SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs: what it means for business leaders

Plurai's SCOPE compiles a written policy into a program of small-model yes/no questions, exact extractors and Python glue, matching frontier reasoning judges on compound policy checks at a fraction of the cost and with far steadier verdicts.

1. What the method is

SCOPE, short for Symbolic Composition Over Predicates and Extractors, is a compiler from a natural-language policy to an executable program. The program has three kinds of parts: predicates, which are narrow classification questions with a fixed label set answered by a small model with reasoning switched off; extractors, which are deterministic functions that pull spans, values or counts out of the input; and ordinary Python code that decides which text each predicate sees, calls predicates conditionally or repeatedly, and maps their answers to a verdict. The program is produced once by a search run by strong models, which revise predicates and code against failures while two adversarial generators manufacture counterexamples where the program departs from the policy, each labeled by a teacher that reads the full policy. At inference time only the small executor runs, and every verdict is traceable to the predicate answers that produced it.

2. Why the method was developed

Policy enforcement for our agents is no longer a single-message content check. A real policy bundles conditions, exceptions and counts, and the thing being judged is a long transcript or an agent trace in which the deciding evidence is a small fraction of the text. The two standard tools each fail on one side. Small fine-tuned guardrail models are cheap and steady but their capacity caps out as clauses interact. A frontier model prompted as a judge handles the compound case but costs a frontier call per gated interaction and gives unstable verdicts, with variance growing as the clause count grows. Earlier neurosymbolic designs tried to split the difference, but their symbolic layers were checklists, weighted rules or Boolean circuits that cannot express conditional, iterative or arithmetic structure, and they were fit to a fixed dataset or self-generated tests rather than to the policy itself.

3. Who should care

This touches anyone in our business who gates model behavior with a model. Trust and safety and policy owners gain a program they can read clause by clause instead of a prompt whose behavior they infer from samples. Platform and ML engineering teams running guardrails in production get a path to serve compound policies on inexpensive or open-weight models rather than paying for a frontier call on every interaction. Finance and whoever owns inference spend should note that the expensive work moves to a one-time compilation step. Compliance, audit and legal get verdicts that trace to named predicate outputs, which is the kind of evidence a review or a regulator can inspect. Product teams shipping agents, and procurement teams comparing guardrail vendors, should ask whether a vendor's enforcement layer is a monolithic judge or something closer to this.

4. How the method works

The search starts from the policy itself as a single predicate applied to the whole input, with a small pool of human-labeled seed samples. Each round, a teacher model labels any newly generated samples, the current program runs on the pool using the weak executor, and an analyzer replays the composition code on the recorded predicate labels to find which answers would have had to differ to reach the gold verdict. That attributes each failure to a predicate whose wording misses its clause or to code that misencodes the policy. Revisions must cite a clause, definition or exception, never a phrase seen in a sample. A decomposer applies them while tracking history and backtracks to the best program when rounds stall. Two adversaries then generate inputs where the program and policy likely disagree, one targeting the whole composition and one targeting a single predicate; a sample is admitted only when the generator's intended label and the teacher's independent label agree. A weaker executor forces more and simpler predicates.

5. How it was evaluated

The authors released a four-task benchmark on Hugging Face drawn from or modeled on deployed agentic systems: Coaching, auditing a critic's verdict on a wellness message with labels Pass, Fail or Bug, 174 samples; Escalation, a customer-support dialogue where escalation is warranted after three repeats of an unresolved intent, 371 samples; Plan, validating a short research plan buried in a GAIA agent trace averaging 45 thousand characters, 163 samples; and Tile-match, picking which dashboard tiles a message refers to, scored by Jaccard with 55 of 124 test samples referring to none. Executors were gpt-5.4-nano, gpt-5.4-mini and gemini-3.5-flash with reasoning disabled; the compilation agents ran Claude Opus 4.8. Baselines were direct prompting, the DSPy optimizers GEPA and MIPROv2, the decomposition methods CheckEval and RLIE on the binary tasks, and AFlow, which was allowed intermediate reasoning. Numbers average three optimization runs times three evaluations. Nano-compiled programs were then run unchanged on five open-weight models against gpt-5.5 and gemini-3.1-pro, and an ablation removed the adversaries over five runs.

6. How it performed

With gpt-5.4-nano, SCOPE scored 0.85, 0.82, 0.87 and 0.78 on Coaching, Escalation, Plan and Tile-match against 0.60, 0.56, 0.59 and 0.38 for direct prompting, with standard deviations of at most 0.03; it was best or tied in 10 of 12 task-executor cells and AFlow took the other two. Upgrading from the weakest to the strongest executor bought 0.26 under prompt optimization but only 0.09 under SCOPE. Programs compiled on nano and run on DeepSeek-V4.1-Flash and Qwen3-235B without reasoning reached accuracy comparable to gpt-5.5 at high effort and gemini-3.1-pro, beating them on Tile-match and Escalation while trailing on Coaching, and only 5 to 7 percent of Tile-match verdicts changed across five runs against 37 percent for gpt-5.5. Removing the adversaries cost 0.04 to 0.06 on three tasks and nothing on Escalation. The authors note that correctness rests on the teacher's reading of the policy with no formal verification, the test sets are small and self-built, and the truncated text we read gives no compile-cost figure. Our call: pilot it on one compound policy we currently pay a frontier judge to enforce. (Source: arXiv 2610.31062, 2026)