In earlier posts, we introduced contextual policies in Omnigent, showed them blocking slow-burn attacks, and used them to enforce a declared intent. How does the contextual policy workThe policy tracks three legs as session state:Private data , lit when the agent reads something confidential. A sub-agent that reads private data and then tries to send it out is already two legs in, and blocked. Private data access, untrusted input, and outbound communication are all ordinary capabilities, and a per-action authorization check clears each one. A contextual policy remembers which legs a session has touched and cuts the last one before private data can leave.