CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Based on the provided search context, there is no mention of a framework named CONTINUITY or a paper titled "Security-Context Contracts for Composable LLM Agent Controls." The search results instead highlight two other recent frameworks for LLM agent security:

• A Framework for Formalizing LLM Agent Security (Siu et al., March 2026): This framework systematizes agent security through four contextual properties—task alignment, action alignment, source authorization, and data isolation—verified via oracle functions. It argues that security is contextual and that existing defenses often fail because they do not verify all four properties simultaneously against the full execution context.
• Alignment Contracts for Agentic Security Systems (May 2026): This work introduces alignment contracts with finite-trace semantics, focusing on enforcement soundness under an Effect Observability Assumption (EOA). It uses a reference monitor to enforce scope, allow/forbid constraints, and disclosure policies, ensuring that mediated effects remain within authorized boundaries regardless of the underlying LLM's behavior.

If CONTINUITY is a distinct or newer framework not covered in the provided search results, its specific details regarding security-context discontinuity and verifiable end-to-end composition are not available in the current context.

• Problem and framing. The paper addresses a core weakness in composable LLM-agent systems: security context often becomes fragmented or inconsistent as an agent moves across models, planners, tools, memory stores, and external services. In such systems, one component may reason under one trust assumption, while another executes with broader permissions, stale state, or weaker policy constraints. The work frames this as a security-context discontinuity problem, where the security guarantees intended for the overall agent are not preserved at component boundaries.

• Key contribution. CONTINUITY is introduced as a contract-based framework for composing LLM-agent controls in a verifiable way. Rather than treating security as a property of a single model or prompt, it specifies security-context contracts that can be checked across agent components—covering concerns such as trust boundaries, permitted capabilities, data-flow constraints, provenance, and policy obligations. The goal is to make secure composition explicit: each component’s behavior should be governed by a shared, inspectable security context, and the end-to-end agent should be able to demonstrate that its composed controls satisfy the intended invariants.

• Why it matters. As LLM agents become more modular and capable of chaining reasoning, tool use, and autonomous action, ad hoc permission checks and prompt-level safeguards are unlikely to be sufficient. CONTINUITY matters because it shifts the design question from “how do we make a single agent safer?” to “how do we ensure that many agent components can be composed without silently degrading security?” For practitioners building multi-agent or tool-using systems, this kind of contract-based, verifiable approach provides a more principled path toward auditable, end-to-end secure agent architectures.