As AI systems evolve from generating content to taking autonomous actions, security teams face a new challenge: ensuring agents perform the right action, for the right reason, in the right context.
A recent Google Research paper, Contextual Agent Security: A Policy for Every Purpose, introduces Conseca, a framework that dynamically generates task-specific security policies for AI agents. While the paper presents a technical approach, its bigger significance may be the security question it raises:
Key Question
Are traditional authorization models sufficient for autonomous AI agents, or does the AI era require a new form of authorization built around intent, context, and purpose?
🚨 Executive Takeaway
Google’s research suggests we may be approaching a fundamental shift in security architecture.
Traditional authorization asks: Does this entity have permission?
Agent authorization asks: Is this action appropriate for this purpose, in this specific context, right now?
We’ve Been Securing Applications. Now We Need to Secure Decisions.
For decades, cybersecurity focused on protecting:
- Users —> Applications —> APIs —> Data —> Infrastructure
Takeaway
Traditional security assumes software performs a limited and predictable set of functions. Agentic AI changes that assumption.
Modern agents can:
- Read and summarize emails
- Access files and repositories
- Query enterprise applications
- Schedule meetings
- Execute workflows
- Interact with external tools
- Make recommendations
- Take autonomous actions
The challenge is no longer simply controlling access.
Traditional Security vs. Agentic AI Security
Traditional security evaluates permissions.
Agent security increasingly evaluates purpose.
A permission may be technically valid while the resulting decision remains contextually wrong.
The Hidden Problem: Context Changes Everything
Consider a simple example.
An agent has permission to delete email.
Scenario 1
User request:
Remove spam emails older than 30 days.
Deleting email is likely appropriate.
Scenario 2
User request:
Summarize my inbox.
Deleting email is likely inappropriate.
Both scenarios use the same capability. Both scenarios involve the same tool. Both scenarios are executed by the same agent.
The only thing that changed was context.
Google’s central argument is that static permissions cannot adequately distinguish between these situations at scale.
Context Determines Whether an Agent Action Is Safe
This is arguably the most important lesson from the paper.
Security decisions may increasingly depend on:
- Why an action is being performed
- What task is being executed
- What context surrounds that task
- What outcome the user expects
This is a shift from asking whether the action is technically allowed to asking whether the action is justified.
Introducing Conseca
Google proposes a framework called Contextual Agent Security, shortened as Conseca.
Instead of permanently granting broad permissions to agents, Conseca dynamically generates a temporary policy based on:
- User request
- Trusted context
- Organizational information
- Approved system information
- Known constraints
The generated policy then becomes the runtime authorization boundary for the agent.
In simple terms, traditional authorization says: —> This agent may send email.
Conseca-style authorization says: —> This agent may send email only
for this task -> in this context -> for this purpose -> under these constraints
Every task receives its own policy.
Conseca Architecture Overview
Perhaps the most interesting aspect of the design is the separation between trusted and untrusted context.
✅Trusted Context
Examples include:
- Identity
- User attributes
- Organizational structure
- Approved business policies
- Environment information
🔴Untrusted Context
Examples include:
- Email content
- Webpages
- External documents
- Third-party inputs
- Tool responses
By isolating policy generation from untrusted content, Google attempts to reduce prompt-injection influence on authorization decisions.
Reading Between the Lines
Google never claims that agentic AI is unsafe.
However, the research highlights several challenges facing autonomous systems today:
- Prompt injection
- Over-permissioning
- User approval fatigue
- Context-sensitive decision making
- Static authorization limitations
My interpretation is straightforward:
Conseca is not evidence that AI agents are failing.
It is evidence that traditional authorization models may not scale with future agent capabilities.
Three Stakeholder Perspectives
One of the most useful ways to understand this research is through three different lenses.
AI Consumers
Individuals who primarily consume AI-generated outputs. Examples include:
- ChatGPT users
- Microsoft Copilot users
- Gemini users
- Perplexity users
Primary question:
Can I trust the output?
Primary concerns include:
- Data leakage
- Misinformation
- Manipulation
- Reliability
Conseca helps indirectly by reducing inappropriate actions behind the scenes. Most consumers will never know it exists.
AI Integrators
Organizations embedding AI into products, workflows, and services. Examples include:
- SaaS providers
- Enterprise application teams
- Product engineering organizations
- Healthcare manufacturers
Primary question:
How much autonomy should my AI have?
For this audience, Conseca represents dynamic least privilege. Instead of granting broad permissions permanently, permissions become tied to context and purpose. This may be where the framework creates the most near-term value.
AI-Native Businesses
Organizations whose products are fundamentally driven by AI decisions. Examples include:
- Agent platforms
- Autonomous service providers
- AI-first startups
- AI workflow providers
Primary question:
How do we create trust in AI-driven decisions?
For these organizations, the following capabilities become business-critical:
- Auditability
- Explainability
- Accountability
- Governance
Contextual authorization may eventually become a competitive differentiator.
Three Stakeholder Lenses
The same framework delivers different value depending on where an organization sits in the AI adoption journey.
Strengths and Limitations of Conseca
No security framework is perfect.
Conseca introduces meaningful improvements, but also faces important challenges.
✅Strengths
- Dynamic least privilege
- Context-aware authorization
- Reduced reliance on static permissions
- Human-readable rationales
- Better alignment between actions and purpose
- Potential reduction in prompt-injection impact
🔴Limitations
- Defining trusted context remains difficult
- Policy quality depends on model quality
- Intent understanding remains imperfect
- Multi-step attack chains remain challenging
- Generated policies introduce operational complexity
Google openly acknowledges many of these limitations and positions Conseca as an early exploration rather than a complete solution.
The Bigger Picture: Agent Authorization May Become the Next IAM
Looking back, every major computing era introduced a dominant security challenge.
Authentication Era —>
Who are you?
Identity Era —>
What are you allowed to access?
Zero Trust Era —>
Can this request be trusted right now?
Agent Era —>
Is this action appropriate for this purpose and context?
The Evolution of Security
The industry may be entering a transition from:
Identity-Based Authorization —> Intent-Based Authorization —> Contextual Agent Authorization
Final Thoughts
Google’s Conseca framework may or may not become the dominant implementation model for agent security.
That is not the most important takeaway.
🚨 Final Takeway
The more significant message is what the research signals about the future.
As agents become increasingly autonomous, security teams may need to move beyond simply granting permissions and begin continuously validating purpose, context, and intent.
If that vision proves correct, contextual authorization could become to AI agents what IAM became to cloud computing: a foundational control layer that every organization eventually depends on.
Source
- Lillian Tsai and Eugene Bagdasarian, Google. Contextual Agent Security: A Policy for Every Purpose. HOTOS ‘25, May 14-16, 2025, Banff, AB, Canada.
All content provided on this blog is for informational and educational purposes only. The views expressed here are mine alone and do not represent the views of my employer.