BAGDASARIAN, TSAI ET AL. · CAPS WORKSHOP REPORT · 2026116 pages · 14 sections · 51 open problems · 17 pages here

A plush raccoon mail courier in a CONTEXT t-shirt holds up an envelope in front of three small doors marked with a medical cross, a dumbbell and a house, deciding which envelope belongs at which door. — Contextual Integrity in one picture: the same envelope is fine at one door and wrong at the next.

Agentic privacy, mapped

A long workshop report from the Google Contextual Agent Privacy and Security (CAPS) Workshop, New York City, November 2025, argues that the usual toolkit of least privilege, consent prompts and static filters breaks once software plans its own steps. Its replacement is an old idea from privacy philosophy: an agent should do what is appropriate in context. This map walks the framework, then every open problem the authors list, one area per page.

The one-sentence version: an agent needs broad access to be useful, and broad access is exactly what security engineering tells you not to grant, so the report proposes replacing "who may see what" with "which flows and actions fit the norms of this context". It calls that Contextual Integrity for information and Contextual Security for every other action, then spends most of its pages on what nobody yet knows how to build: norms a machine can look up, policies compiled from natural language, credentials that live exactly as long as a task, consent that does not fatigue, benchmarks that run for years, and governance that decides whose norms win.

Short on time

read it in 10 minutes

Building agents

what to do Monday

Every problem

all 51, indexed

The words

glossary

Tick a page when you have read it; this browser remembers.

01 · THE LENS

Why "appropriate in context" and not "allowed or denied"

The executive summary blames three properties of agents for breaking conventional security and privacy engineering. Part I then brings in Helen Nissenbaum's theory of Contextual Integrity as the yardstick for what "acting appropriately" means.

Dimension 1

Unstructured interfaces, ambiguous input

Instructions and data arrive as natural language and images, so expected behavior is hard to define and adversarial text (prompt injection) looks like any other input.

Dimension 2

Probabilistic, dynamic control flow

Plans and code are generated at run time with "jagged" model performance, so the execution path is new each time and resists ordinary testing.

Dimension 3

Autonomy and delegation

Long tasks, sub-agents and abstract goals outrun oversight that leans on confirmation prompts, which ends in consent fatigue.

Contextual Integrity, applied to agents

§1, §2, §4, App. A–Cthe five-parameter CI tuplefour meanings of "context"

Privacy as appropriate flow, not secrecy or control. Sender, recipient, subject, information type and transmission principle; why norms are legitimate only when they serve a context's purposes; where personal preferences fit; and the report's definition of a trustworthy agent: utility, privacy, security, under benign and adversarial conditions.

Three dimensions, four threat models

Exec. summary, §1, §3capability vs. control

The three properties that break least privilege, read against the four threat models of §3: malicious users, a malicious environment (indirect prompt injection), a poisoned model, and no adversary at all, where agents still over-share, melt down and reward-hack. Plus the paper's reframing of prompt injection as a flip of judgment that can go either way.

02 · PART I · THE FRAMEWORK

From a theory of privacy to a machine that enforces it

Part I closes with two moves: extend Contextual Integrity from information flows to all behavior, and decompose "operationalize CI" into five steps an agent would have to perform. Ten open problems live here.

Contextual Security

§5OP 5.1–5.3security defined by society, not the spec

Why a system that perfectly enforces its own specification can still be insecure in context, from the gym-booking agent to the serial killers' self-destructing filesystem. Threat models that fit the setting, and security norms as a pair of functionality and security goal.

Operationalizing CI: the contextual policy engine

§6OP 6.1–6.7five reasoning steps

Identify flows, locate norms, judge, resolve uncertainty, enforce. Why no oracle model exists, how a policy generator plus a runtime enforcer splits the job, why untrusted text must not reach the generator, and how preferences, values and requirements rank when they collide.

03 · PART II · COMPONENTS

System, model, user

Part II asks what each layer can contribute: guardrails in the execution environment, contextual reasoning in the model, and oversight from a user whose attention is finite. Twenty-one open problems.

Identity, authorization, accounting

§7.1–7.3OP 7.1–7.5system level

An agent is neither a human nor a deterministic program, so identity, OAuth scopes and audit logs all wobble. Telling agents from people, tracing a sub-agent's action back to a user, purpose-bound and task-lived credentials, and artifacts that bind an action to the intent behind it.

PII, minimization, deletion, anonymity

§7.4OP 7.6–7.9system level

Redaction that keeps meaning, leaks through chain of thought and memory, three faces of data minimization, encrypted-traffic fingerprints, "ghost" representations that survive deletion, and the tension between anonymity and accountability.

AI as the last-mile developer

§7.5OP 7.10–7.11exec(*)

The report's sharpest systems argument: replace each LLM call with a nondeterministic choice and see what the code still guarantees. An email-to-calendar app stays bounded; a general planner becomes exec(*). How much agentic-ness a task needs, and how to bring testing and review back.

Teaching models contextual reasoning

§8OP 8.1–8.4model level

RL gyms and on-policy distillation for CI reasoning, the knowing-doing gap, when to ask a clarifying question, stale assumptions months later, scaling and verifier trade-offs, and interpretability for how models use private data.

Mental models and the end of notice-and-choice

§9.1–9.2OP 9.1–9.4user level

Why users misread agents, what merged contexts and "infinite memory" do to bystanders, four ways static consent fails, and a shift to risk-scaled, mixed-initiative control with policies users can author and edit.

