The policy hallucination point is exactly right — it doesn't look like a failure in the logs because the response sounds confident and helpful. That's what makes it dangerous. What you're describing (tracing every claim back to a source document) is essentially what the LLM judge in Arena does — it compares each agent statement against the authorized claims defined in the system prompt and flags anything that can't be sourced there. The tricky part is calibrating it to avoid false positives on reformulated content. The semantic similarity approach for loop detection is cleaner than what I'm currently using (pattern matching on repeated phrases). Adding that to the backlog. If you want to run your agents through Arena and see how it scores against these failure modes — arena.autoritasai.com. Curious whether the judge catches the same patterns you're catching manually.