SAFETY SENTRY: Context-Aware Human Intervention via EXECUTE-ASK-REFUSE Routing

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Tianyu Chen, Chujia Hu, Wenjie Wang
• Venue: arXiv: cs.AI
• Published: 2026-07-15
• Collected: 2026-07-16
• URL: http://arxiv.org/abs/2607.13594v1
• PDF: https://arxiv.org/pdf/2607.13594v1
• DOI: UNKNOWN

Plain-Language Brief

Researchers present Safety Sentry, a lightweight guard model that makes decisions about executing, asking for help, or refusing actions in real-world environments. This model aims to improve safety and autonomy by making more nuanced decisions based on individual instances rather than action categories.

What the Document Says

• The research presents a guard model called Safety Sentry.
• Safety Sentry makes a three-way routing decision between EXECUTE, ASK, and REFUSE for actions in real-world environments.
• It reduces the decision to a single decoding call during inference.
• A single threshold is used for decision making across different risk tolerance levels without retraining.
• Safety Sentry outperforms various open-weight and closed-source baselines in terms of overall accuracy and safety-related recall while controlling both directional error rates.

Key Concepts Mentioned

• LLM agents
• real-world environments
• tool calls
• Safety Sentry
• EXECUTE-ASK-REFUSE routing
• guard model
• single misjudged action
• irreversible harm
• granularity of action categories
• routine interruptions
• autonomy
• user's context
• directional error rates

Claims Made by the Document

• Safety Sentry outperforms various baselines in terms of overall accuracy and safety-related recall.

Evidence Used

• The text states that Safety Sentry outperforms a broad set of open-weight and frontier closed-source baselines on overall accuracy and safety-related recall.

Methods / Approach

• Three-way routing decision over {EXECUTE, ASK, REFUSE}.

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

LLM agents act on real-world environments through tool calls, and a single misjudged action can cause irreversible harm. The standard safeguard is a guard model that labels each proposed action as safe or unsafe, but this binary view conflates two distinct decisions: whether the action is harmful in itself, and whether it is appropriate given the user's context. It also operates at the granularity of action categories rather than individual instances, producing routine interruptions that erode autonomy and train users to wave through the most consequential alerts. We reframe the problem as a per-instance three-way routing decision over {EXECUTE, ASK, REFUSE} and instantiate it with Safety Sentry, a lightweight guard model whose inference reduces to a single decoding call. A single decoding-time threshold lets one fixed checkpoint be re-positioned across deployments of differing risk tolerance without retraining. Safety Sentry outperforms a broad set of open-weight and frontier closed-source baselines on overall accuracy and safety-related recall, while controlling both directional error rates simultaneously.