Bell–LaPadula and agentic AI: controlling confidential information flows in Swarm
An agent may have legitimate access to a document without being authorised to send its contents to every available model, tool or recipient. In an agentic architecture, confidentiality therefore depends on how information moves: reading it, incorporating it into a context, transforming it and producing outputs from it.
This complements the integrity question addressed by Biba. A proposal can be admissible from an integrity perspective while containing information that its recipient is not cleared to receive. Authority to act and authority to disclose are separate constraints.
Bell–LaPadula provides a formal framework for this second control. In Swarm, its integration connects classifications, clearances and destination checks, with execution-flow coverage that remains partial.
Confidentiality as a property of flows
Bell and La Padula describe access constraints between subjects and objects associated with security levels and categories. In the usual shorthand, reading above a subject's level is prohibited: no read up. The star property constrains writes to prevent transfer to a lower classification: no write down. Read-write operations and trusted subjects require more precise treatment than these two abbreviations. Bell and La Padula, 1976
For an agentic system, the distinction between reading and output is essential. Document access control is insufficient if a context incorporating that document can subsequently be sent to an uncleared service. Control must apply at boundaries where bytes are actually exposed.
Clearance to read information does not authorise sending it to every destination the agent can reach.
Risk scenario: an authorised audit, an unauthorised transmission
Imagine a team asking an agent to summarise an internal audit. The dossier describes sensitive assets, weaknesses and outstanding measures. The organisation's policy classifies it as “Confidential — Audit”. The agent may read it to prepare an output in a cleared environment. This permission does not, by itself, cover an external rewriting service or a messaging channel available to a different audience.
The boundary fails when the agent chooses a convenient tool and sends its context to it. Without a check at this output, the request can carry asset names, findings and treatment priorities. Exposure begins with transmission: redacting the final answer cannot withdraw data already received by the service. Possible consequences include disclosure of audit information, exposure of an attack path and loss of control over retention and recipients.
Bell–LaPadula calls for checking the destination before transmission. For the ordinary output considered here, the recipient must cover the information's classification: a sufficient level and the Audit compartment. A usable account, a valid API key or an instruction generated by the model is not that clearance. The model distinguishes legitimate access to the dossier from permission to disclose its contents.
The required check concerns the exact bytes being committed and the actual recipient. It must still apply if the model proposes another tool, endpoint or account. Classification does not replace provider assessment, transport isolation or other action permissions. Protection depends on mediation of the paths that are actually available.
Risk scenario: a confidential summary reaches a shared log
Now consider an agent receiving an audit dossier classified “Confidential — Audit” and an “Internal — HR” note. It prepares a summary connecting an access-control issue with information about team organisation. Even a short summary can retain both kinds of information.
A multi-agent chain may then copy the answer into shared memory, a ticket or an error log intended for a wider audience. If every transformation is treated as new, unrestricted data, classification disappears while the information remains. The risk concerns later readers of these destinations: uncleared teams, other agents or export recipients. It can arise through normal output handling without any hostile instruction.
A summary does not become public merely because it is shorter than its sources. Under the conservative reasoning used here, context combines the highest source level with the union of their compartments. An output must remain compatible with this domain. An Internal log, or a destination covering HR alone, does not satisfy that condition for a “Confidential — HR and Audit” context.
This also shows the limits of labelling alone: producers must attribute classifications and consumers must actually retain them. Swarm has dominance, combination and destination-check mechanisms; propagating these restrictions to all results, memories, logs, exports and alternative paths remains a condition of transverse protection. Declassification requires a separate procedure, authority and scope; it cannot be inferred from AI rewording.
Why agents make these risks more relevant
An application that reads, summarises and calls tools connects scopes that were previously separate. Indirect prompt injection can attempt to redirect these capabilities; a routing error may create a similar exposure. OWASP describes information exfiltration caused by instructions embedded in external content. OWASP — Prompt Injection
The question is therefore both “may this agent read?” and “what information has it received, and which destinations may receive it?”. Bell–LaPadula structures the second decision. An architecture can use equivalent controls without naming the model; absence of that name does not establish a leak. Risk arises when relevant outputs are not effectively governed by a confidentiality policy.
