Integrous AI Systems Design: Bruce Schneier on the Leg of the Triad Nobody Studied

Confidentiality has a budget line. Availability has an SLO. Integrity has a checkbox and a hash, and that is roughly where the industry left it. The claim Bruce Schneier brings to [un]prompted II — most people type it unprompted — is that the least-studied leg of the CIA triad is becoming the most important property of AI-driven systems, and that it has to be solved before we trust AI to act on people's behalf, not after. If that is right, a good deal of current agent deployment is out of order. Our guide to the conference covers the rest of the programme.

The talk is Integrous AI Systems Design, from Bruce Schneier (Fellow and Lecturer, Harvard Kennedy School; University of Toronto), Day 3, Stage 1, 11:35, per the official agenda as published on 2026-10-12. We wrote this brief from that published abstract, before the talk. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following the conference remotely. Nothing here is a quote, and agendas change.

What the unprompted abstract says it will show

Integrity, the least-studied leg of the CIA triad, is becoming the most important property for AI-driven systems. The abstract names four kinds: data, processing, storage and contextual integrity. And it makes a sequencing claim — these must be solved before trusting AI to act for people.

Four nouns and a precondition. The precondition is the part with teeth: every agent deployment currently in production has already skipped it.

Why this is the hard part

Our analysis, not the speaker's. Confidentiality fails visibly: data appears somewhere it should not, and someone can point at it. Integrity fails invisibly. A poisoned retrieval, a reasoning chain that looks right, a memory entry nobody wrote, an approval describing something other than what was signed — each produces a system that runs normally and is wrong. No stack alerts on “correct output, corrupted path”.

Agents make this acute for a structural reason: an agent's input is its own prior output. Memory, scratchpad, tool results and summaries all re-enter the context as fact. A single integrity failure does not stay a failure; it becomes a premise. We traced that mechanism in memory poisoning in long-running agents, and the structural version in supply-chain risk in agentic pipelines.

The four kinds map onto work elsewhere on this agenda. The mapping below is ours, not the speaker's.

Kind of integrity	How it fails for an agent	Nearest session on the agenda
Data	A poisoned tool response is stored as fact and resurfaces in a later task	Giorgio Severi (Microsoft) and David Yang (PhD candidate, RPI; Microsoft) on Memory Dojo, Day 2 Stage 1
Processing	Benign-looking reasoning, attacker-chosen answer	Giorgio Severi (AI Safety Research, Microsoft) on backdoors that evade CoT monitoring, Day 1 Stage 2
Storage	No record of which runner, policy or signature produced an artefact	Aishwarya Athreya (Visa) and Kavia Venkatesh (Cigna) on the Open PBOM specification, Day 3 Stage 2
Contextual	The human approves a summary written by the agent, not the operation signed	Felipe Zimmerle (CTO, KonaSense) and Rodrigo Branco (Vulnerability Researcher, Anthropic), Day 3 Stage 1

Two of those are worth sitting with. The Open PBOM specification — a machine-readable schema recording a build's execution context, including runner identities, policies and signatures — is storage integrity as a file format, which is what the property looks like when an engineer has to ship it. And the approval problem is contextual integrity in one sentence: an approval not bound to the exact operation is not an approval, however good the dialog.

What we will be watching for

• Whether contextual integrity gets an operational definition. It is the most useful of the four and the hardest to test. Without one, it stays a principle people cite approvingly.
• The sequencing claim, taken literally. “Solve integrity first” is either a research agenda or a deployment moratorium. Which one it is determines who has to act.
• Whether the framing admits a partial answer. Most teams cannot solve four integrities. They can instrument one, and it would help to know which pays first.
• How it lands against the talk that follows it. Sounil Yu (creator of the Cyber Defense Matrix and the DIE Triad) is on the same stage at 12:00 proposing least agency as a complement to least privilege, with a C4 model — Crown, Chassis, Conscience, Committee — for mapping control points and accountability. Integrity says what must be true; least agency says how much the agent may do. Back-to-back, those are the two halves of the same design argument.

If this holds, what changes on Monday

1. Pick one integrity and make it falsifiable this quarter. Storage is the cheapest start: record which runner, policy and signature produced each artefact, so you can tell an unverified artefact from a verified one.
2. Bind every approval to the operation, not to a description of it. If the thing a human reads is generated by the agent being approved, you have a loop, not a control.
3. Treat agent memory as untrusted input on every read, not only on write. Provenance per entry, expiry by default.
4. Write down what your system asserts and what it only assumes. Integrity failures hide in that gap.

Three questions we would ask Bruce Schneier

1. Is integrity testable, or only designable? Confidentiality has pentests and availability has chaos engineering. If there is no equivalent for integrity, the property is aspirational in practice.
2. What does contextual integrity mean concretely for an agent's memory — that an entry keeps its provenance, that it cannot be read outside the context that created it, or something stronger?
3. What is the first enforceable integrity control you would ask a team to ship? Not a principle: a control, with a failure mode a defender can observe.

Those are the questions the abstract leaves open. For the vocabulary in this thread — contextual integrity, least agency, PBOM, provenance — see our glossary for [un]prompted II, which marks which terms come from the agenda and which are our own shorthand.