Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle

* The workshop report was presented on October 5, 2026.
* The authors are Eugene Bagdasarian (Research Scientist, Google Research) and Marco Gruteser (Principal Scientist, Google Research).
* The research outlines open research directions across system, model, and user levels for trustworthy AI agents.
* The work is grounded in the theory of Contextual Integrity (CI), defining privacy as "appropriate information flow" according to social norms.
* The core challenge is enabling agent capability while ensuring appropriate action through reasoning about context.
* Agents differ from traditional software in three critical dimensions leading to challenges.
* The report advocates for a contextual policy engine to monitor and enforce action appropriateness.
* This engine includes a dynamic policy generation loop operating in real time.
* A proposal is made for standardized, multi-agent benchmarks, such as dynamic "Agent Gym" environments.
* Contributions were made by over 50 researchers and industry leaders.

The argument pivots on the idea that agentic AI requires a paradigm shift from traditional static permissions to dynamic, context-aware governance anchored in social norms. The mechanism proposed—a contextual policy engine—is an attempt to operationalize Contextual Integrity by creating a machine-readable layer that translates abstract societal expectations into executable system constraints. This moves the problem from simple access control (what data can be seen) to complex behavioral regulation (what action is appropriate).
The call for dynamic, multi-agent testing environments like "Agent Gym" suggests an awareness that safety and trust cannot be guaranteed by static auditing; they require simulating the cascading, long-running interactions agents perform in real-world contexts. The underlying pattern here reflects a necessary evolution in AI safety: moving from externally imposed, brittle guardrails to internally reasoned, contextually integrated systems. The implication is that building trustworthy agents depends less on patching individual vulnerabilities and more on embedding the *structure* of social appropriateness directly into the system's operational logic, challenging the assumption that safety can be bolted on later.
What are the inherent risks in relying solely on a contextual policy engine? If the definition of "social norms" is itself context-dependent or subject to manipulation by different actors, the system risks enforcing an arbitrary or biased definition of appropriateness. The leap from defining CI theoretically to engineering a reliably enforceable mechanism for it is significant; the success of this approach depends entirely on how robustly and fairly those contextual norms are encoded, tested, and continuously updated across diverse agent interactions.
What further research is needed to ensure the policy engine does not become an opaque layer that simply obfuscates undesirable outcomes rather than actually enforcing genuine appropriateness? How can the mechanism for defining and updating these contextual norms itself be made transparent and accountable to the end-user and society?