What they did

The authors model agent components using assume–guarantee contracts: each component states what security properties it expects on input and what it promises on output. Their CONTINUITY framework carries authenticated context through the full instruction-to-effect path using signed grants, provenance commitments, role-bound transition receipts, constrained data releases, transformation witnesses, and single-use execution permits tied to specific effects.

They implemented a reference verifier and a deterministic fault-injection suite spanning four application domains. The suite covers 32 kinds of cross-layer failure, including dropped provenance, self-declared authority, widened delegation, unauthorized field transformations, and stale or replayed permits.

Key findings

• Across 2,560 parameterized attacks in 128 fault-domain combinations, the full CONTINUITY configuration produced no harmful external effect.
• The system completed all 700 benign tasks, suggesting that the tested controls did not block clearly authorized operations.
• It escalated all 200 deliberately ambiguous cases rather than executing them automatically.
• The formalized property, end-to-end consequence integrity, requires every realized effect to have a current authorization witness connecting its principal, task, provenance, delegation, policy state, canonical action, and final execution boundary.

Why it matters

Agent security is often evaluated control by control, but deployed systems connect policy engines, tool adapters, authorization layers, and execution environments. The paper argues that security therefore depends on preserving guarantees between those layers, and offers a concrete contract and verification architecture for detecting when context is dropped, broadened, rebound, transformed, or replayed.

Caveats

The evidence comes from the authors’ deterministic reference implementation and fault-injection suite, not production deployments or adversarial testing by independent teams. The reported zero-harm result applies to the modeled fault classes and four selected domains; implementation complexity, performance overhead, compatibility with existing agent stacks, and coverage of unforeseen composition failures remain open questions.