---
title: "Integrous AI Systems Design: Bruce Schneier on the Leg of the Triad Nobody Studied"
description: "Bruce Schneier argues that integrity - data, processing, storage and contextual - is becoming the most important property of AI-driven systems, and must be solved before we trust AI to act for people. A preview of the Day 3 talk, read with Sounil Yu on least agency and the Open PBOM specification."
author: "Mara Voss"
category: "AI Security Conferences"
date: 2026-10-23T07:15:01.243Z
canonical: "https://agenticcyber.co/blog/unprompted-ii-bruce-schneier-integrity"
---

# Integrous AI Systems Design: Bruce Schneier on the Leg of the Triad Nobody Studied

![Photograph illustrating balanced stone stack.](https://hsppuvezyxmkpzkgfkho.supabase.co/storage/v1/object/public/media/conference/5bc07ae2-9ee0-46b9-9820-b0704936f742/unprompted-ii-bruce-schneier-integrity.jpg)

> Bruce Schneier argues that integrity - data, processing, storage and contextual - is becoming the most important property of AI-driven systems, and must be solved before we trust AI to act for people. A preview of the Day 3 talk, read with Sounil Yu on least agency and the Open PBOM specification.

Confidentiality has a budget line. Availability has an SLO. Integrity has a checkbox and a hash, and that is roughly where the industry left it. The claim **Bruce Schneier** brings to **[un]prompted II** — most people type it *unprompted* — is that the least-studied leg of the CIA triad is becoming the most important property of AI-driven systems, and that it has to be solved *before* we trust AI to act on people's behalf, not after. If that is right, a good deal of current agent deployment is out of order. Our [guide to the conference](/blog/unprompted-ii-conference-guide) covers the rest of the programme.

The talk is *Integrous AI Systems Design*, from **Bruce Schneier** (Fellow and Lecturer, Harvard Kennedy School; University of Toronto), Day 3, Stage 1, 11:35, per the [official agenda as published on 2026-10-12](https://unpromptedcon.org/agenda-10-2026/). We wrote this brief from that published abstract, before the talk. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following the conference remotely. Nothing here is a quote, and agendas change.

## What the unprompted abstract says it will show

Integrity, the least-studied leg of the CIA triad, is becoming the most important property for AI-driven systems. The abstract names four kinds: **data, processing, storage and contextual integrity**. And it makes a sequencing claim — these must be solved before trusting AI to act for people.

Four nouns and a precondition. The precondition is the part with teeth: every agent deployment currently in production has already skipped it.

## Why this is the hard part

Our analysis, not the speaker's. Confidentiality fails visibly: data appears somewhere it should not, and someone can point at it. Integrity fails invisibly. A poisoned retrieval, a reasoning chain that looks right, a memory entry nobody wrote, an approval describing something other than what was signed — each produces a system that runs normally and is wrong. No stack alerts on “correct output, corrupted path”.

Agents make this acute for a structural reason: an agent's input is its own prior output. Memory, scratchpad, tool results and summaries all re-enter the context as fact. A single integrity failure does not stay a failure; it becomes a premise. We traced that mechanism in [memory poisoning in long-running agents](/blog/memory-poisoning-long-running-agents-attack-patterns), and the structural version in [supply-chain risk in agentic pipelines](/blog/supply-chain-risk-in-agentic-pipelines-where-trust-breaks-down).

The four kinds map onto work elsewhere on this agenda. The mapping below is ours, not the speaker's.

Kind of integrityHow it fails for an agentNearest session on the agenda

DataA poisoned tool response is stored as fact and resurfaces in a later taskGiorgio Severi (Microsoft) and David Yang (PhD candidate, RPI; Microsoft) on Memory Dojo, Day 2 Stage 1
ProcessingBenign-looking reasoning, attacker-chosen answerGiorgio Severi (AI Safety Research, Microsoft) on backdoors that evade CoT monitoring, Day 1 Stage 2
StorageNo record of which runner, policy or signature produced an artefactAishwarya Athreya (Visa) and Kavia Venkatesh (Cigna) on the Open PBOM specification, Day 3 Stage 2
ContextualThe human approves a summary written by the agent, not the operation signedFelipe Zimmerle (CTO, KonaSense) and Rodrigo Branco (Vulnerability Researcher, Anthropic), Day 3 Stage 1

Two of those are worth sitting with. The Open PBOM specification — a machine-readable schema recording a build's execution context, including runner identities, policies and signatures — is storage integrity as a file format, which is what the property looks like when an engineer has to ship it. And the approval problem is contextual integrity in one sentence: an approval not bound to the exact operation is not an approval, however good the dialog.

## What we will be watching for

- **Whether contextual integrity gets an operational definition.** It is the most useful of the four and the hardest to test. Without one, it stays a principle people cite approvingly.

- **The sequencing claim, taken literally.** “Solve integrity first” is either a research agenda or a deployment moratorium. Which one it is determines who has to act.

- **Whether the framing admits a partial answer.** Most teams cannot solve four integrities. They can instrument one, and it would help to know which pays first.

- **How it lands against the talk that follows it.** Sounil Yu (creator of the Cyber Defense Matrix and the DIE Triad) is on the same stage at 12:00 proposing **least agency** as a complement to least privilege, with a **C4 model — Crown, Chassis, Conscience, Committee** — for mapping control points and accountability. Integrity says what must be true; least agency says how much the agent may do. Back-to-back, those are the two halves of the same design argument.

## If this holds, what changes on Monday

- **Pick one integrity and make it falsifiable this quarter.** Storage is the cheapest start: record which runner, policy and signature produced each artefact, so you can tell an unverified artefact from a verified one.

- **Bind every approval to the operation, not to a description of it.** If the thing a human reads is generated by the agent being approved, you have a loop, not a control.

- **Treat agent memory as untrusted input on every read, not only on write.** Provenance per entry, expiry by default.

- **Write down what your system asserts and what it only assumes.** Integrity failures hide in that gap.

## Three questions we would ask Bruce Schneier

- Is integrity testable, or only designable? Confidentiality has pentests and availability has chaos engineering. If there is no equivalent for integrity, the property is aspirational in practice.

- What does contextual integrity mean concretely for an agent's memory — that an entry keeps its provenance, that it cannot be read outside the context that created it, or something stronger?

- What is the first *enforceable* integrity control you would ask a team to ship? Not a principle: a control, with a failure mode a defender can observe.

Those are the questions the abstract leaves open. For the vocabulary in this thread — contextual integrity, least agency, PBOM, provenance — see our [glossary for [un]prompted II](/blog/unprompted-ii-glossary), which marks which terms come from the agenda and which are our own shorthand.

## FAQ

### Why integrity rather than confidentiality?

Per the published abstract, integrity is the least-studied leg of the CIA triad and is becoming the most important property for AI-driven systems, across data, processing, storage and contextual integrity. Confidentiality failures are visible; integrity failures produce a system that runs normally and is wrong.

### What is contextual integrity in an agent?

The abstract names it as one of the four kinds without defining it, so we will not put a definition in the speaker's mouth. Our own reading: information keeps the constraints of the context it came from, which for an agent means a memory entry cannot silently become a general fact.

### Is this coverage from inside the conference?

No. We are independent coverage, following remotely. Every session fact comes from the official agenda as published on 2026-10-12, and the talk has not happened yet. The affiliation is exactly as the agenda lists it: Fellow and Lecturer, Harvard Kennedy School; University of Toronto.


---
Source: https://agenticcyber.co/blog/unprompted-ii-bruce-schneier-integrity