Agents need personal data and autonomy: Google convenes 50-plus experts to propose a contextual policy engine

Agent privacy and security have to be judged per context, not by the fixed permissions that traditional software relies on. Traditional deterministic software constrains behavior through manual permissions or expert-written policies, and those approaches cannot scale to agents that autonomously perform many complex, long-running tasks. The report is the product of more than 50 academic and industry leaders who met at the Google Contextual Agent Privacy and Security Workshop in late 2025 in New York City, and it spans system, model, user, and ecosystem levels.

The report generalizes Contextual Integrity from information sharing to the appropriateness of agent actions, so a system can evaluate a data flow before any information leaves the user's workspace. Contextual Integrity originally defined privacy as appropriate information flow under social norms, described by actors, information types, and transmission principles, and had not been used to judge whether an agent action itself is appropriate. The report advocates complementing model and user interaction advances with a contextual policy engine inside a supervisor layer, whose dynamic policy generation loop runs in real time and tailors policies to the user request and to tools and capabilities discovered at runtime.

The report calls for standardized multi-agent benchmarks to test the safety of highly autonomous systems. Existing safety evaluations do not directly apply to highly autonomous, multi-agent systems. It proposes dynamic Agent Gym environments where researchers can safely simulate complex, cascading interactions over extended periods, with open-source sandboxes establishing a shared privacy, security, and safety baseline across academia and industry.

The report addresses researchers, platform engineers, and policymakers concerned with agentic privacy and security, and it lays out open research directions across system, model, user, and ecosystem levels rather than a deployed system. It explicitly frames the contextual policy engine, the dynamic policy generation loop, and Agent Gym sandboxes as work the community must advance together, and it invites researchers to read the technical report and join in.

The report presents the contextual policy engine, the dynamic policy generation loop, and standardized multi-agent benchmarks as directions to be developed rather than validated mechanisms. It also states that building a safe, secure, and trustworthy agentic ecosystem is too large a task for any single discipline, organization, or sector, and requires unprecedented collaboration across academia, government, civil society, and industry.