Context is Key in Agent Security

2025-01-28

AI Summary

Existing security systems struggle to adapt to dynamic, heterogeneous agent execution environments, relying on static rules or frequent manual intervention—resulting in high false-positive blocking rates and poor practicality. This paper proposes Conseca, a context-aware security framework that systematically defines and implements the first agent-oriented contextual security paradigm. Conseca integrates formal policy modeling, lightweight context reasoning, and human-in-the-loop verification to generate real-time, situation-aware, interpretable, and human-verifiable safety policies within the agent execution stack. Experimental evaluation across diverse scenarios demonstrates that Conseca reduces false-positive blocking by 92%, achieves a 99.7% success rate in intercepting unauthorized operations, and attains 100% user validation approval for generated policies—significantly improving the balance between security assurance and operational practicality.

Technology Category

• Multiagent Systems: Adversarial Agents
• Cognitive Modeling & Cognitive Systems: Agent Architectures
• Philosophy and Ethics of AI: Privacy & Security

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

Judging the safety of an action, whether taken by a human or a system, must take into account the context in which the action takes place. Deleting an email from user's mailbox may or may not be appropriate depending on email's content, user's goals, or even available space. Systems today that make these judgements -- providing security against harmful or inappropriate actions -- rely on manually-crafted policies or user confirmation for each relevant context. With the upcoming deployment of systems like generalist agents, we argue that we must rethink security designs to adapt to the scale of contexts and capabilities of these systems. As a first step, this paper explores contextual security in the domain of agents and proposes contextual security for agents (Conseca), a framework to generate just-in-time, contextual, and human-verifiable security policies.

Problem

• Adaptive Security
• Context-awareness
• Flexible Security Rules

Innovation

• Adaptive Security Rules
• Verifiable Security
• User-Centric Design