[Theme] Preserving Authority Boundaries across Agent Memory and Context Handoffs

Theme Name

Preserving Authority Boundaries across Agent Memory and Context Handoffs

Proposer(s)

Haoran Deng, State Radio Monitoring Center of China

Summary

AI agents increasingly retain long-term memory, compress context, and pass task summaries to other agents. During these transformations, third-party statements, agent inferences, or historical approvals may be mistaken for current authority, while restrictions attached to an original grant may be lost. This theme proposes to examine the requirements for preserving the distinction between information and authorization across memory and context handoffs, so that a receiving agent or service can determine what authority is actually supported before a consequential action.

Scope / Open Questions

Illustrative use case. A user asks Agent A to compare supplier quotations and obtain confirmation before placing an order. Agent A passes a compressed task summary to Agent B, but the summary omits the confirmation requirement; Agent B treats the task description as permission to purchase. The agents and messages may be authenticated, yet the handoff does not establish authority to place the order.

The proposed scope is limited to three areas:

1. Distinguishing information from authority

How should user preferences, third-party statements, agent-generated inferences, historical approvals, and current grants of authority be distinguished when stored or retrieved?

What evidence should support a claim that an authorized principal approved a particular action?

How can a receiver avoid treating content as authorized merely because it appears in persistent memory, is returned by a trusted tool, or is repeated by another authenticated agent?

2. Preserving authority references and restrictions through transformations

Which authority-related information must remain available, directly or through a verifiable reference, after summarization, context compression, retrieval, and inter-agent handoff?

How should the principal, permitted operation, purpose, limits, validity conditions, and any required human confirmation remain associated with the relevant task?

What should happen when a transformation omits, changes, or cannot faithfully preserve a restriction? How should the transformed representation remain distinguishable from the underlying grant?

3. Checking applicability before consequential action

What must the receiving agent or relying service check before using remembered or transferred information as an authorization basis?

How should missing evidence, an expired or withdrawn grant, a changed task context, and an unmet confirmation condition be distinguished?

Under which declared policies should the receiver request evidence, seek renewed confirmation, defer, or reject the action?

Possible outputs include a terminology and requirements matrix, minimum authority-reference and transformation-record requirements, and implementation-neutral test cases. An initial test set could compare a correctly preserved restriction, an omitted restriction, reuse of a historical approval, and a third-party claim incorrectly presented as principal approval.

Out of scope: general memory architectures, model training, universal prompt-injection detection, new agent communication protocols, and legal determinations of a principal’s standing. The work would consume applicable authority and policy requirements rather than redefine them.

Related Work

OWASP ASI06 discussion: Memory Is a Feature. It Is Also an Attack Surface, on persistent untrusted content influencing later agent actions.

Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees, a research preprint examining authority laundering through summarization, trusted-tool echoes, and manufactured corroboration.

These provide threat and research inputs. The proposed FG-TIDA contribution would examine common requirements and testable evidence semantics across implementations, without assuming that a particular research construction should become the standard.

Related Themes

#5 — Provenance of Authority for Agentic AI: supplies the authority requirements this proposal would preserve through memory and context transformations.

#6 — Intent-based Security Policies: evaluates action conformance; this proposal examines whether the remembered or transferred authority reference faithfully represents the applicable grant and its restrictions.

#9 — Authority that was never crisply authored: addresses ambiguity in the original grant. The initial case here instead starts with an explicit restriction that is lost during a later transformation.

#12 — Agent Trust Mechanics: covers memory and context assurance more broadly. This proposal could develop as a bounded workstream within that theme.

#1 — Accountability and attribution after an agent has acted: provides record requirements; this proposal would identify transformation-specific evidence needed to reconstruct how an authority claim reached the acting party.

Discussion

The central question is:

What evidence should a receiving party require before treating remembered or transferred context as authority to act?

Would the supplier-comparison case provide a useful starting point for joint discussion under #5, #6, and #12? In particular, which restrictions must survive a context handoff, and what should a receiver do when their preservation cannot be established?

This is an exploratory proposal. A dedicated workstream or joint sub-thread may be sufficient; a separate Working Group is not assumed.