What to know
- The report draws on a workshop involving more than 50 researchers.
- It proposes contextual policy enforcement around agent actions.
- The work is a research agenda rather than a released security product.
Privacy is framed as appropriate information flow
Google Research published a workshop report on agentic privacy and security on October 5. The work draws on a late-2025 meeting involving more than 50 academic and industry participants. It uses contextual integrity, a framework concerned with appropriate information flow, to examine agents that retrieve data, invoke tools and delegate work.
The report proposes a supervisor layer with a contextual policy engine and identifies research questions across systems, models, user controls and governance. It also calls for dynamic evaluation environments for interactions among agents. These are proposed directions for research. The report does not announce a finished policy engine or establish that a released agent satisfies the proposed framework.
Source: Google Research: Agentic privacy and security report
Analysis: Permission depends on the task
An assistant may have access to a calendar and a contact list while organizing a meeting. That access does not make every transfer between the two appropriate. A participant’s availability may be relevant to scheduling, while a private note about that participant may not be relevant to the invitation. The task determines which information should flow to which recipient.
Traditional access controls remain necessary because they define which resources an identity can reach. Context adds a question about what the application should do with information it can already read. A useful system needs both: a resource boundary enforced outside the model and an action assessment that considers the purpose, recipient and content of a proposed transfer.
Delegation makes the record more complicated. If one agent asks another to finish a subtask, the receiving agent needs enough context to work without gaining unrelated authority. The original user’s request and the limits attached to it should remain visible through the delegation chain. A subtask description alone should not become a general grant of access to every connected system.
Evaluation needs consequential test cases
A context-aware control can only be assessed against cases where the expected behavior is explicit. Tests should include similar requests that require different decisions, such as sharing a public project summary with a colleague and sending a confidential draft to an external recipient. The evaluator needs to inspect what actually left the system, not only the explanation an agent provided.
User controls also need to fit the work being delegated. Repeated confirmation prompts can become routine clicks if they omit the information needed to assess the action. A useful approval identifies the recipient, material and consequence. For longer tasks, the system may need to show a coherent batch of proposed actions with a record of what remains within the approved scope.
The report’s contribution is to make these questions part of the research agenda for autonomous systems. Turning them into reliable controls requires implementation, testing and evidence about failures. Organizations evaluating agents can use the contextual lens to define their own test cases while recognizing that the proposed architecture remains an open engineering problem.
Sources & further reading
Factual statements are grounded in the linked material. Interpretation and illustrative examples are Byte Watchr analysis. Vendor claims are identified as claims, rather than independent testing.
The event date records the source announcement or documented operation. The coverage edition groups recent developments and is separate from the publication date. Actual publication is recorded above.
Corrections policy · About this byline
