The Pulse
Google Researchers Sketch Policy Engines to Govern AI Agents
Google Research proposes contextual policy engines that translate user intent and social norms into machine-checkable rules for AI agents. The workshop report also details unresolved risks, including prompt injection, conflicting policies a
AI.info Team · Written with AI ·
AI agents need broad access to data and tools to complete complex tasks, but broad permissions are exactly what security engineering tries to limit. A report published by Google Research on October 5 proposes a middle layer: a contextual policy engine that decides whether an agent’s next action fits the user’s request and the norms of the situation.
The proposal is a research framework, not a newly released Google product. The report, produced from a late-2025 workshop in New York, frames the problem as controlling systems that plan probabilistically, handle ambiguous instructions and may delegate work to other agents—conditions that can make fixed permissions and repeated user prompts inadequate.
Why static permissions miss the problem
Conventional software can often be restricted with fixed rules about which files or services it may access. An agent may need different access as a task changes: organizing conference travel, for example, could involve sharing different personal details with an airline, a visa service and an event organizer. A permission granted at the start may be too broad later, while a narrow rule may prevent the agent from doing useful work.
The report draws on Contextual Integrity, a theory of privacy that focuses on whether information flows are appropriate for a particular setting, rather than treating privacy only as secrecy or user control. Its authors extend that idea to actions as well as data sharing. “The core challenge of controlling AI agents lies in precisely understanding which actions are appropriate in every context in which the agent operates and enforcing such appropriate behavior,” write the authors of Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle.
A policy engine between plans and tools
The proposed engine has two jobs. First, it turns contextual norms and a user’s request into a formal policy that software can check; if it cannot determine the rule, it can ask the user to clarify. Second, a runtime enforcer checks a proposed action against that policy and the agent’s current state, then allows, denies or modifies the action—or requests confirmation.
That separation puts a control point between the model that plans and the external tools that carry out its requests. The report describes the design as a pattern shared by several existing research systems, including Conseca, rather than claiming to introduce a finished implementation. It also says there is no agreed policy language for arbitrary agents, or consensus on what such a language must support.
The guardrail has its own blind spots
A policy engine still has to interpret vague instructions such as “keep this between us” and convert them into enforceable rules without losing the user’s meaning. It may lack important details about the user’s intent or the task environment, and the information it receives could include prompt injections or incorrect contextual rules. The authors identify separating trusted from untrusted context as an open research problem.
Conflicts pose another test. A user’s preference may collide with legal or social requirements, and agents representing different users may bring incompatible rules into a shared task. The report argues that a policy engine must distinguish preferences from values and requirements, but leaves the way to resolve competing policies unsettled.
Testing the proposal at agent scale
Enforcement also has to work across many users, policies, tools and concurrent agent tasks. The report specifically flags latency and computing costs, asking how systems can check complex, stateful permissions at the scale of billions of simultaneous agent loops. Frequent requests for clarification could also burden users and prompt them to abandon an agent, the report warns.
For evaluation, the authors call for standardized, multi-agent “Agent Gym” environments where researchers can simulate long-running interactions and cascading effects in controlled settings. Google Research says the workshop report draws on more than 50 academic and industry contributors; the report itself describes workshop deliberations involving more than 30 leaders. It closes with a call for work across system enforcement, model reasoning, user controls and shared governance—not a deployment announcement or a timetable for a Google policy engine.