Skip to content

CONCEPT Cited by 1 source

Contextual Integrity

Definition

Contextual Integrity (CI) is a theory of privacy — originated by Helen Nissenbaum — that defines privacy not as secrecy or control over data, but as appropriate information flow according to established, justifiable social norms. Information isn't "private" or "public" in the abstract; a given flow is appropriate or inappropriate relative to the context it occurs in. Sharing your medical history with your doctor is appropriate; the same flow to your employer is not — the data is identical, only the context changed.

A context-specific informational norm has three components (Source: sources/2026-10-05-google-open-and-emergent-problems-in-agentic-privacy-and-security-a-contextual-angle):

Component What it specifies
Actors Who is sending, who is receiving, and who the information is about
Information types The category of information (e.g. medical, financial, location)
Transmission principles The rule governing the flow (e.g. confidentiality, reciprocity, consent)

A flow violates contextual integrity when any component departs from the norm the subject reasonably expects for that context — e.g. a recipient the subject didn't expect, an information type not appropriate to the context, or a transmission principle (like "keep confidential") that is broken.

Why it matters for agentic systems

Google Research's 2026 CAPS workshop report makes CI the organizing lens for agentic AI privacy and security. The argument: to be useful, an AI agent needs both access to personal data and the authority to take consequential actions across many contexts — so the question is no longer "may this agent read this field?" (static access control) but "is this data flow / action appropriate for the specific context the agent is operating in?" CI gives a principled, decomposable answer where coarse allow/deny permissions cannot.

Two moves the report makes:

  • Extends CI from information sharing to information action — "contextual security." Classic CI governs disclosures; the report generalizes the same actors × info-types × transmission-principles frame to judge the appropriateness of an agent's actions (booking a flight, sending an email, deleting a resource), not just what it reveals. The motivating example: you'd share a gift-shopping list with a shopping assistant but not with family and friends — appropriateness is context-and-recipient specific.

  • LLMs make CI machine-readable for the first time. Historically there was a "semantic gap" between high-level norms ("protect my data while organizing my travel") and low-level system permissions, and manual permissions / expert-written policies "cannot scale" to many concurrent long-running agent tasks. Because models now begin to understand contextual norms, a contextual policy engine can generate and evaluate machine-readable, context-dependent policy at runtime — deciding whether a requested flow is appropriate before any information leaves the user's workspace.

Relationship to enforcement

CI is the norm model; it does not say where enforcement lives. The report pairs it with a supervisor layer / contextual policy engine that evaluates appropriateness before execution — a pre-execution, outside-the-agent boundary that is the research-agenda cousin of the wiki's Out-of-Band Policy Engine and sits as a central-proxy choke point in the path of every action. Because the CI-understanding model layer is itself probabilistic (and injectable), the enforcement boundary is argued to be deterministic and out of band, with the model used to generate candidate policy rather than to be the final gate — a direct application of defense-in-depth. CI thereby refines, rather than replaces, least-privilege and governed agent data access: those bound what is reachable; CI judges whether reaching it is appropriate here.

Contrast with access control

  • Access control (RBAC/ABAC) answers "is this principal permitted to touch this resource?" — a property of identity + resource.
  • Contextual integrity answers "is this flow appropriate given who's involved, what type of information, and under what expected rule?" — a property of the flow in context.

An agent can be fully permitted to read a field yet violate CI by passing it to an inappropriate recipient — the same gap the confused-deputy problem exposes, viewed through a privacy-norm lens.

Seen in

Last updated · 854 distilled / 2,448 read