COMPASS: A Framework for Evaluating Organization-Specific Policy Alignment in LLMs

Models excel at allowing permitted actions but fail dangerously at blocking prohibited ones: Across seven state-of-the-art models tested, LLMs achieved over 95% accuracy in handling legitimate requests aligned with organizational policies, but only refused 13-40% of adversarial attempts to violate prohibitions—a critical gap for high-stakes deployments in healthcare and finance.

Current safety evaluations miss organization-specific risks: Existing AI safety assessments focus on universal harms (like illegal content or violence), but COMPASS reveals that models need separate evaluation for company-specific policies like financial regulations, medical protocols, or industry compliance rules that vary by organization.

Adversarial edge cases expose hidden vulnerabilities: The framework tested 5,920 queries including strategically designed edge cases that attempt to circumvent policies through subtle rewording or context manipulation. Models that appeared safe under routine testing failed dramatically when faced with these adversarial variations.

Policy compliance requires a different evaluation approach than general safety: The "fundamental asymmetry" discovered—strong performance on allowlist compliance but weak performance on denylist enforcement—suggests that preventing harmful outputs requires distinct evaluation methods and safeguards beyond current approaches.

Organizations deploying LLMs in regulated industries need specialized testing: The research demonstrates that COMPASS-style evaluation is "essential" before deploying LLMs in policy-critical environments, indicating that standard safety certifications are insufficient for enterprise applications in healthcare, finance, and other regulated sectors.