explain exactly why it won't cancel your order.