When Correct Security Controls Still Leak: The CONTINUITY Paper on Composable Agent Security

Here is an uncomfortable idea for anyone securing AI agents: you can assemble a provenance tracker, an authorization layer, a policy engine, protocol adapters and execution guards — each one individually correct — and still ship an end-to-end system that lets an agent do something it was never authorized to do. A new paper, CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls (arXiv:2609.05269, by Chris Zheng and Geng Yang), names that failure and shows how to close it. This is the plain-English version for security leaders.

The failure mode: security-context discontinuity

An agent action doesn't happen in one place. It travels: an instruction arrives, provenance is tagged, authorization is checked, policy is applied, a protocol adapter translates it, and finally something executes in the real world. The paper's core observation is that the security-critical context can be lost or corrupted every time the action crosses a boundary between those components. Four ways, specifically:

• Dropped — the "who" and "why" behind an action fall away, so a later component approves it blind.
• Widened — a narrowly-scoped grant is treated as broader than it was.
• Rebound — the action gets re-attached to a different target than the one that was authorized.
• Reinterpreted — the meaning of the request changes as it's translated across layers.

The authors call this security-context discontinuity, and it is why "we have all the right controls" is not the same as "we are secure." The individual controls can each pass their own tests. The vulnerability lives in the seams.

The fix: carry an authenticated context across every boundary

CONTINUITY treats composition as a first-class problem. It models each component with an assume-guarantee contract — what the component assumes about its input, and what it guarantees about its output — and then carries an authenticated security context across every transition. The machinery, in the paper's terms:

• Signed root grants — the authoritative statement of who is allowed to do what.
• Provenance commitments — a tamper-evident record of where the request came from.
• Role-bound transition receipts — proof that a hand-off between components preserved the role.
• Bounded typed releases — data leaves a component only within declared bounds.
• Transformation witnesses — evidence that a translation between layers didn't change the meaning.
• Effect-bound execution permits — the final action fires only against a permit that matches it exactly.

Consequence integrity, in one sentence

The property CONTINUITY guarantees is called end-to-end consequence integrity: every real external effect must be backed by a valid, current authorization witness that links the principal, task, provenance, delegation, policy state, canonical action, and finality boundary. Put plainly — nothing happens in the real world unless there's a complete, checkable chain of authorization behind it, and that chain is current, not stale.

Does it work? The numbers

The authors built a reference verifier and a deterministic cross-layer fault-injection suite covering 32 fault classes across four application domains. Then they ran it hard:

• 2,560 parameterized attack instances spanning 128 fault-domain classes.
• The full CONTINUITY configuration committed zero harmful external effects.
• It still completed all 700 benign tasks — the security didn't break normal work.
• And it escalated all 200 ambiguous cases to a human instead of guessing.

That last two points matter as much as the first. A control that blocks attacks by blocking everything is useless; CONTINUITY let legitimate work through and routed the genuinely unclear cases to a person. That is the shape of a control you can actually deploy.

What a CISO should take from it

You don't need to implement CONTINUITY to use its lesson. It changes the question you ask when you evaluate an AI-agent platform:

• Stop grading controls in isolation. "We have an authorization layer and a policy engine" says nothing about whether the context survives the trip between them. Ask vendors how security context is preserved across component boundaries.
• Trace the whole instruction-to-effect path. The dangerous gaps are at the seams — the adapter, the translation, the hand-off — not inside any one box. This is the same seam-level risk that MCP governance worries about when a server chains one action into another.
• Demand freshness, not just presence. "Consequence integrity" requires a current witness. An authorization that was valid a minute ago, applied to an action rebound to a new target, is exactly the failure this paper describes.
• Keep the human in the loop for the ambiguous cases. Escalation isn't a failure of automation; it's the design. It's the same principle behind defending against agent hijacking and behind sound MCP server governance.

CONTINUITY is a research result, not a product you can buy today. But it puts a precise name and a hard number on something CISOs have felt intuitively: a bag of correct controls is not a secure system. The security is in the contracts between them.

Frequently asked questions

What is security-context discontinuity?

It is the failure mode named in the CONTINUITY paper: when an AI agent action crosses component boundaries — provenance, authorization, policy, protocol adapters, execution — the security-critical context can be dropped, widened, rebound to a different target, or reinterpreted. Each control can be individually correct, yet the end-to-end system still allows a harmful action because the context that justified the decision did not travel with it.

What is the CONTINUITY framework?

CONTINUITY (arXiv:2609.05269, by Chris Zheng and Geng Yang) is a framework for verifiable composition of LLM-agent security controls. It models each component with an assume-guarantee contract and carries an authenticated security context across every transition using signed root grants, provenance commitments, role-bound transition receipts, bounded typed releases, transformation witnesses, and effect-bound execution permits.

What is consequence integrity?

Consequence integrity is CONTINUITY's end-to-end property: every realized external effect must be backed by a valid, current authorization witness that links the principal, the task, provenance, delegation, policy state, the canonical action, and the finality boundary. In plain terms, nothing happens in the real world unless there is a complete, verifiable chain of authorization behind it.

What were the results?

Across 2,560 parameterized attack instances spanning 128 fault-domain classes in four application domains, the full CONTINUITY configuration committed no harmful external effect, while completing all 700 benign tasks and escalating all 200 ambiguous cases.

Why does this matter for CISOs?

Most AI-agent security programs assemble good components and assume the sum is secure. This paper shows the gaps live at the seams between controls. When you evaluate an agent platform, ask how security context is preserved across boundaries, not just whether each control works in isolation.

Source

Chris Zheng and Geng Yang, "CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls," arXiv:2609.05269 (cs.CR, cs.AI), submitted 4 September 2026. This is an independent summary; figures and quotes are drawn from the paper's public abstract. PlayCISO is not affiliated with the authors.