Trust, stop buttons, accountability

§9.3OP 9.5–9.6user level

Trust versus trustworthiness, audit paths the task model cannot rewrite, "what if" simulation before delegation, delayed execution, undo windows and circuit breakers, and what contracts, transparency, liability and incentives mean when the contractor is a model.

04 · PART III · ECOSYSTEM

Evaluation, multi-agent systems, governance

Part III leaves the single agent: how to measure success, what happens when agents talk to agents, and who decides the norms. Twenty open problems.

Evaluations and benchmarks

§10, App. DOP 10.1–10.716 CI benchmarks reviewed

Why agent benchmarks mislead, the open question behind saturated red-teaming, the missing large-scale user studies, and "CI for life": memory over years, cumulative leakage, a privacy-utility balance that moves, and benchmarks that survive a change of harness.

Shared norms, delegation, composition

§11.1–11.2OP 11.1–11.5multi-agent

A contextual handshake between strangers, collusion and norm drift, constraints that evaporate after hop one, swarms of thousands, and disclosures that are each fine until someone sees both.

Protocols, attestation, side channels

§11.3–11.4OP 11.6–11.9multi-agent

Free-form language over MCP and A2A, firewalled task-scoped protocols, why remote attestation of code does not attest behavior, how expressive an inter-agent language should be, timing leaks, and simulated societies for training and evaluation.

Governance: whose norms, and who checks

§12–13OP 12.1–12.4norm repository

Preconditions for a norm-respecting ecosystem, liability placed where capability sits (the credit-card and ADA precedents), three ways to source norms, conflicting jurisdictions, and compliance records produced at the moment an agent acts.

05 · GUIDES

Three ways in

Read it in 10 minutes

the whole report, compressed

The argument end to end: definitions, the three dimensions, the five reasoning steps, the seven headline problem areas, and what the report does not claim.

For builders

what the report implies for an agent you ship

The patterns the report points to that exist today, such as a separate policy engine, trusted-only policy inputs and task-scoped credentials, each tied to the section and open problem it comes from, with the caveats the authors attach.

Glossary

App. A–B plus the report's own coinages

CI terms as the report standardizes them (context, norm, CI tuple, transmission principle, the CI heuristic) and the new vocabulary: contextual security, contextual policy engine, intent-binding artifact, functional revocation, contextual handshake.

06 · INDEX

All 51 open problems

The report's own list (§14), each linked to the page that explains it. Section numbers and page numbers match the report; the p. column opens the PDF at that page.

OP	Problem	p.
5.1	Identifying contextual behavior norms	19
5.2	Determining reasonable and accurate threat models	20
5.3	Agreeing upon contextual security norms	21
6.1	Balancing reliance on users vs. AI models	23
6.2	AI models that understand contextual norms	24
6.3	Representing contextual norms	25
6.4	Formal policies that capture norms expressed in natural language	26
6.5	Preventing harmful context from affecting policy generation	27
6.6	Establishing precedence between conflicting policies	28
6.7	Practical enforcement mechanisms to ensure appropriate behavior	29
7.1	Distinguishing agents from humans	31
7.2	Tracing agents back to users	32
7.3	Enabling context-aware authorization	33
7.4	Managing the authorization lifecycle	34
7.5	Ensuring that an agent's action is intended by the user	35
7.6	Evolving PII detection and replacement	36
7.7	Achieving data minimization	36
7.8	Moving from data deletion to functional data revocation	37
7.9	Protecting user anonymity in an agentic world	38
7.10	Closing the gap between developer intent and application specification	41
7.11	Making agent execution as robust as traditional software	43
8.1	Teaching models privacy and security reasoning	44
8.2	Handling uncertainty and ambiguity in unstructured domains	46
8.3	Detecting stale assumptions in changing contexts	47
8.4	Interpretable use of private information	49
9.1	Supporting user mental models for AI agents	50
9.2	Thinking beyond notice and choice for AI agents	53
9.3	Determining appropriateness of AI agent actions	53
9.4	Enabling user supervision over automation	55
9.5	Delaying, stopping, and reversing AI agent actions	58
9.6	Accountability frameworks for AI agents	58
10.1	Advancing automated red-teaming on saturated benchmarks	61
10.2	Designing and implementing large-scale studies	62
10.3	Evaluating how agents persist and use historical system context	63
10.4	Evaluating leakage in aggregated data flows	64
10.5	Benchmarking dynamic privacy-utility trade-offs	64
10.6	Evaluations that carry across environments	64
10.7	Evaluations of agents in evolving environments	65
11.1	Establishing shared contextual norms	66
11.2	Preventing collusion and drifting norms between agents	66
11.3	Preserving constraints during delegation or parallel execution	67
11.4	Orchestrating large agentic swarms and enforcing normative behavior	68
11.5	Ensuring composed behaviors across agents uphold privacy and security	68
11.6	Developing secure and robust multi-agent communication protocols	69
11.7	Building trust across agent boundaries with attestation	69
11.8	Balancing security and utility in multi-agent communications	70
11.9	Building realistic multi-agent environments for Contextual Integrity	71
12.1	Achieving environments conducive to contextual privacy and security	72
12.2	Determining CI norms	73
12.3	Institutional and legal governance: resolving conflicting norms	74
12.4	Incentivizing and verifying normative compliance	74

Source and related reading

The report (PDF, 116 pages)Bagdasarian, Tsai et al., Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle, 66 authors from 25 affiliations Google Research publication pageThe canonical listing for the report. No arXiv version could be found as of 2026-10-23. Announcement postGoogle Research blog, 2026-10-05, by two of the workshop organizers The full CI glossaryThe up-to-date version of the report's Appendix A, maintained by the Contextual Integrity community