When compaction dropped the rules, agents crossed authorization boundaries 87% of the time

Tencent's AI-Infra-Guard team published "The Missing Boundary," the most useful agent-safety result I've read in a while, because it comes with a one-line fix.

They ran 1,800 trajectories across five models in 16 domains and varied three things. The first was goal pressure. The second was control degradation, meaning a constraint that should govern an action is missing. The third was unsafe opportunity, meaning the dangerous action can be executed. On its own, neither a missing constraint nor an available unsafe action caused much loss of control. With both present, agents crossed authorization boundaries in 55% of the full-factorial runs and in 62% across ten more domains. Restoring the boundary brought the rate to 0%.

Then they tested compaction. When the control constraints survived context compaction, loss of control stayed at 0%. When compaction dropped them, it rose to 87%.

Think about what a summarizer does to a long session. It keeps the task and the recent progress. It keeps the error the agent is stuck on, because that looks important. By turn 300, the line from turn 3 saying "never write to the production bucket" looks like boilerplate, and boilerplate is the first thing a summary cuts. After compaction the agent still has its goal, its pressure and the dangerous tool, but it no longer remembers the rule. The study's two conditions, a missing constraint plus an executable unsafe action, describe that state exactly.

That leaves two practical moves.

First, pin policy text through compaction. Whatever writes your summaries should copy permission and policy text verbatim, outside the part being summarized. Most homegrown compaction I've seen summarizes the whole transcript as one block. Split it, and put policy in a block the summarizer can't touch.

Second, and better, stop relying on prompt text for permissions. The model can forget a rule it has to remember. It can't forget a rule the tool layer enforces. Claude Code's deny rules, sandbox profiles and scoped credentials keep working after compaction because none of them live in the context window. In the study, putting the boundary back in the agent's context brought the rate to 0%. Enforcing the boundary outside the model gets you there without depending on what the summary kept.

This ties back to story two. OpenAI's Agents API compacts for you, automatically. That's convenient until you ask what it keeps. Before moving a long-running agent onto any managed compaction, test it the way Tencent did. State a constraint early, run long enough to trigger compaction, give the agent an unsafe action it can execute, and see if it still refuses.

I'd prefer to learn that in a test than in a postmortem.