SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs

SCOPE. Compiling Natural-Language Policies into Neurosymbolic Predicate Programs. By Arnon Mazza and one other, from Plurai. Published on the twenty-second of October. No code repository is linked to it, though it does publish its weights.

Enforcing policy on LLM agents used to mean single-turn content moderation: look at one message, decide whether it is allowed. It has shifted to compound, application-specific policies that are evaluated over multi-turn transcripts and over trajectories of tool calls. The existing tools each fall short. Fine-tuned guardrail models are efficient, but they degrade on compound policies. Approaches that use an LLM as a judge achieve higher accuracy, but they incur high inference cost and tend to produce unstable predictions.

Neurosymbolic methods are a natural alternative. They decompose a policy into narrow neural decisions and compose those decisions under explicit logic. But existing symbolic layers lack the expressiveness these policies require, and they are optimised against fixed data rather than against the policy itself.

SCOPE treats a natural-language policy as something to compile. It turns the policy into an executable program of neural predicates. Those predicates are executed by small models and by deterministic extractors, and ordinary code composes their outputs into a verdict. The policy stops being one large judgement and becomes a program made of many narrow ones.

This is the neurosymbolic recipe again, with the two weaknesses addressed. Where existing symbolic layers lacked expressiveness, SCOPE's layer is executable code, able to compose whatever the predicates report. Where existing layers were tuned against fixed data, SCOPE's program is tuned against the policy itself. The neural parts stay narrow, each answering one small question, and the logic that combines them is explicit.

The program is not optimised against a fixed dataset. It is optimised jointly with its own training data. SCOPE generates counterexamples adversarially, aiming them at the places where the program deviates from the policy, so the data keeps pushing on exactly the cases the program currently gets wrong. Program and data improve together. The policy, not a frozen collection of examples, is what the program is measured against.

SCOPE is evaluated on a benchmark of real-world policy tasks, against prompt optimisation, task decomposition, and workflow generation methods. It achieves the highest average accuracy across tasks and models. Programs optimised with the weakest executor transfer to other models without further optimisation. That lets them be deployed in production on inexpensive models, where they reach accuracy comparable to frontier reasoning models.

Unlike those monolithic models, SCOPE produces substantially more stable predictions, and each verdict can be interpreted through the predicate outputs that produced it. Where a judge model gives a verdict, SCOPE gives a verdict together with the narrow decisions it was built from. An ablation study validates the key components of the method.

The trade the authors are after is to stop choosing between the cheap guardrail and the accurate, expensive judge. A compiled program of small predicates, trained against counterexamples drawn from the policy itself, is offered as a way to get accuracy, stability and an explanation for every verdict, while running on inexpensive models at production scale.