Can an agent violate a policy when every action it took was approved?

Yes. A guardrail that checks one action at a time can wave through a violation that only exists once you look at several approved actions together, because no single one of them looks wrong by itself. One recent study built exactly this kind of violation and tested it against nine LLM judges acting as per-action guards: they approved it almost without exception, blocking it at a rate close to an ordinary benign action, even though the same models flagged it immediately once both actions were shown together.

A single-action check only ever sees one action, so a violation that only exists across several has nowhere to be caught, however strict that one check gets. A policy about intent or purpose is a claim about a sequence, not about any step in it on its own. Catching a violation like that needs something that compares actions across a run, not a stricter version of the same per-action gate. A trace can look entirely normal while the real problem sits upstream of it; this is the same gap, one step further out.