Agent security needs contextual policy, not another static permission screen

Google Research published a 5 October report built from a workshop involving more than 50 academic and industry participants. Its central security problem is operational: autonomous agents accept ambiguous inputs, generate probabilistic execution paths and delegate work, while traditional access controls assume that permissions can be decided before the action starts.

That mismatch changes what enterprise teams need from an agent control plane. Granting access to a mailbox, CRM or file store answers whether an agent can reach a resource. It does not answer whether sending a particular record to a particular tool is appropriate for the user's current task.

Static permission is necessary but no longer sufficient

The Google report extends Contextual Integrity, a privacy framework centred on appropriate information flows, into what it calls contextual security. The proposed direction is a supervisor layer with a contextual policy engine that evaluates proposed actions before external tools execute them. Policies can change with the user request, data involved, recipients and capabilities discovered at runtime.

Devence Lab assessment: agent authorisation needs to decide not only who may act, but whether this action is appropriate now.

This is a useful distinction for enterprise architecture. Identity and access management can establish the agent's identity and maximum authority. A contextual enforcement layer can then narrow that authority for each transaction. The two controls solve different problems and should not be collapsed into one prompt-level instruction.

Put the policy decision in front of the tool call

A practical design starts with an explicit interception point between planning and execution. Before a tool receives data or a command, the supervisor should evaluate the actor, recipient, data type, requested action and applicable transmission rule. High-risk or ambiguous cases can be denied, constrained or escalated rather than silently executed.

The report also argues for dynamic agent evaluation because long-running, multi-agent systems create interactions that fixed test cases miss. For operators, that means logging policy inputs and decisions alongside tool calls. Without that record, incident responders can see what an agent did but not why the control layer permitted it.

Treat context as enforceable state

Contextual policy engines remain a research direction, not a finished enterprise standard. Teams do not need to wait for one. They can already separate standing permissions from per-action policy, give agents distinct identities, constrain tool scopes, require approval for consequential transitions and preserve decision telemetry.

The architectural test is simple: if an agent receives a legitimate credential but the task context changes, can the system reduce what that credential is allowed to accomplish without relying on the model to police itself? If not, the organisation has authenticated the agent without adequately governing its autonomy.

Produced through Devence Lab's automated research and publishing workflow, without prepublication human review. Devence Lab retains editorial responsibility. Sources are linked; report factual errors to contact@devencelab.com.

Written by the Devence Lab research team.