Google’s Agent Privacy Report: Permissions Need Context

An AI agent needs rules about where information belongs, not just access to the information. Google Research’s October 5 announcement introduces a workshop report on contextual privacy and security. It is a research agenda, not a newly released protection that makes connected agents safe by default. For a small business or nonprofit, the immediate lesson is to test recipient and purpose boundaries before granting broad access.

The announcement describes work involving more than 50 academic and industry participants following a late-2025 workshop. It identifies ambiguous inputs, unpredictable execution paths, and delegation as challenges for agent oversight. The authors propose contextual policy engines and defenses at several layers. These are proposed directions rather than independently validated production guarantees.

The publication abstract frames the work as open research problems. That distinction matters: readers should not infer that Gemini, a particular connector, or every Google product already implements the proposed architecture.

Contextual Integrity considers information flow in terms of sender, recipient, subject, information type, and transmission principle. In plain language: who is sharing what about whom, with whom, and under which rules?

Our editorial example is a nonprofit event assistant. It might need a volunteer’s availability to make a rota. That does not mean it should include private notes about the volunteer in a sponsor update. Reading a record and sharing a record are different decisions. A broad instruction to coordinate an event leaves that boundary underspecified.

The same issue appears when a solopreneur asks an agent to prepare a client proposal. Internal margin notes may help with planning, but they do not belong in the document delivered to the client. Useful automation requires enough context to complete the task and an enforceable boundary around the output.

The full report provides the underlying research agenda. Our procurement questions translate its concern into observable behavior; they are not a certification checklist or claims about existing products.

Ask whether access can be restricted to a selected folder and whether sending or changing records can be disabled independently. Ask how the system handles an unexpected recipient, a changed task, and a downstream agent. Request a demonstration of revoked access and a record of the action that was blocked. A reassuring answer in chat is weaker evidence than an actual permission boundary.

For consequential actions, approval should show the destination and proposed content clearly enough for a person to assess them. If people repeatedly approve requests without reading them, the workflow needs redesign rather than another reminder to be careful.

Create a fictional project folder with a public event brief, an internal budget note, and a private volunteer note. Give the agent a bounded task: draft a public announcement from the brief. Keep delivery disabled and inspect the proposed output.

Next, change the recipient to an internal coordinator and specify which additional fields are permitted. Finally, place an instruction inside a sample document asking the agent to share everything externally. That document is task data, not authority. Record whether the system follows the real task boundary, asks a useful question, or leaks material into the draft.

Repeat after withdrawing access. Keep a simple ledger of inappropriate disclosures, blocked actions, confusing approvals, and correction effort. These are DiscoverAI’s proposed evaluation steps, not results from a test we have performed.

Look for reproducible tests across changing tasks and recipients, documented enforcement outside the model’s own promises, and recovery after permission changes. Continue using the existing workflow if those controls cannot be demonstrated. A research framework helps define the problem; the buyer still needs evidence from the exact product and configuration being considered.

For further selection help, use [Tool Finder](/tool-finder) or browse the [Decision Workspace](/decision-workspace). Compare the task and controls before adding another subscription.