Levels and compartments in Swarm
Swarm represents a classification with a level and a set of compartments. Dominance requires both a sufficient level and all required compartments. A higher level cannot compensate for a missing compartment.
Consider a policy with Internal and Confidential levels, and HR and Audit compartments. A “Confidential — HR and Audit” context cannot be sent to a “Confidential — HR” destination: its level is sufficient but Audit is missing. An “Internal — HR and Audit” destination is also incompatible because its level is insufficient.
Levels, labels, compartments and clearances belong to the configured policy. The names used in this scenario do not establish a regulatory classification.
Context inherits restrictions from its sources
A prompt may combine instructions, memory, history, documents and structured parameters. Classifying only the attachment would leave the other inputs outside the confidentiality assessment.
Swarm calculates a combined classification from attributed sources using the highest level and the union of compartments. The principal must be cleared for that combination. An absent or unclassified source does not become public by default.
Admission fixes this confidentiality domain before transport. It reflects the information actually assembled, rather than the principal's maximum clearance. A later incompatible input requires a new authorised context; silently widening an execution's domain would undermine previous output checks.
This depends on classification provenance. An agent cannot make information public by writing a label in its answer. Attribution must be controlled and concern the actual content.
Bind the decision to the actual recipient
Output permission must concern the destination actually used. A provider name or the presence of an API key is insufficient.
Swarm's preparation integration binds an attributed destination to the configured connection, including its endpoint, model and configuration fingerprint. The decision reloads current information and refuses relevant discrepancies. This binding is intended to prevent an approved destination from being replaced between preparation and transmission.
Two mechanisms must be distinguished. The transport-decision operation checks compatibility without issuing a request. For classified preparations linked to an admission, the API worker applies a last-use check before constructing the HTTP request. It revalidates admission, configuration freshness and destination.
This integration has a targeted scope. When the relevant turn has no matching admission, the legacy path retains its behaviour. A check on one execution branch does not establish that every provider call is governed by Bell–LaPadula.
Rewording is not declassification
Summarising a document, changing its format or removing a few passages does not establish permission to disclose the result. A short answer may still reveal protected information, and an error may contain context data.
Swarm's domain contract provides an output classification, including for summaries and errors. Propagating that classification to all results, memories, logs and exports remains an integration task. A classification function alone does not establish enforcement by every consumer.
Declassification is separate and requires its own authority and conditions. Swarm currently provides no qualified human-declassification command. A new policy revision, an administrative role or a model's rewording does not substitute for that approval.
Reducing or transforming content does not, by itself, lower its confidentiality classification.
Available mechanisms and remaining scope
Swarm has revisioned policy mechanisms, classifications and clearances, controlled object attribution, source combination and immutable context admission. Targeted readers and the API-worker integration add concrete control boundaries.
Integration remains partial. Attribution by all producers, result inheritance, file and network access mediation, agent descendants and alternative paths must be addressed to establish end-to-end confidentiality. Global capability status remains distinct from these targeted mechanisms.
A preparation-quarantine policy can block emissions controlled by that mechanism. It is not general system confinement and cannot withdraw information already transmitted.
Verification must examine observable effects: legitimate access within scope; refusal when a level or compartment is missing; revalidation after policy change; no emission on the refused path; and control of relevant alternatives. A formal model or local tests alone do not establish the whole property in deployment.
Compose confidentiality and integrity
Biba and Bell–LaPadula address complementary dimensions. The former constrains integrity flows; the latter structures reading and disclosure conditions. Composing them requires consistent identification of subjects, objects and control boundaries.
Swarm's work connects provenance, authority, context and destination. The intended property is that an authorised action can neither acquire its authority from the content it processes nor expose that content to a destination incompatible with its classification.
The operational question becomes: which information did this execution receive, and which destinations are actually authorised to receive it?
Source code and documentation: Swarm on GitHub.