Transitive Policies for Agents: Agent Permissions Don't Automatically Compose

Agent tool permissions do not compose across handoffs: a Writer agent, a read-only Reader agent and an email-only Sender agent can each stay within their own permissions while private customer data still reaches an attacker. The article calls the behavioral constraints that must survive these handoffs "transitive policies" and argues they require trusted runtime software outside the models to mediate data access, messages, tool calls and external actions.