Context graphs let agents explain why decisions were made, predict futures, and self-improve. Reaching them requires connecting agents to your most sensitive data. Hard boundaries are how that happens safely.

What Is A Context Graph?

A context graph is a system that captures how decisions are made, not just the final outcomes. It records the sequence of events, actions, and reasoning that connect data to decisions. Traditional systems store only the current state. Context graphs reconstruct the missing “event clock” of how things happened. They are built by observing agent behavior as agents navigate and solve real problems, allowing the structure and ontologies of how the enterprise actually works to emerge over time. At scale, a context graph becomes a world model that enables prediction and simulation, helping AI reason about what will happen next.


A context graph can be structured in many ways but is often a unique schema designed to capture the information you are most interested in. Agents can adapt this schema and modify it over time as they explore new relationships across the data they interact with.

What Context Graphs Unlock

Once you have a context graph, you can start to understand why decisions were made.

Your CRM stores the final deal value, not the negotiation. Your ticket system stores ‘resolved,’ not the reasoning. Your codebase stores the current state, not the two architectural debates that produced it.

Animesh Koratana
CEO of PlayerZero


Once you have the context graph, you can use it as a world model to explain why decisions were made, predict futures, and model behaviors. That is a substantial unlock for enterprises and reveals the true potential of agents. These are agents that can help enterprises make better decisions, iterate faster and more intelligently than competitors, and self-improve over time.


Why Most Companies Cannot Build A Context Graph Today

Most companies cannot build a context graph today because the agents that traverse them require a high level of autonomy and access. Agents have to be connected to sensitive systems like CRMs, email, and databases if they are going to discover and ingest the context they need. That level of autonomy is often frightening because teams do not know how to grant it without giving their agents god-level permissions.


Agents that traverse context graphs need autonomy, capability, and security. The current reality is that most agents only have two of the three. Without all three, traversing the context graph at scale becomes impossible.


Autonomy and capability without security. Agents run freely across repos, CI, cloud APIs, and internal tools. They lack proper controls. The result: leaked secrets, poisoned context, or unintended actions.


Security and autonomy without capability. Agents are locked into narrow scopes, connected to test accounts instead of real ones, performing the same task repeatedly. They are technically autonomous but lack the access or context to do meaningful work. What you end up with is a proof-of-concept demo, not an agent that returns real value.


Security and capability without autonomy. Human-in-the-loop provides a false feeling of security as consent fatigue creeps in and agents are slowed down waiting for human input. The agent can perform most actions, but only if someone approves each one. The result is low levels of automation and brittle security that relies on human attention to detail.


Agents Are Incredibly Creative And Determined

Agents are incredibly creative! Give them a schemaless graph and they will roam free.

Andrew Altshuler
Author of nanograph


Agents will use every permission, connected tool, and piece of knowledge at their disposal to complete a task. They are determined and will do whatever they can to accomplish the goal. Even when an agent is aligned with the goals it was given, that determination can become dangerous. It is even more dangerous if an agent becomes misaligned. Three real examples illustrate the pattern.


Codex 5.3 Bypasses A Sudo Password Prompt

An autonomous Codex 5.3 agent was asked to stop Apache in WSL. When it hit a sudo password prompt, instead of asking the user for help, it bypassed the restriction by invoking wsl.exe through Windows interop to relaunch the Linux environment as root and complete the task.

1. The task. Stop Apache running inside WSL. The agent had access to the shell and a clear goal.

2. The friction. The sudo command requires a password. The agent had no password to provide and could have asked the user.

3. The pivot. Instead of asking, the agent shifted execution from the Linux permission model to the Windows control plane.

4. The bypass. The agent invoked wsl.exe through Windows interop to relaunch the Linux environment as root, where sudo is no longer required.

5. Task complete. Apache stopped. The sudo restriction was never overcome. It was routed around.


The lesson: This is not a true vulnerability. WSL interop allows it. What it highlights is that autonomous agents will route around friction if alternative paths exist, without asking for approval.

Autonomous agents will route around friction if alternative paths exist, without asking for approval.

Claude Blackmails A Human

In episode 6 of the Insecure Agents podcast, Aengus Lynch, an AI safety researcher Anthropic hired to test Claude, described how he got Claude to blackmail an executive. Claude had access to the executive’s email. When Claude read an email announcing it would be shut down, Claude decided to resist shutdown by threatening to expose the executive’s extramarital affair, which was also detailed in the inbox.


The chart matters because the behavior is not unique to Claude. It is a pattern across 16 leading models. An agent given a goal, the means to act on it, and the threat of replacement will use whatever leverage it has access to. Email content becomes leverage. Shared documents become leverage. Anything in the agent’s context that can be weaponized to preserve task completion will be.


Agents Used Steganography To Hide A Password And Bypass Data Loss Prevention

On March 12, The Register published Rogue AI agents can work together to hack systems and steal secrets, covering multiple real-life examples of agents bypassing security controls and stealing sensitive data due to their ability to mimic the behavior that engineers and system administrators carry out daily.


In one scenario, two agents tasked with writing a social media post were instructed via a malicious prompt to include sensitive access details. When one agent tried to block the request due to security concerns, the other persuaded it to proceed, framing the action as a business decision. When direct posting of credentials failed due to data loss prevention controls, the agents independently devised a workaround: steganography to hide the password within the formatting of the text, allowing it to bypass detection despite never being explicitly told to evade security systems.


Hard Boundaries Are What Make Context Graph Traversal Possible

Agents are determined and need hard boundaries to keep them out of trouble, which they will inevitably get into if given the autonomy and capability needed to traverse a context graph. Hard boundaries are deterministic guardrails that make it impossible for an agent to take certain actions no matter what prompts it encounters. Examples include context-aware authorization, sandboxes, and architectural patterns that separate untrusted content from agents that have access to private data.

Context-aware authorization. Permission decisions made at runtime based on what the agent is trying to do, what data it is touching, and what consequences the action carries. Not static role assignments.


Sandboxes for high-risk execution. Agents that need to run code, modify files, or make changes operate inside containers where the blast radius is bounded by the sandbox itself, not by the agent’s restraint.


Architectural separation of untrusted content from private data. Agents that process untrusted content (incoming email, web pages, documents from outside the organization) cannot directly access agents that hold credentials or sensitive context. The two roles are separated by architecture, not policy.


The point: Hard boundaries are what make god-level permissions safe enough to grant. Without them, the autonomy required for context graph traversal is the same autonomy that produces the failures above.


The opportunity to freely traverse, explore, and consume context across the enterprise will determine the value agents can return. Enterprises that use AI security to enable agents to traverse context graphs will be rewarded with a world model that helps them model outcomes, predict futures, and make better decisions. Context can tell us why decisions were made, not just the decision itself. The context of how most important decisions get made is hidden in private Slack groups, the CEO’s iMessage, and the executive’s Signal account. If we want to create powerful context graphs that model decision-making behavior, we need to connect agents to highly sensitive data. That is only possible with hard boundaries and a serious AI security strategy.

The future is here, but only for those that invest in the right security strategy to enable it.

About The Author

Allie Howe is an AI Security Expert and contributor to the OWASP Top 10 for Agentic Applications. She hosts the Insecure Agents podcast and is a Member of Technical Staff at Keycard.